Ignore and never send ICMP redirects

Low risk Ticked by default in IbexWall Catalog reviewed: 2026-11-05

A network device can tell this computer to send its traffic through someone else. This refuses such messages and stops sending them.

Why it matters

An ICMP redirect is a message from a router saying use this other router for that destination. On shared Wi-Fi, an attacker can send a forged one so your traffic flows through their machine, where it can be watched or changed. Refusing redirects keeps your routes under your own control.

How it works

Sets the accept_redirects and secure_redirects options to 0 for IPv4 and accept_redirects to 0 for IPv6, on the all and default interface groups. It also sets send_redirects to 0 so this computer does not send redirects to others.

Who should use it

Right for desktops, laptops and most servers. A machine that works as a router may want to keep sending redirects, and a few small networks rely on them.

What you may notice

Nothing on ordinary networks.

Check it on your computer

Read the current value:

sysctl net.ipv4.conf.all.accept_redirects
sysctl net.ipv4.conf.default.accept_redirects
sysctl net.ipv4.conf.all.secure_redirects
sysctl net.ipv4.conf.default.secure_redirects
sysctl net.ipv6.conf.all.accept_redirects
sysctl net.ipv6.conf.default.accept_redirects
sysctl net.ipv4.conf.all.send_redirects
sysctl net.ipv4.conf.default.send_redirects

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w net.ipv4.conf.all.accept_redirects=0
sudo sysctl -w net.ipv4.conf.default.accept_redirects=0
sudo sysctl -w net.ipv4.conf.all.secure_redirects=0
sudo sysctl -w net.ipv4.conf.default.secure_redirects=0
sudo sysctl -w net.ipv6.conf.all.accept_redirects=0
sudo sysctl -w net.ipv6.conf.default.accept_redirects=0
sudo sysctl -w net.ipv4.conf.all.send_redirects=0
sudo sysctl -w net.ipv4.conf.default.send_redirects=0

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-net-redirects.conf <<'EOF'
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

Sources

Linux Hardening Guide (madaidans): 2.2.2
ANSSI, Configuration recommendations of a GNU/Linux system (BP-028): kernel and network settings