# Ensure reverse path filtering is enabled

Necessity: Reverse Path Filtering (rp_filter) is a crucial security mechanism that helps prevent IP address spoofing. When enabled, the kernel verifies that the source IP address of any incoming packet is reachable through the network interface it was received on. This mitigates the risk of an attacker forging a source IP address to launch denial-of-service (DoS) attacks (e.g., SMURF attacks) or to bypass network access controls. Disabling this feature makes the system significantly more vulnerable to such network-based attacks. Auditing and Remediation: The audit script checks the live kernel parameters 'net.ipv4.conf.all.rp_filter' and 'net.ipv4.conf.default.rp_filter' to ensure they are configured correctly. The remediation script sets these parameters in both the running configuration and a persistent sysctl configuration file to ensure the setting survives a reboot. Recommended State Rationale: A value of '1' enables strict reverse path filtering, which is the most secure mode and is recommended by security benchmarks like CIS. This mode is suitable for the vast majority of systems. A value of '2' (loose mode) exists but is less secure and should only be used in complex multi-homed network scenarios where asymmetric routing is present and unavoidable. Because '1' represents the most secure and universally applicable state, it is the recommended value for Basic, Moderate, and Strict security levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the runtime values of the 'net.ipv4.conf.all.rp_filter' and 'net.ipv4.conf.default.rp_filter' kernel parameters using the 'sysctl -n' command. The script must check both parameters and if they are identical, it must output their shared value. If they differ, it should return 'mismatch'. The output must contain only the value or the word 'mismatch' with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the desired value for reverse path filtering (e.g., '1'). The script must set both 'net.ipv4.conf.all.rp_filter' and 'net.ipv4.conf.default.rp_filter' to this value. The change must be applied to the running configuration using 'sysctl -w' and made persistent by writing to a file such as '/etc/sysctl.d/99-security-rp-filter.conf'. The script must return 'true' if the operation succeeds and 'false' if it fails.

