Hardening Linux Server Kernels with sysctl & nftables

Enterprise Linux servers exposed to the open internet require defense-in-depth at the kernel TCP/IP layer. This guide details our production hardening configurations used across the **TechNHIT** cluster infrastructure.

Production Prerequisite

Before reloading sysctl configurations on remote servers, ensure you possess out-of-band console access (IPMI / iDRAC) in the event of an interface packet drop misconfiguration.

1. TCP/IP Stack Hardening via sysctl

Create `/etc/sysctl.d/99-security-hardened.conf` and apply strict parameters to mitigate SYN flood attacks, disable IP forwarding, and prevent ICMP redirect poisoning:

/etc/sysctl.d/99-security-hardened.conf

+net.ipv4.tcp_syncookies = 1

+net.ipv4.conf.all.rp_filter = 1

+net.ipv4.conf.default.rp_filter = 1

+net.ipv4.conf.all.accept_source_route = 0

+net.ipv4.icmp_echo_ignore_broadcasts = 1

+net.ipv4.conf.all.log_martians = 1

Apply the kernel parameters immediately without rebooting:

Apply Sysctl Configuration

Debian 12 / Ubuntu 24.04

$sysctl -p /etc/sysctl.d/99-security-hardened.conf

2. High-Performance nftables Firewall Ingress Filter

Replace legacy `iptables` with `nftables` atomic table evaluation:

<TerminalBlock command="nft list ruleset > /etc/nftables.conf.bak && systemctl enable --now nftables" title="Enable nftables Service" os="Linux" />

Verify that martian packets and drop counts are recorded in the system journal:

Inspect Kernel Log for Martians

Linux

$journalctl -k -g 'martian' --no-pager -n 20