This is what my /etc/sysctl.conf looks like; this is not my total defense but only part of a much more larger strategy.
#
# /etc/sysctl.conf - Configuration file for setting system variables
# See sysctl.conf (5) for information.
#
vm.swappiness=10
#kernel.domainname = example.com
#Stop ping replies
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_echo_ignore_all = 1
# Uncomment the following to stop low-level messages on console
#kernel.printk = 4 4 1 7
##############################################################3
# Functions previously found in netbase
#
# Uncomment the next line to enable Spoof protection (reverse-path filter)
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter =1
net.ipv4.conf.lo.rp_filter =1
net.ipv4.conf.default.rp_filter =1
# Uncomment the next line to enable TCP/IP SYN cookies
net.ipv4.tcp_syncookies=1
# Disable ICMP Redirect Acceptance
net.ipv4.conf.all.accept_redirects =0
net.ipv4.conf.lo.accept_redirects =0
net.ipv4.conf.default.accept_redirects =0
# Enable bad error message Protection
net.ipv4.icmp_ignore_bogus_error_responses =1
# Don't Log Spoofed Packets, Source Routed Packets, Redirect Packets
net.ipv4.conf.all.log_martians =0
net.ipv4.conf.lo.log_martians =0
# Disables packet forwarding
net.ipv4.ip_forward=0
# Disables IP source routing
net.ipv4.conf.all.accept_source_route =0
net.ipv4.conf.lo.accept_source_route =0
net.ipv4.conf.default.accept_source_route =0
# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.conf.default.forwarding=1
# Uncomment the next line to enable packet forwarding for IPv6
#net.ipv6.conf.default.forwarding=1