In this lesson, you will learn how the Linux kernel uses Reverse Path Forwarding (RPF) to detect and block incoming packets that attempt to spoof their source IP addresses.
The Problem: IP Spoofing
Normally, when a router or a multi-homed Linux host receives a packet, it looks at the destination IP address to decide where to send it next. However, malicious actors often perform "IP spoofing," where they forge the source IP of a packet to make it look like it originated from a trusted network. If your kernel isn't careful, it might process these packets as legitimate, potentially leaking data or participating in a reflected DoS attack.
How Reverse Path Forwarding Works
RPF is a security mechanism that performs a sanity check: "If I wanted to send a packet back to this source IP address, would I send it out through the same interface that this packet just arrived on?"
If the kernel’s routing table says the best path to that source IP is through a completely different interface, the incoming packet is likely spoofed. Instead of routing it, the kernel drops it immediately.
Configuring RPF in Linux
You control this behavior using the rp_filter sysctl parameter. You can see the current settings for your interfaces in /proc/sys/net/ipv4/conf/. There are three main modes:
0: No source validation.1(Strict Mode): The packet must arrive on the interface that the routing table identifies as the best path to the source. This is the most secure setting.2(Loose Mode): The packet is accepted if the source address is reachable via any interface on the host, even if it’s not the one it arrived on.
To enable strict mode on a specific interface, you would run:
# Enable strict RPF filtering on eth0
sysctl -w net.ipv4.conf.eth0.rp_filter=1
By enforcing this check at the kernel level, you ensure that your host does not inadvertently participate in network traffic that claims to be from a location that cannot physically reach your current entry point.
Key Takeaway: Reverse Path Forwarding validates that the source IP of an incoming packet is reachable through the same interface it arrived on, effectively mitigating IP spoofing attacks at the kernel level.