sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2

This switches the RFC3704 Reverse Path filtering from Strict mode to Loose
mode. The Strict mode breaks some pretty common and reasonable use cases,
such as keeping connections via one default route alive after another one
appears (e.g. plugging an Ethernet cable when connected via Wi-Fi).

The strict filter also makes it impossible for NetworkManager to do
connectivity check on a newly arriving default route (it starts with a
higher metric and is bumped lower if there's connectivity).

Kernel's default is 0 (no filter), but a Loose filter is good enough. The
few use cases where a Strict mode could make sense can easily override
this.

The distributions that don't care about the client use cases and prefer a
strict filter could just ship a custom configuration in
/usr/lib/sysctl.d/ to override this.

diff --git a/NEWS b/NEWS
index d9f4e2be94c6d855a304fda66f8c3c0839f3cdb5..bbd1e2d8a1d63b01bd9a42835f97f957f13bb798 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -70,6 +70,15 @@ CHANGES WITH 240 in spe:
           glibc is going to make it available too. This locale enables UTF-8
           mode by default, which appears appropriate for 2018.
 
+        * The "net.ipv4.conf.all.rp_filter" sysctl will now be set to 2 by
+          default. This effectively switches the RFC3704 Reverse Path filtering
+          from Strict mode to Loose mode. This is more appropriate for hosts
+          that have multiple links with routes to the same networks (e.g.
+          a client with a Wi-Fi and Ethernet both connected to the internet).
+
+          Consult the kernel documetnation for details on this sysctl:
+          https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
+
 CHANGES WITH 239:
 
         * NETWORK INTERFACE DEVICE NAMING CHANGES: systemd-udevd's "net_id"

diff --git a/sysctl.d/50-default.conf b/sysctl.d/50-default.conf
index e263cf06284a98a2fb402767b023f20ab9eb9808..b0645f33e7fea5d871af3c39339eabbb231d44be 100644 (file)
--- a/sysctl.d/50-default.conf
+++ b/sysctl.d/50-default.conf
@@ -22,7 +22,7 @@ kernel.sysrq = 16
 kernel.core_uses_pid = 1
 
 # Source route verification
-net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.all.rp_filter = 2
 
 # Do not accept source routing
 net.ipv4.conf.all.accept_source_route = 0