summaryrefslogtreecommitdiffstats
path: root/net/ipv4
diff options
context:
space:
mode:
authorJesper Dangaard Brouer <hawk@comx.dk>2009-02-22 00:06:20 -0800
committerDavid S. Miller <davem@davemloft.net>2009-02-22 19:54:47 -0800
commitb2cc46a8ee905d1d642e01761939879c495e3e3a (patch)
tree53de67ae5f324440b9a2c5ecc1c9722a5ae4c86a /net/ipv4
parent0117cfabe3ba9b430c6ff6eecd4fdc569977f24f (diff)
downloadop-kernel-dev-b2cc46a8ee905d1d642e01761939879c495e3e3a.zip
op-kernel-dev-b2cc46a8ee905d1d642e01761939879c495e3e3a.tar.gz
ipv4: Fix rp_filter description in net/ipv4/Kconfig.
The reverse path filter (rp_filter) will NOT get enabled when enabling forwarding. Read the code and tested in in practice. Most distributions do enable it in startup scripts. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4')
-rw-r--r--net/ipv4/Kconfig6
1 files changed, 4 insertions, 2 deletions
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 691268f..10c944d 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -35,7 +35,7 @@ config IP_ADVANCED_ROUTER
at boot time after the /proc file system has been mounted.
- If you turn on IP forwarding, you will also get the rp_filter, which
+ If you turn on IP forwarding, you should consider the rp_filter, which
automatically rejects incoming packets if the routing table entry
for their source address doesn't match the network interface they're
arriving on. This has security advantages because it prevents the
@@ -46,9 +46,11 @@ config IP_ADVANCED_ROUTER
rp_filter on use:
echo 1 > /proc/sys/net/ipv4/conf/<device>/rp_filter
- or
+ and
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
+ Note that some distributions enable it in startup scripts.
+
If unsure, say N here.
choice
OpenPOWER on IntegriCloud