warchild

$ cat interface-secure
# Script-name: /etc/network/interface-secure
     # Modifies some default behaviour in order to secure against
     # some TCP/IP spoofing & attacks
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # broadcast echo protection enabled
echo 0 > /proc/sys/net/ipv4/ip_forward             # ip forwarding disabled
echo 1 > /proc/sys/net/ipv4/tcp_syncookies         # TCP syn cookie protection enabled
echo 1 >/proc/sys/net/ipv4/conf/all/log_martians   # Log packets with impossible addresses
                                                   # but be careful with this on heavy loaded web servers
echo 1 > /proc/sys/net/ipv4/ip_always_defrag       #  defragging protection always enabled
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses # bad error message protection enabled

     # now ip spoofing protection
     for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
             echo 1 > $f
     done

     # and finally some more things:
     # Disable ICMP Redirect Acceptance
     for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
             echo 0 > $f
     done

     for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
           echo 0 > $f
     done

     # Disable Source Routed Packets
     for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
             echo 0 > $f
     done

     # Log Spoofed Packets, Source Routed Packets, Redirect Packets
     for f in /proc/sys/net/ipv4/conf/*/log_martians; do
             echo 1 > $f
     done