# restrict arp subnets per nic
# in principle only required by load-balancers, but let's avoid answering on the wrong nic
# https://sysctl-explorer.net/net/ipv4/arp_filter/
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.all.arp_filter = 0

# todo - try enable strict mode (1) - might break things
# 10-network-security.conf
# turn on source address verification to prevent some spoofing attacks
# https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html
# https://www.rfc-editor.org/rfc/rfc3704
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2