Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable ARP filtering #289

Merged
merged 2 commits into from
Jan 10, 2025
Merged

Enable ARP filtering #289

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
af1d069
Set `net.ipv4.conf.*.arp_filter=1`
raja-grewal Dec 19, 2024
1f8eee4
Add missing sentence full stop
raja-grewal Jan 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,8 +105,7 @@ Networking:
- Optional - Deny sending and receiving shared media redirects to reduce
the risk of IP spoofing attacks.

- Optional - Enable ARP filtering to mitigate some ARP spoofing and ARP
cache poisoning attacks.
- Enable ARP filtering to mitigate some ARP spoofing and ARP cache poisoning attacks.

- Optional - Respond to ARP requests only if the target IP address is
on-link, preventing some IP spoofing attacks.
Expand Down
4 changes: 2 additions & 2 deletions usr/lib/sysctl.d/990-security-misc.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -454,13 +454,13 @@ net.ipv6.conf.*.accept_redirects=0
#net.ipv4.conf.*.shared_media=0

## Enable ARP (Address Resolution Protocol) filtering.
## Prevents the Linux kernel from handling the ARP table globally
## Prevents the Linux kernel from handling the ARP table globally.
## Can mitigate some ARP spoofing and ARP cache poisoning attacks.
## Improper filtering can lead to increased ARP traffic and inadvertently block legitimate ARP requests.
##
## https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf
##
#net.ipv4.conf.*.arp_filter=1
net.ipv4.conf.*.arp_filter=1

## Respond to ARP (Address Resolution Protocol) requests only if the target IP address is on-link.
## Reduces IP spoofing attacks by limiting the scope of allowable ARP responses.
Expand Down