---
title: "HOST-KRN-013 Reverse Path Filtering Disabled"
canonical: https://openvapt.com/checks/HOST-KRN-013.html
html: https://openvapt.com/checks/HOST-KRN-013.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-KRN-013 Reverse Path Filtering Disabled

Checks that the kernel drops packets whose source address could not be routed back through the receiving interface.

- Domain: Server
- Severity: Low
- Control category: Secure Configuration
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N`
- CIS Controls v8: 4.1
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-940
- NIST SP 800-53 Rev. 5: SC-7, CM-6
- Benchmark topic: Kernel parameters: net.ipv4.conf.all.rp_filter (topic only, no benchmark text)

## Why It Matters

Reverse path filtering blocks many spoofed-source packets used in attacks and amplification.

## How It Detects

Reads /proc/sys/net/ipv4/conf/*/rp_filter directly (all, default for future interfaces, and every interface except loopback; no command is run) and combines the all value with each interface value as the kernel does. The kernel uses the larger of the two values, so an interface passes when that larger value is 1 (strict) or 2 (loose).

## How to Fix

Create /etc/sysctl.d/60-openvapt-hardening.conf containing:  net.ipv4.conf.all.rp_filter = 1  then apply with: sysctl --system

## How to Verify

```
sysctl net.ipv4.conf.all.rp_filter  should print 1.
```

## Learn the Theory

- [P1 Linux Server Hardening](https://openvapt.com/academy/p1.md)

## References

- [Linux kernel documentation, IP sysctl](https://docs.kernel.org/networking/ip-sysctl.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go

Run it: `openvapt scan --only HOST-KRN-013`. Read it offline: `openvapt explain HOST-KRN-013`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-KRN-013.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.