# Ensure reverse path filtering is enabled

Necessity: Reverse Path Filtering (rp_filter) is a crucial kernel-level security feature that helps prevent IP spoofing attacks. It works by verifying that the source address of an incoming packet is reachable through the network interface on which the packet was received. If the check fails, the packet is dropped. Misconfiguring this setting by disabling it (setting to 0) makes the system vulnerable to attackers forging source IP addresses, which can be used to bypass firewall rules or launch denial-of-service attacks.

Auditing and Remediation: The audit script directly queries the kernel's current setting for 'net.ipv4.conf.all.rp_filter' to determine the system's state. The remediation script modifies this setting in the running kernel configuration and also saves it to a persistent configuration file (e.g., /etc/sysctl.d/99-security.conf) to ensure the setting is reapplied after a system reboot.

Recommended State Rationale: 
- Basic, Moderate, and Strict: All levels recommend a value of '1'. This enables 'Strict Mode' filtering as defined in RFC 3704. It is the most secure setting and is mandated by security benchmarks such as CIS. A value of '0' disables this protection entirely. A value of '2' enables 'Loose Mode', which is less secure as it only checks if the source is reachable via any interface, not necessarily the one it arrived on. For any standard server or workstation, 'Strict Mode' ('1') is the only appropriate security setting, hence its recommendation across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that reads the value of the 'net.ipv4.conf.all.rp_filter' kernel parameter using the 'sysctl' command. The script must output only the numerical value of this parameter, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single numerical command-line argument. The script must set both 'net.ipv4.conf.all.rp_filter' and 'net.ipv4.conf.default.rp_filter' to this value. The change must be made persistent by writing to a file in '/etc/sysctl.d/'. After writing the configuration, the script should apply the settings to the running kernel. The script must output 'true' on success and 'false' on failure.

