Kernel tunable security parameter versus iptables, which is prefer? Or can I use both methods? For example, to modify the /etc/sysctl.conf as to tune security parameter, otherwise use iptables. Some command lines I have modified in my system were:
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.icmp_echo_ignore_all = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.log_martians = 1

These seems to be acting like iptables, and this get me confuses that should I just use iptables only, or I can add those lines above to /etc/sysctl.conf for additional security measures? I think when done modify the /etc/sysctl.conf, you have to reboot to have your kernel activates those parameters, am I right? Thanks...

Both. They serve different purposes and complement each other.


Yes. In your kernel source documentation directory there's a nice text on sysctls explaining everything. Else it should be somewhere in the LQ FAQ: Security references or maybe search LQ.


No reboot necessary: edit your sysctl.conf then 'sysctl -p' (uses "/etc/sysctl.conf" by default) to set the values (or single values manually with 'sysctl -w key=value') but only config changes in files like sysctl.conf survive a reboot.

If you want your sysctls in different states you can put the changes in scripts. In fact, I have some sysctl statements in the first section of my iptables file.

Thanks guy!