Elastic Compute Service
Elastic Compute Service
Document
- Documentation
Elastic Compute ServiceElastic Compute ServiceBest PracticesImagesKernel fine-tuningModifying rp_filter parameter in Linux operating system
Copy page
Download PDFKernel fine-tuning
Modifying rp_filter parameter in Linux operating system
Copy pageDownload PDFModifying rp_filter parameter in Linux operating system
Modifying the rp_filter parameter to configure reverse path filtering mode for the server can help you prevent network security issues such as IP address spoofing.
warning
If the rp_filter parameter is configured incorrectly, it may block the source IP address and cause network disconnection. Additionally, enabling reverse routing verification may also lead to packet loss. In such cases, evaluate carefully before you modify the parameter.
Terms
About the rp_filter parameter
rp_filter (Reverse Path Filtering) is a network-related parameter in the Linux kernel. It defines rules for network interfaces to perform reverse routing on received packets. It also helps verify the legitimacy of packets entering network devices (such as routers, firewalls, servers and other devices with network interfaces) by using reverse routing verification. Valid values:
- 0: Disable reverse routing verification and do not verify the source IP address.
- 1: Enable strict reverse routing verification. If the interface that receives the packet is not the optimal reverse path, the packet check will fail. By default, the packet will be discarded if the check fails.
- 2: Enable loose reverse routing verification. If the source IP address cannot be reached through any interface, the packet check will fail.
Reverse routing verification
Reverse routing verification is a check performed on data packets entering a network device. When a data packet arrives at a network interface of a network device, the device will check its routing table based on the source IP address of the packet. This is to determine which network interface should be used to return a packet to that source IP address, which refers to the return path. If the network interface corresponding to the identified return path is inconsistent with the actual network interface through which the packet entered the device, the packet may be problematic and potentially a forged one. In such cases, the packet can be handled according to the corresponding policy.
Applicable scenarios
- Servers with multiple network interfaces
- In environments with multiple network interfaces, the rp_filter parameter can guide data packets to enter and exit through the intended network interfaces. This prevents packets from looping between different network interfaces.
- Preventing IP spoofing attacks
- On servers or hosts connected to the Internet, proper configuration of the rp_filter parameter enables checking the source IP addresses of inbound packets. This allows the system to discard packets that claim to originate from a subnet associated with a specific network interface but actually enter through an unintended network interface, thus avoiding IP spoofing.
- Filtering exceptional traffic
- In DDoS attack scenarios, attackers often forge source IP addresses to send massive amounts of packets. By properly configuring the rp_filter parameter to check the outbound paths corresponding to the source IP addresses of inbound packets, some abnormal packets with forged source IP addresses can be discarded. This discard process helps reduce invalid traffic flowing into the server.
- Asymmetric routing or other complex routing
- In scenarios using asymmetric routing or other complex routing setups, the rp_filter parameter can be configured to enable reverse routing verification (such as 1 or 2) to prevent normal packets from being discarded.
Procedure
The rp_filter parameter can be configured either globally (for all interfaces) or on a per-network interface basis.
warning
The actual effective value for each network interface is the maximum of the global (all) configuration and the configuration specific to that interface. For example: The global rp_filter parameter is set to 1, and the rp_filter parameter for the eth0 network interface is set to 2. In such cases, the actual effective value of the rp_filter parameter on the eth0 network interface is 2.
Configure the global parameter
The global parameter configured using this method applies the same reverse path filtering mode to all network interfaces, facilitating batch management.
You can use this method to temporarily modify the parameter value while the operating system is running. Each time the instance restarts, you need to configure the parameter again.
- Log in to the target instance. For more information, see Logging in to Linux instances.
- Execute the following command to view the value of the global rp_filter parameter.
-
- Sample output:
-
- Execute the following command to configure the rp_filter parameter.
-
tip
Replace 1 with the actual value required for your business. For more information, see About the rp_filter parameter.
You can use this method to permanently modify the parameter value while the operating system is running. You do not need to configure the parameter again after the instance restarts.
- Log in to the target instance. For more information, see Logging in to Linux instances.
- Execute the following command to view the current parameter value.
-
- Sample output:
-
- Modify the value of the rp_filter parameter.
- Execute the following command to create the net_rp_filter.conf file.
-
- Press the i key to enter edit mode and add the following content to the end of the file.
-
tip
Replace 1 with the actual value required for your business. For more information, see About the rp_filter parameter.
- Press the Esc key to exit edit mode, enter :wq, and then press Enter to save and exit the file.
- Execute the following command to make the configuration take effect.
-
- Sample output:
-
Configure the parameter for a specific network interface
This method allows you to specify the parameter value for a specific network interface without impacting the reverse path filtering mode of other network interfaces.
You can use this method to temporarily modify the parameter value while the operating system is running. Each time the instance restarts, you need to configure the parameter again.
- Log in to the target instance. For more information, see Logging in to Linux instances.
- Execute the following command to view the parameter value of the eth0 network interface.
-
tip
Replace eth0 with the actual name of the network interface.
- Sample output:
-
- Execute the following command to configure the rp_filter parameter.
-
tip
- Replace 1 with the actual value required for your business. For more information, see About the rp_filter parameter.
- Replace eth0 with the actual name of the network interface.
You can use this method to permanently modify the parameter value while the operating system is running. You do not need to configure the parameter again after the instance restarts.
- Log in to the target instance. For more information, see Logging in to Linux instances.
- Execute the following command to view the current parameter value.
-
tip
Replace eth0 with the actual name of the network interface.
- Sample output:
-
- Modify the value of the rp_filter parameter.
- Execute the following command to create the net_rp_filter.conf file.
-
- Press the i key to enter edit mode and add the following content to the end of the file.
-
tip
- Replace 1 with the actual value required for your business. For more information, see About the rp_filter parameter.
- Replace eth0 with the actual name of the network interface.
- Press the Esc key to exit edit mode, enter :wq, and then press Enter to save and exit the file.
- Execute the following command to make the configuration take effect.
-
- Sample output:
-
Last updated: 2026.06.18 17:49:52
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
