> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux sysctl Hardening: Secure Kernel and Network Settings

> Linux sysctl hardening for a VPS: put safe kernel and network settings in /etc/sysctl.d/99-hardening.conf, load them with sysctl --system, secure /dev/shm.

To harden Linux kernel settings, create `/etc/sysctl.d/99-hardening.conf` with safe values such as `net.ipv4.conf.all.accept_redirects = 0`, `net.ipv4.conf.all.send_redirects = 0`, `net.ipv4.tcp_syncookies = 1` and `kernel.dmesg_restrict = 1`, then load them with `sudo sysctl --system`. To secure shared memory, mount `/dev/shm` with `nodev,nosuid,noexec` in `/etc/fstab`. Test your services after each change.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Intermediate | 15 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 | Root or sudo access |

`sysctl` reads and changes kernel settings at runtime. The settings live under `/proc/sys`, and files in `/etc/sysctl.d/` apply them again at every boot. Most modern distributions already ship sensible values, so this page focuses on the few settings that are worth changing on a server that does not route traffic.

## Before you start

* You need root or a sudo user. Root users can leave out `sudo`.
* Take a snapshot first. See [schedule and restore backups](https://help.freakhosting.com/portals/vps-panel/how-to-schedule-and-restore-backups.md).
* If the server runs **Docker**, a **VPN** (such as [WireGuard](https://help.freakhosting.com/portals/other/how-to-set-up-a-wireguard-vpn-server.md)) or forwards ports, it acts as a router. Never set `net.ipv4.ip_forward = 0` on it, or those services stop working.

> [!WARNING]
>
> Wrong network settings can cut the server off the network. Change settings from a session you can recover, and keep the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) ready.

## Which sysctl settings should I use for hardening?

| Setting | Value | What it does |
| - | - | - |
| `net.ipv4.tcp_syncookies` | `1` | Uses SYN cookies when the connection queue overflows during a SYN flood. Kernel default is `1`. |
| `net.ipv4.conf.all.accept_redirects` | `0` | Ignores ICMP redirects, which can be used to change your routes |
| `net.ipv4.conf.all.secure_redirects` | `0` | Also ignores redirects from your own gateway |
| `net.ipv6.conf.all.accept_redirects` | `0` | Same for IPv6 |
| `net.ipv4.conf.all.send_redirects` | `0` | Stops the server sending redirects; only routers need them |
| `net.ipv4.conf.all.accept_source_route` | `0` | Drops source-routed packets |
| `net.ipv4.conf.all.log_martians` | `1` | Logs packets with impossible source addresses |
| `net.ipv4.icmp_echo_ignore_broadcasts` | `1` | Ignores pings sent to broadcast addresses. Kernel default is `1`. |
| `kernel.dmesg_restrict` | `1` | Only privileged users can read the kernel log |
| `kernel.kptr_restrict` | `2` | Hides kernel memory addresses from every user |
| `kernel.randomize_va_space` | `2` | Full address space layout randomisation (ASLR) |
| `fs.suid_dumpable` | `0` | No core dumps from setuid programs, which could leak secrets |

Meanings come from the kernel documentation for [network](https://docs.kernel.org/networking/ip-sysctl.html) and [kernel](https://docs.kernel.org/admin-guide/sysctl/kernel.html) settings.

## How to apply sysctl hardening

**1. Check current values**

```bash theme={null}
sysctl net.ipv4.conf.all.accept_redirects net.ipv4.conf.all.send_redirects kernel.dmesg_restrict kernel.kptr_restrict
```

**2. Create the settings file**

```bash theme={null}
sudo nano /etc/sysctl.d/99-hardening.conf
```

```ini theme={null}
# Network
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Kernel
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
kernel.randomize_va_space = 2
fs.suid_dumpable = 0
```

`default` applies to network interfaces created later, such as VPN or Docker interfaces. The `99-` prefix makes the file load last, so its values win over earlier files.

**3. Load the settings**

```bash theme={null}
sudo sysctl --system
```

The command lists every file it reads and each value it sets. A line starting with `sysctl: cannot stat` means a setting name is wrong or not available on your kernel.

**4. Test your services**

Log in over SSH from a new session and check your websites, game servers and other services.

## How to check it worked

```bash theme={null}
sysctl net.ipv4.conf.all.accept_redirects kernel.kptr_restrict
```

```text theme={null}
net.ipv4.conf.all.accept_redirects = 0
kernel.kptr_restrict = 2
```

Reboot once at a quiet time and run the same command to confirm the values load at boot.

## What about rp\_filter?

Reverse path filtering (`rp_filter`) drops packets whose source address would not be routed back through the same interface. `1` is strict, `2` is loose. Ubuntu 24.04 already ships `2` in `/etc/sysctl.d/10-network-security.conf`. Strict mode can drop valid traffic on servers with several interfaces or additional IP ranges, so keep your distribution's value unless you have one simple interface.

## How to secure shared memory (/dev/shm)

`/dev/shm` is a memory-backed folder every user can write to. Attackers sometimes use it to run downloaded programs. Mounting it with `noexec` stops programs running from it.

**1. Check the current options**

```bash theme={null}
findmnt /dev/shm
```

**2. Add a line to /etc/fstab**

```bash theme={null}
sudo nano /etc/fstab
```

Add this line at the end (or edit an existing `/dev/shm` line):

```text theme={null}
tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0
```

**3. Check fstab and apply**

```bash theme={null}
sudo findmnt --verify
sudo mount -o remount /dev/shm
findmnt /dev/shm
```

The options now include `nosuid,nodev,noexec`.

> [!WARNING]
>
> A mistake in `/etc/fstab` can stop the server booting. Always run `sudo findmnt --verify` before you reboot. If the server does not boot, use [rescue mode](https://help.freakhosting.com/portals/vps-panel/how-to-use-rescue-mode.md) to fix the file.

Some software runs code from `/dev/shm`. If a service fails after the change, remove `noexec` from the line and remount.

## Frequently asked questions

### Should I put settings in /etc/sysctl.conf or /etc/sysctl.d/?

Use a file in `/etc/sysctl.d/`. It survives package updates and is easy to remove. Delete the file and reboot to undo every change on this page.

### Should I disable ping (ICMP echo)?

It hides the server only slightly and makes troubleshooting harder, and IPv6 needs ICMPv6 to work. Rate-limit or filter ICMP in your firewall instead.

### Do I need these settings on a Windows server?

No. They are Linux kernel settings. See the [Windows Server security checklist](https://help.freakhosting.com/portals/other/windows-server-security-checklist.md).

### Is there a sysctl setting that stops DDoS attacks?

No. SYN cookies help the server survive a SYN flood, but large attacks must be filtered before they reach the server. See [apply DDoS filters](https://help.freakhosting.com/portals/firewall/how-to-apply-ddos-filters.md).

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> Harden the rest of your server.

> [card] [Tune Linux for game servers](https://help.freakhosting.com/portals/other/how-to-tune-linux-for-game-servers.md)
>
> Performance sysctl settings.

> [card] [Enable BBR](https://help.freakhosting.com/portals/other/how-to-enable-bbr-tcp-congestion-control.md)
>
> Another common sysctl change.

> [card] [WireGuard VPN server](https://help.freakhosting.com/portals/other/how-to-set-up-a-wireguard-vpn-server.md)
>
> Needs IP forwarding on.

***

> [!NOTE]
>
> **Checked against the official Linux kernel documentation for [IP sysctl](https://docs.kernel.org/networking/ip-sysctl.html) and [kernel sysctl](https://docs.kernel.org/admin-guide/sysctl/kernel.html) settings** on 4 November 2026; Ubuntu 24.04 LTS default files were read and the `/etc/fstab` line was checked with `findmnt --verify` on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.