Reverse Path Filtering (RPF) is a technology that is used on InternetProtocol routers to try and prevent source address spoofing, which is often used for DenialOfService attacks. RPF works by checking the source IP of each packet received on an interface against the routing table. If the best route for the source IP address does not use the same interface that the packet was received on the packet is dropped. There are some situations where this feature will obviously not be the desired behaviour and will need to be disabled. In general if you are not multi-homed then enabling RPF on your router will not be a problem.


Assume a router with the following routing table

 Dest   Mask   Interface   eth0   eth1 
 default   *   eth0 

A packet arriving at eth0 with a source IP address of would not be dropped, as the best route for is out eth0.

A packet arriving at eth0 with a source IP address of would be dropped as the best route for is out eth1, a different interface to what the packet was received on.

Controlling RPF in Linux

In linux RPF is controlled by the rp_filter kernel option found in /proc/sys/net/ipv4/conf/*/rp_filter. Setting this option to 1 enables reverse path filtering on the specified interface, while setting it to 0 disables it. conf/all/rp_filter must be set to 1 for filtering to work on any interface.

See ip-sysctl.txt in the Documentation directory of the kernel source for more information

Controlling RPF on Cisco Routers

To use RPF your router must support CiscoExpressForwarding.

To enable Reverse Path Forwarding.

  Router#configure terminal
  Router(config)#int <<interface-type>> <<Interface-num>>
  Router(config-if)#ip verify unicast reverse-path

To verify the RPF is working
Look closely at the last three lines

  Router#show ip interface
  <<Interface-type>> <<interface-num>> is up, line protocol is up
    Internet address is
    Broadcast address is
    WCCP Redirect exclude is disabled
    BGP Policy Mapping is disabled
    __IP verify source reachable-via RX, allow default__
     __4 verification drops__
     __0 suppressed verification drops__

See for more details.

Configuring RPF on Juniper Routers

To enable Reverse Path Forwarding

 routing-options {

    forwarding-table     {

       unicast-reverse-path (active-paths | feasible-paths);



See for more details.