Persist rp_filter=0 on every router interface #539

Merged

benvin merged 1 commits from benvin/router-sysctl into develop 2026-10-04 16:02:01 +11:00

Conversation 1 Commits 1 Files Changed 1

+4

unkin-agent commented 2026-10-04 15:51:13 +11:00

Member

Copy Link

Copy Source

Effective rp_filter is max(all, ). Setting all/default to 0 is not enough after a reboot: /usr/lib/sysctl.d/50-redhat.conf sets net.ipv4.conf.*.rp_filter = 1, which udev applies to every interface as it is created, so routed asymmetric traffic gets dropped once shorewall goes.

• add net.ipv4.conf.*.rp_filter: 0 to the router role, overriding the vendor glob
• disable enforce for it, since sysctl -n cannot read glob keys

Effective rp_filter is max(all, <iface>). Setting `all`/`default` to 0 is not enough after a reboot: `/usr/lib/sysctl.d/50-redhat.conf` sets `net.ipv4.conf.*.rp_filter = 1`, which udev applies to every interface as it is created, so routed asymmetric traffic gets dropped once shorewall goes. - add `net.ipv4.conf.*.rp_filter: 0` to the router role, overriding the vendor glob - disable `enforce` for it, since `sysctl -n` cannot read glob keys

unkin-agent added 1 commit 2026-10-04 15:51:14 +11:00

Persist rp_filter=0 on every router interface c3cf5b2693

unkin-agent commented 2026-10-04 15:52:52 +11:00

Author

Member

Copy Link

Copy Source

No findings.

No findings.

benvin merged commit b74bced771 into develop 2026-10-04 16:02:01 +11:00

benvin deleted branch benvin/router-sysctl 2026-10-04 16:02:01 +11:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/puppet-prod#539