The Man-in-the-Middle Attack Vector
The Internet Control Message Protocol (ICMP) is primarily known for the ping command, but it is also a fundamental routing protocol. One of its features is the ICMP Redirect.
Normally, if a Linux server wants to send a packet to a remote network, it sends the packet to its default gateway (the main router). If that router knows there is a faster, more direct route via a different router on the same local network, it will send an ICMP Redirect packet back to the Linux server. This packet essentially says: “Update your routing table; send future traffic directly to Router B instead of me.”
While this was designed to optimize network traffic, it is a massive security vulnerability. A malicious actor on the local network can spoof an ICMP Redirect packet, sending it to your Linux server and tricking it into routing all of its outbound internet traffic through the attacker’s laptop. The attacker can then silently capture passwords, API keys, and unencrypted data before forwarding the traffic to the real router. This is a classic Man-in-the-Middle (MitM) attack.
To secure your server, you must disable the acceptance of ICMP Redirects entirely within the Linux kernel using sysctl.
Verifying the Vulnerability
By default, many Linux distributions accept ICMP Redirects. You can verify your kernel’s current vulnerability status using the following command:
sysctl -a | grep accept_redirectsIf you see the following output, your server is vulnerable to routing spoof attacks:
net.ipv4.conf.all.accept_redirects = 1
net.ipv4.conf.default.accept_redirects = 1Applying Protection via sysctl
You must instruct the kernel to silently drop and ignore any ICMP Redirect packets it receives, regardless of who sent them.
To apply this protection immediately in RAM (without rebooting), execute the following commands with root privileges:
sudo sysctl -w net.ipv4.conf.all.accept_redirects=0
sudo sysctl -w net.ipv4.conf.default.accept_redirects=0Additionally, if your Linux machine is acting as a router itself, you must ensure it does not send ICMP redirects, as this can leak topology information:
sudo sysctl -w net.ipv4.conf.all.send_redirects=0
sudo sysctl -w net.ipv4.conf.default.send_redirects=0Making the Protection Permanent
The sysctl -w commands are volatile; the protection will disappear the moment the server is rebooted. To permanently harden the networking stack, you must append these directives to the system configuration file.
Open /etc/sysctl.conf using a text editor (like nano):
sudo nano /etc/sysctl.confScroll to the bottom of the file and add the following lines:
# Disable ICMP Redirect Acceptance (Prevent MitM Attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
# Disable sending ICMP Redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0Save and close the file. To force the kernel to parse the file and apply the baseline immediately, execute:
sudo sysctl -pYour Linux server’s routing table is now strictly locked. It will only accept routing instructions from the static configuration files or authenticated routing protocols (like BGP/OSPF), completely neutralizing the threat of ICMP-based Man-in-the-Middle attacks.