From: Jesper Dangaard Brouer Date: Sun, 22 Feb 2009 08:06:20 +0000 (-0800) Subject: ipv4: Fix rp_filter description in net/ipv4/Kconfig. X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=b2cc46a8ee905d1d642e01761939879c495e3e3a;p=openwrt%2Fstaging%2Fblogic.git ipv4: Fix rp_filter description in net/ipv4/Kconfig. The reverse path filter (rp_filter) will NOT get enabled when enabling forwarding. Read the code and tested in in practice. Most distributions do enable it in startup scripts. Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller --- diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig index 691268f3a359..10c944d42488 100644 --- a/net/ipv4/Kconfig +++ b/net/ipv4/Kconfig @@ -35,7 +35,7 @@ config IP_ADVANCED_ROUTER at boot time after the /proc file system has been mounted. - If you turn on IP forwarding, you will also get the rp_filter, which + If you turn on IP forwarding, you should consider the rp_filter, which automatically rejects incoming packets if the routing table entry for their source address doesn't match the network interface they're arriving on. This has security advantages because it prevents the @@ -46,9 +46,11 @@ config IP_ADVANCED_ROUTER rp_filter on use: echo 1 > /proc/sys/net/ipv4/conf//rp_filter - or + and echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter + Note that some distributions enable it in startup scripts. + If unsure, say N here. choice