/etc/sysctl.d/99-hardening.conf with safe values such as net.ipv4.conf.all.accept_redirects = 0, net.ipv4.conf.all.send_redirects = 0, net.ipv4.tcp_syncookies = 1 and kernel.dmesg_restrict = 1, then load them with sudo sysctl --system. To secure shared memory, mount /dev/shm with nodev,nosuid,noexec in /etc/fstab. Test your services after each change.
sysctl reads and changes kernel settings at runtime. The settings live under /proc/sys, and files in /etc/sysctl.d/ apply them again at every boot. Most modern distributions already ship sensible values, so this page focuses on the few settings that are worth changing on a server that does not route traffic.
Before you start
- You need root or a sudo user. Root users can leave out
sudo. - Take a snapshot first. See schedule and restore backups.
- If the server runs Docker, a VPN (such as WireGuard) or forwards ports, it acts as a router. Never set
net.ipv4.ip_forward = 0on it, or those services stop working.
Which sysctl settings should I use for hardening?
Meanings come from the kernel documentation for network and kernel settings.
How to apply sysctl hardening
1
Check current values
2
Create the settings file
default applies to network interfaces created later, such as VPN or Docker interfaces. The 99- prefix makes the file load last, so its values win over earlier files.3
Load the settings
sysctl: cannot stat means a setting name is wrong or not available on your kernel.4
Test your services
Log in over SSH from a new session and check your websites, game servers and other services.
How to check it worked
What about rp_filter?
Reverse path filtering (rp_filter) drops packets whose source address would not be routed back through the same interface. 1 is strict, 2 is loose. Ubuntu 24.04 already ships 2 in /etc/sysctl.d/10-network-security.conf. Strict mode can drop valid traffic on servers with several interfaces or additional IP ranges, so keep your distribution’s value unless you have one simple interface.
How to secure shared memory (/dev/shm)
/dev/shm is a memory-backed folder every user can write to. Attackers sometimes use it to run downloaded programs. Mounting it with noexec stops programs running from it.
1
Check the current options
2
Add a line to /etc/fstab
/dev/shm line):3
Check fstab and apply
nosuid,nodev,noexec./dev/shm. If a service fails after the change, remove noexec from the line and remount.
Frequently asked questions
Should I put settings in /etc/sysctl.conf or /etc/sysctl.d/?
Use a file in/etc/sysctl.d/. It survives package updates and is easy to remove. Delete the file and reboot to undo every change on this page.
Should I disable ping (ICMP echo)?
It hides the server only slightly and makes troubleshooting harder, and IPv6 needs ICMPv6 to work. Rate-limit or filter ICMP in your firewall instead.Do I need these settings on a Windows server?
No. They are Linux kernel settings. See the Windows Server security checklist.Is there a sysctl setting that stops DDoS attacks?
No. SYN cookies help the server survive a SYN flood, but large attacks must be filtered before they reach the server. See apply DDoS filters.Related guides
VPS and dedicated server guides
Every guide in this section.
Security checklist
Harden the rest of your server.
Tune Linux for game servers
Performance sysctl settings.
Enable BBR
Another common sysctl change.
WireGuard VPN server
Needs IP forwarding on.
Checked against the official Linux kernel documentation for IP sysctl and kernel sysctl settings on 4 November 2026; Ubuntu 24.04 LTS default files were read and the
/etc/fstab line was checked with findmnt --verify on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.Need Extra Help?
If you encounter any issues, our support team is ready to assist:- Live Chat: Quick assistance via our website.
- Support Ticket: Open a Ticket
- Discord: Join our Community
- Email: support@freakhosting.com
Last Updated: November 2026