What is rp_filter?

rp_filter (reverse-path filtering) is a Linux kernel setting that drops packets arriving on an interface that isn't the route back to their source.

When a packet arrives, the kernel looks up the route to the packet's source address. In strict mode (rp_filter=1), the packet is accepted only if that route points out of the same interface it arrived on. In loose mode (rp_filter=2), it only has to be reachable through some interface, and 0 turns the check off. The setting lives under net.ipv4.conf.<interface>.rp_filter, and the kernel uses the higher of the all value and the interface's own value, so setting one interface to 0 has no effect while all is still 1. This is the Linux version of unicast reverse-path forwarding (uRPF), recommended in RFC 3704 as a way to stop spoofed source addresses. Distributions differ in what they set by default (strict on some, loose on others), so check the actual value before blaming the network; dropped packets can be logged as "martians" by turning on log_martians.

The check works well on a simple host or edge router, but it breaks legitimate asymmetric routing, where traffic leaves by one path and returns by another. A router with two uplinks, a VRRP pair, a policy-routing setup or a tunnel whose return route differs from its outbound route can see packets vanish with no firewall rule to blame. If tcpdump shows packets arriving on an interface but the application never sees them, rp_filter is a prime suspect. On VyOS the same feature is exposed as a firewall source-validation setting rather than a sysctl. Relaxing it to loose mode is usually safer than turning it off, and combining it with conntrack-based firewalling means asymmetric paths need care in both places. The Packets That Never Come Back lesson diagnoses asymmetric routing on a real VyOS router.