Ignore ICMP redirects and source-routed packets, and send no redirects

Description

These kernel settings decide whether the network may change how the system routes its traffic:

• accept_redirects (IPv4 and IPv6) and secure_redirects (IPv4, redirects from known gateways): whether ICMP redirect messages update the routing table;
• accept_source_route (IPv4 and IPv6): whether packets carrying their own route are accepted;
• send_redirects (IPv4): whether the system sends redirects, which only routers should do.

This control sets them all to 0, for all and for default (interfaces created later).

Debian ships accept_redirects, secure_redirects and send_redirects enabled. ufw, when active, also sets the accept_redirects keys to 0 from /etc/ufw/sysctl.conf. IPv6 checks only run when the IPv6 stack is present.

Rationale

An attacker on the local network can send forged ICMP redirects to make the system send its traffic through the attacker's host (man in the middle). Source routing lets a packet choose its own path, which can bypass filtering. A host that sends redirects is acting as a router and gives away information about the network.

Impact

None known for hosts. Routers that must send redirects are covered by tailoring this control out together with CB-DEB-NET-009.

Setting

Audit

Run sysctl -a 2>/dev/null | grep -E 'conf\.(all|default)\.(accept_redirects|secure_redirects|accept_source_route|send_redirects) '. Every listed value must be 0, for IPv4 and IPv6. Then check that no file in /etc/sysctl.d/, /run/sysctl.d/, /usr/lib/sysctl.d/ or /etc/sysctl.conf sets another value.

Automated: every check must pass. Scanners report each check by its id.

ipv4-all-accept-redirects

net.ipv4.conf.all.accept_redirects.

key: net.ipv4.conf.all.accept_redirects
value: 0

ipv4-default-accept-redirects

net.ipv4.conf.default.accept_redirects.

key: net.ipv4.conf.default.accept_redirects
value: 0

ipv4-all-secure-redirects

net.ipv4.conf.all.secure_redirects.

key: net.ipv4.conf.all.secure_redirects
value: 0

ipv4-default-secure-redirects

net.ipv4.conf.default.secure_redirects.

key: net.ipv4.conf.default.secure_redirects
value: 0

ipv4-all-send-redirects

net.ipv4.conf.all.send_redirects.

key: net.ipv4.conf.all.send_redirects
value: 0

ipv4-default-send-redirects

net.ipv4.conf.default.send_redirects.

key: net.ipv4.conf.default.send_redirects
value: 0

ipv4-all-source-route

net.ipv4.conf.all.accept_source_route.

key: net.ipv4.conf.all.accept_source_route
value: 0

ipv4-default-source-route

net.ipv4.conf.default.accept_source_route.

key: net.ipv4.conf.default.accept_source_route
value: 0

ipv6-all-accept-redirects

net.ipv6.conf.all.accept_redirects.

key: net.ipv6.conf.all.accept_redirects
value: 0

ipv6-default-accept-redirects

net.ipv6.conf.default.accept_redirects.

key: net.ipv6.conf.default.accept_redirects
value: 0

ipv6-all-source-route

net.ipv6.conf.all.accept_source_route.

key: net.ipv6.conf.all.accept_source_route
value: 0

ipv6-default-source-route

net.ipv6.conf.default.accept_source_route.

key: net.ipv6.conf.default.accept_source_route
value: 0

Remediation

Add to /etc/sysctl.d/60-cirsec.conf, for all and default, IPv4 and IPv6:

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_source_route = 0

(and the same lines with default), remove other assignments, then run sysctl --system.

Rollback

Remove the lines from /etc/sysctl.d/60-cirsec.conf and set the previous values with sysctl -w.

ipv4-all-accept-redirects

Generated from check ipv4-all-accept-redirects: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipv4-default-accept-redirects

Generated from check ipv4-default-accept-redirects: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipv4-all-secure-redirects

Generated from check ipv4-all-secure-redirects: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipv4-default-secure-redirects

Generated from check ipv4-default-secure-redirects: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipv4-all-send-redirects

Generated from check ipv4-all-send-redirects: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipv4-default-send-redirects

Generated from check ipv4-default-send-redirects: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipv4-all-source-route

Generated from check ipv4-all-source-route: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipv4-default-source-route

Generated from check ipv4-default-source-route: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipv6-all-accept-redirects

Generated from check ipv6-all-accept-redirects: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipv6-default-accept-redirects

Generated from check ipv6-default-accept-redirects: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipv6-all-source-route

Generated from check ipv6-all-source-route: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ipv6-default-source-route

Generated from check ipv6-default-source-route: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Linux kernel documentation - IP Sysctl The Linux Kernel Organization, vendor-doc, accessed 2026-10-18
• RFC 5095 - Deprecation of Type 0 Routing Headers in IPv6 IETF, rfc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R12) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle