TCP/IP Hardening¶
A handful of old settings in the network stack that still matter. Most stop an attacker on the local network from redirecting traffic through their machine. They live under MSS (Legacy) in gpedit.msc if the template is installed; otherwise use the registry values, which work either way.
The settings¶
| CIS | Setting | Set to | Registry (under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters unless noted) |
Why |
|---|---|---|---|---|
| 18.5.3 | (DisableIPSourceRouting) IP source routing protection level | Highest protection, source routing is completely disabled | DisableIPSourceRouting = 2 |
Source-routed packets specify their own path; used to bypass firewalls and spoof addresses |
| 18.5.2 | (DisableIPSourceRouting IPv6) | Highest protection | Tcpip6\Parameters\DisableIPSourceRouting = 2 |
Same, IPv6 |
| 18.5.5 | (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes | Disabled | EnableICMPRedirect = 0 |
An attacker sends an ICMP redirect and becomes the route to a destination |
| 18.5.8 | (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses | Disabled | PerformRouterDiscovery = 0 |
Level 2. An attacker advertises as a router and becomes the default gateway. |
| 18.5.6 | (KeepAliveTime) How often keep-alive packets are sent | 300000 | KeepAliveTime = 300000 |
Level 2. Dead connections detected in 5 minutes instead of 2 hours. |
| 18.5.11 | (TcpMaxDataRetransmissions) | 3 | TcpMaxDataRetransmissions = 3 |
Level 2. Fewer retransmissions means flood attacks tie up resources for less time. |
| 18.5.10 | (TcpMaxDataRetransmissions IPv6) | 3 | Tcpip6\Parameters\TcpMaxDataRetransmissions = 3 |
Level 2. |
| 18.5.4 | (DisableSavePassword) Prevent the dial-up password from being saved | Enabled | RasMan\Parameters\DisableSavePassword = 1 |
Level 2. Saved VPN passwords are stored on disk. |
IPv6¶
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.6.19.2.1 | Disable IPv6 | Tcpip6\Parameters\DisabledComponents = 0xff |
Level 2. Most networks are IPv4-only, and an unmanaged IPv6 stack is a second attack surface nobody watches. Skip if the scenario's network uses IPv6. Restart required. |
Apply¶
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DisableIPSourceRouting /t REG_DWORD /d 2 /f
One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:
| Key | Value | Type | Data |
|---|---|---|---|
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters |
DisableIPSourceRouting |
REG_DWORD | 2 |
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters |
DisableIPSourceRouting |
REG_DWORD | 2 |
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters |
EnableICMPRedirect |
REG_DWORD | 0 |
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters |
PerformRouterDiscovery |
REG_DWORD | 0 |
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters |
KeepAliveTime |
REG_DWORD | 300000 |
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters |
TcpMaxDataRetransmissions |
REG_DWORD | 3 |
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters |
TcpMaxDataRetransmissions |
REG_DWORD | 3 |
HKLM\SYSTEM\CurrentControlSet\Services\RasMan\Parameters |
DisableSavePassword |
REG_DWORD | 1 |
Level 2 only, and only on an IPv4 network:
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 255 /f
Verify¶
reg query "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DisableIPSourceRouting
reg query "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect
2 and 0.
Try it¶
- Set two of the MSS values and find them under
Tcpip\Parameters. - Read the description of each value and write one line on the attack it stops.
Build it¶
A tcpip.bat with the table's reg add lines. Add its key to the verify list.