Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to configure the kernel of my Linux server so that it will not act as router, for more security. The point is not to forward packets.

I have found this:

echo 0 > /proc/sys/net/ipv4/ip_forward  

and this:

sysctl -w net.ipv4.ip_forward=0  

Obviously both do the same thing, but I am not sure what's the real difference between them. I would also like to make the effects permanent if possible.

share|improve this question
    
No difference, sysctl does the same as the echo command. Just easier. –  vonbrand Mar 28 '13 at 0:14

1 Answer 1

up vote 2 down vote accepted

There is no difference. The sysctl command on Linux writes directly to files in /proc/sys. This snippet from the source code for sysctl proves it:

/*
 * Write a sysctl setting
 */
static int WriteSetting(const char *setting)
{
    /* ... */

    /* used to open the file */
    tmpname = xmalloc(equals - name + 1 + strlen(PROC_PATH));
    strcpy(tmpname, PROC_PATH);
    strncat(tmpname, name, (int) (equals - name));
    tmpname[equals - name + strlen(PROC_PATH)] = 0;
    /* change . to / */
    slashdot(tmpname + strlen(PROC_PATH), '.', '/');

    /* ... */

    fp = fopen(tmpname, "w");
    /* some error checking ... */
    rc = fprintf(fp, "%s\n", value);

    /* ... */
}

If you want something permanent you need to edit /etc/sysctl.conf or add a file under /etc/sysctl.d (e.g. /etc/sysctl.d/99-disable-ip-forwarding.conf) containing:

# Disable IP packet forwarding
net.ipv4.ip_forward = 0

By the way, some distributions already disable this explicitly by default. For example RHEL <= 6 or Fedora <= 15 have this in /etc/sysctl.conf:

# Controls IP packet forwarding
net.ipv4.ip_forward = 0

Fedora 20 doesn't disable it explictly anymore. There's not forwarding setting in /etc/sysctl.conf, /etc/sysctl.d/ or /usr/lib/sysctl.d/.

share|improve this answer
    
Isn't forwarding always off by default? –  grawity Mar 24 '13 at 11:35
    
That's what I think too, but you never know what wild distributions might be out there :-) –  Cristian Ciupitu Mar 24 '13 at 11:47
    
@grawity indeed, its off by default in my distribution as well. I am kinda confused now, is there any other kernel configuration in order to avoid our system running as router ? –  John M. Mar 24 '13 at 12:25
    
@JohnM.: what's there to avoid if the default is disabled? –  Cristian Ciupitu Mar 24 '13 at 12:31
    
@CristianCiupitu , i dont know, i am new to Linux and all i want to disable my server from runnig as router. So i am not sure if this command is sufficient :) –  John M. Mar 24 '13 at 12:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.