TCP Syn Flood Hardening – Kernel IPv4 Settings

With the increasing TCP flood attacks and AI bot scraping floods, here are some optimizations that should be added to the end of your /etc/sysctl.conf file:

# Hardening
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.tcp_max_syn_backlog=2048
net.ipv4.tcp_synack_retries=2
net.ipv4.conf.all.accept_redirects=0

Reboot for the settings to take effect.

Turn on IPv4 Forwarding by running this script:

cd ~/Downloads
wget -N "http://dinofly.com/files/linux/ipv4_forward.tar.gz"
tar -zxvf ipv4_forward.tar.gz
sudo bash forwarding.sh

It should work on all versions of Linux but has been tested and works perfectly on Ubuntu.