# Enabling the strongest form of native Linux Address Space Layout Randomization (ASLR).
kernel.randomize_va_space=2

# Restrict revealing kernel addresses
kernel.kptr_restrict=2

# Preventing non-root users from viewing the kernel ring buffer.
kernel.dmesg_restrict = 1

# Disabling an unused feature
kernel.sysrq=0

# Set TCP Challenge ACK Limit
net.ipv4.tcp_challenge_ack_limit = 1073741823

# Disable IPv4 Forwarding
net.ipv4.ip_forward = 0

# Disable IPv6 Forwarding
net.ipv6.conf.all.forwarding = 0

# No coredumps for setuid and setgid binaries
fs.suid_dumpable = 0

# Following are moved from iptables

# Ignore broadcast pings
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# Protect against SYN flood attacks
net.ipv4.tcp_syncookies = 1

# Disable ICMP redirect acceptance
net.ipv4.conf.default.accept_redirects = 0

# Do not send ICMP redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Enable reverse path filtering
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.*.rp_filter = 1

# Log packets with invalid source addresses
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Enable dynamic IP handling
net.ipv4.ip_dynaddr = 2

# Disable ECN for compatibility
net.ipv4.tcp_ecn = 0