enable () { for file in $@; do echo 1 > $file; done }
disable () { for file in $@; do echo 0 > $file; done }
#Define local port range (the default range is 32768-61000)
$ECHO "32768 61000" > /proc/sys/net/ipv4/ip_local_port_range
#Set the TTL (Time To Live on onbound packet) size to give passive OS fingerprints a little more work to do (default is 64)
$ECHO "60" > /proc/sys/net/ipv4/ip_default_ttl
#The window scaling transmitted during the SYN segment, which should be shifted to left (default is 1; boolean)
enable /proc/sys/net/ipv4/tcp_window_scaling
#Disable the timestamps; can reduce overhead and hide passive OS fingerprints
disable /proc/sys/net/ipv4/tcp_timestamps
#Note that the following values are approximated for ADSL2+ Annex M 8mb/3mb
#The delay was choosen by pinging various destinations far away (e.g. from .fi to .jp)
#(8 000 000 bps / 8 bites-per-byte) / 0.400s = 400000
#(3 000 000 bps / 8 bites-per-byte) / 0.400s = 150000
#Tune core receiving buffer (default is 105472)
$ECHO "400000" > /proc/sys/net/core/rmem_max
#Tune core sending buffer (default is 105472)
$ECHO "150000" > /proc/sys/net/core/wmem_max
#Tune TCP receiving buffer (default is 4096 87380 174760)
$ECHO "4096 87380 400000" > /proc/sys/net/ipv4/tcp_rmem
#Tune TCP sending buffer (4096 16384 131072)
$ECHO "4096 87380 150000" > /proc/sys/net/ipv4/tcp_wmem
#We need to adjust also the TCP window scaling (default is 2)
$ECHO "4" > /proc/sys/net/ipv4/tcp_adv_win_scale
#Turn off IP forwarding in the kernel *before* all rules are loaded
disable /proc/sys/net/ipv4/ip_forward
#Disable dynamic IP addresses (enable if DHCP is going to be again used)
disable /proc/sys/net/ipv4/ip_dynaddr
#Enable tcp-syncookies
enable /proc/sys/net/ipv4/tcp_syncookies
#Disable inbound routed packets that may be spoofed (no legitimate use anyhow)
disable /proc/sys/net/ipv4/conf/*/accept_source_route
#Do not respond to packets that may cause a different interface than the one that is responding.
#This does not affect our setup as no dynamic routes are used.
enable /proc/sys/net/ipv4/conf/*/rp_filter
#Furthermore, do not send any redirects.
#This should not affect our setup as there are no alternative routes for clients.
disable /proc/sys/net/ipv4/conf/*/send_redirects
#Disable replies to ARP requests whenever we have a route to the host.
disable /proc/sys/net/ipv4/conf/*/proxy_arp
#Disable all insecure (ICMP) redirects
disable /proc/sys/net/ipv4/conf/*/accept_redirects
#Disable also redirects from trusted sources.
#This should not affect our setup as no multiple routers are used.
disable /proc/sys/net/ipv4/conf/*/secure_redirects
#Disable ICMP echo requests (ping packets); can hide ping sweeps but prevent legitimate use
disable /proc/sys/net/ipv4/icmp_echo_ignore_all
#Ignore ICMP broadcasts and bogus ICMP error messages
enable /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
enable /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
#Enable error message redirects so that the ICMP messages are sent back to the interface that caused the ICMP error (default: disabled)
enable /proc/sys/net/ipv4/icmp_errors_use_inbound_ifaddr
#Enable logging of all packets that have an IP that should not exist
enable /proc/sys/net/ipv4/conf/*/log_martians
#Reduce the ability of DoS by reducing TCP keepalive time (default is 7200)
$ECHO "3600" > /proc/sys/net/ipv4/tcp_keepalive_time
#Reduce the ability of DoS by reducing TCP-FIN timeout (default is 60)
$ECHO "10" > /proc/sys/net/ipv4/tcp_fin_timeout
#Reduce he ability o Dos by reducing the keepalive probe (default is 75)
$ECHO "50" > /proc/sys/net/ipv4/tcp_keepalive_intvl
#Define how many TCP keepalive probes kernel will sent before giving defining a connection broken (default is 9)
$ECHO "5" > /proc/sys/net/ipv4/tcp_keepalive_probes
#Set the number of SYN packets that the kernel will send before giving up on a new connection (default is 5)
$ECHO "3" > /proc/sys/net/ipv4/tcp_syn_retries
#Set the number (but not the timing) of the SYN-ACKs sent back before giving up (default is 5)
$ECHO "3" > /proc/sys/net/ipv4/tcp_synack_retries
#THE LAST-RESORT in case of DoS (do not enable unless absolutely neccessary)
disable /proc/sys/net/ipv4/tcp_abort_on_overflow