<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><div class="">On Nov 6, 2015, at 1:09, Reindl Harald <<a href="mailto:h.reindl@thelounge.net" class="">h.reindl@thelounge.net</a>> wrote:</div><div class=""><div class=""><br class="">defaults should have security in mind, …</div></div></blockquote><br class=""></div><div>IMHO the current behavior is actually less secure:</div><div><br class=""></div><div>If I set <font face="LucidaGrande" class="">net.ipv4.ip_forward=1, I intentionally set forwarding on all interfaces, as documented in countless tutorials, so it’s very unlikely I didn’t mean to do that.</font></div><div><font face="LucidaGrande" class=""><br class=""></font></div><div><font face="LucidaGrande" class="">But if I set net.ipv4.ip_forward=1 in /etc/sysctl.d, and it only works sometimes and on some interfaces, I do have a security problem because it may come on when I least expect it. For example, when I execute systemctl restart </font><span style="font-family: LucidaGrande;" class="">systemd-sysctl.</span></div><div><font face="LucidaGrande" class=""><br class=""></font></div><div><font face="LucidaGrande" class="">(Because networkd doesn’t actually “manage” the interface, it only sets certain attributes at certain times, which can still be changed outside of networkd any time. If </font><span style="font-family: LucidaGrande;" class="">net.ipv4.ip_forward were turned into a read-only setting, for example, that would be different.)</span></div><div><span style="font-family: LucidaGrande;" class=""><br class=""></span></div><div><span style="font-family: LucidaGrande;" class="">Cheers,</span></div><div><span style="font-family: LucidaGrande;" class=""><br class=""></span></div><div><span style="font-family: LucidaGrande;" class=""><br class=""></span></div><div><span style="font-family: LucidaGrande;" class=""><br class=""></span></div><div><span style="font-family: LucidaGrande;" class="">Johannes.</span></div><div><span style="font-family: LucidaGrande;" class=""><br class=""></span></div></body></html>