From f5b2811a9af8c7f35630c971130c707f78f3caf2 Mon Sep 17 00:00:00 2001 From: Jesper Dangaard Brouer Date: Sun, 22 Feb 2009 00:06:20 -0800 Subject: [PATCH] --- yaml --- r: 134656 b: refs/heads/master c: b2cc46a8ee905d1d642e01761939879c495e3e3a h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/net/ipv4/Kconfig | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/[refs] b/[refs] index 1592916f2cff..1b7f5e5ac9e5 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 0117cfabe3ba9b430c6ff6eecd4fdc569977f24f +refs/heads/master: b2cc46a8ee905d1d642e01761939879c495e3e3a diff --git a/trunk/net/ipv4/Kconfig b/trunk/net/ipv4/Kconfig index 691268f3a359..10c944d42488 100644 --- a/trunk/net/ipv4/Kconfig +++ b/trunk/net/ipv4/Kconfig @@ -35,7 +35,7 @@ config IP_ADVANCED_ROUTER at boot time after the /proc file system has been mounted. - If you turn on IP forwarding, you will also get the rp_filter, which + If you turn on IP forwarding, you should consider the rp_filter, which automatically rejects incoming packets if the routing table entry for their source address doesn't match the network interface they're arriving on. This has security advantages because it prevents the @@ -46,9 +46,11 @@ config IP_ADVANCED_ROUTER rp_filter on use: echo 1 > /proc/sys/net/ipv4/conf//rp_filter - or + and echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter + Note that some distributions enable it in startup scripts. + If unsure, say N here. choice