sysctl.conf

###################################################################
# Networking

# Disable IPv6
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.all.disable_ipv6=1

# Enable eBPF JIT compiler
net.core.bpf_jit_enable=1

# Disable host to route packets between interfaces
net.ipv4.ip_forward=0

# Turn on Source Address Verification in all interfaces to prevent some spoofing attacks
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1

# Do not accept IP source route packets (we are not a router)
net.ipv4.conf.default.accept_source_route=0
net.ipv4.conf.all.accept_source_route=0

# Disable ICMP redirects. ICMP redirects are rarely used but can be used in
# MITM (man-in-the-middle) attacks. Disabling ICMP may disrupt legitimate
# traffic to those sites.
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.all.accept_redirects=0

# Ignore bogus ICMP errors
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.icmp_echo_ignore_all=0

# Log Martian Packets (impossible packets)
net.ipv4.conf.default.log_martians=1
net.ipv4.conf.all.log_martians=1

# Change to '1' to enable TCP/IP SYN cookies This disables TCP Window Scaling
# (http://lkml.org/lkml/2008/2/5/167)
net.ipv4.tcp_syncookies=0

# Normally allowing tcp_sack is ok, but if going through OpenBSD 3.8 RELEASE or
# earlier pf firewall, should set this to 0
net.ipv4.tcp_sack=1