Examples of Deep Custom Security Configurations

← Return to main article

← Return to the article on cache.forums.debian.net

Additional User Service Configurations

Below are examples of strong, individualized configurations for:

Also configurations of user services

These are not universal templates, but references illustrating advanced system hardening.

nftables config

nftables

flush ruleset

table inet filter { # Opening the ruleset
  
  # ============================================
  # START OF INPUT CHAIN
  # ============================================
  
  # = Main chain policy =
  chain input {
    type filter hook input priority 0;
    policy drop;

    # = Set of general rules =
    # 🌀 Allow loopback interface (internal processes)
    iif "lo" accept

    # == 🔁 Allow established and related connections ==
    ct state established,related accept
    
    # == 🔒 Proper protection against aggressive incoming traffic (anti-DDoS) ==
    # We do NOT allow traffic, we only instantly destroy what exceeds the limit.
    # If the rate exceeds 100 per second, the packet is logged and dropped right here.
    # If the rate is within limits, the packet goes further down, where a reliable default DROP awaits it.
    ip saddr 0.0.0.0/0 ct state new limit rate over 100/second burst 200 packets log prefix "🔥 BAN: too many conn " flags all drop

    # == 🛡️ Rate-limit ICMP echo requests (ping) ==
    ip protocol icmp icmp type echo-request limit rate 1/second accept
    ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
    ip protocol icmp icmp type echo-request drop

    # == 🚫 Block SSDP and mDNS (local broadcast protocols) ==
    ip daddr 239.255.255.250 udp dport 1900 drop   # ❌ SSDP (UPnP/device discovery)
    ip daddr 224.0.0.251 udp dport 5353 drop       # ❌ mDNS (Bonjour, Avahi)

    # == 🛑 Block NetBIOS and LLMNR (internal Windows/systemd protocols) ==
    udp dport 137 drop    # ❌ NetBIOS Name Service (Windows network names)
    udp dport 138 drop    # ❌ NetBIOS Datagram Service (LAN browsing)
    udp dport 5355 drop   # ❌ LLMNR (Link-Local Multicast Name Resolution)

    # = Set of rules for blocking IP addresses and ranges =
    
    # == 🧱 Block known botnets and proxies ==
    ip saddr {
      45.9.20.0/24,
      89.248.160.0/19,
      185.220.100.0/22,
      198.96.155.0/24,
      185.107.56.0/24,
      185.129.62.0/23
    } log prefix "🔥 BAN: known bots " flags all
    ip saddr {
      45.9.20.0/24,
      89.248.160.0/19,
      185.220.100.0/22,
      198.96.155.0/24,
      185.107.56.0/24,
      185.129.62.0/23
    } drop

    # == 🚫 Block invalid TCP flags (XMAS, NULL scan, etc.) ==
    tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop        # NULL scan
    tcp flags & (fin|psh|urg) == (fin|psh|urg) drop          # XMAS scan
    tcp flags & (fin|syn) == (fin|syn) drop                  # SYN-ACK scan
    tcp flags & (syn|rst|fin) == (syn|rst|fin) drop          # Xmas scan
    tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

    # == 🚫 Block fragmented packets — often used to bypass filters ==
    ip frag-off & 0x1fff != 0 drop

    # == 🔒 Block packets with spoofed IPs (anti-spoofing) ==
    ip saddr 127.0.0.0/8 drop          # localhost
    ip saddr 10.0.0.0/8 drop           # private network
    ip saddr 172.16.0.0/12 drop        # private network
    ip saddr 192.168.0.0/16 drop       # private network
    ip saddr 169.254.0.0/16 drop       # APIPA
    ip saddr 0.0.0.0/8 drop            # invalid address
    ip saddr 224.0.0.0/4 drop          # multicast
    ip saddr 240.0.0.0/5 drop          # reserved
  }

  # ============================================
  # END OF INPUT CHAIN
  # ============================================


  # ============================================
  # START OF FORWARD CHAIN
  # ============================================

  # = Main chain policy =
  chain forward {
    type filter hook forward priority 0;
    policy accept;
    
    #  = Various attack restrictions =
    # Only needed in chain forward if you have Docker, Oracle VirtualBox.
    # Uncomment if needed.

    # == 🔒 Proper protection against aggressive incoming traffic (anti-DDoS) ==
    # We do NOT allow traffic, we only instantly destroy what exceeds the limit.
    # If the rate exceeds 100 per second, the packet is logged and dropped right here.
    # If the rate is within limits, the packet goes further down, where a reliable default DROP awaits it.
    ip saddr 0.0.0.0/0 ct state new limit rate over 100/second burst 200 packets log prefix "🔥 BAN: too many conn " flags all drop

    # == 🛡️ Rate-limit ICMP echo requests (ping) ==
    # ip protocol icmp icmp type echo-request limit rate 1/second accept
    # ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
    # ip protocol icmp icmp type echo-request drop

    # ⬇️ INSERT: Forward chain port rules
    # Blocked and allowed TCP/UDP ports and ranges
    
        include "/etc/nftables.d/forward-tcp-udp.nft"
        
    # ⬆️ END OF INSERT

  }

  # ============================================
  # END OF FORWARD CHAIN
  # ============================================
  
  # ============================================
  # START OF OUTPUT CHAIN
  # ============================================

  chain output {
    # = Main chain policy =
    type filter hook output priority 0;
    policy drop;
    
    # = THE VERY FIRST - critically important rules =
    
    ct state established,related accept
    oif "lo" accept

    # Drop any outgoing packets marked as invalid by conntrack
    # This ensures immediate destruction of invalid packets
    # before the remaining filtering rules are applied.
    ct state invalid log prefix "🔥 INVALID_OUT_PACKET: " drop
    
    # =========================================================================
    # 🔒 SMART INSPECTION OF ESTABLISHED SESSIONS (Protection against Connection Hijacking)
    # =========================================================================
    
    # Allow established sessions ONLY if the packets within them originate from You, Your Browser, APT, or Root.
    # System ghosts (nobody, daemon) are completely exiled from here.
    ct state established,related meta skuid { user, _flatpak, _apt, root, systemd-timesync } accept

    # ⬇️ INSTANT CUTOFF: If an unauthorized system process attempts to hijack your session
    ct state established,related log flags skuid prefix "🔥 HIJACK_ATTEMPT_DROP: " drop

    # =======================================================================
    # 1. GENERAL PROTECTIVE SHIELD (Only rate limiting!)
    # =======================================================================
    
    # ATTENTION: There is NO accept keyword here. This rule does NOT allow packets out to the internet.
    # The "!" sign means: if the rate exceeds the limit, LOG and DROP the packet.
    # If the rate is within limits, the packet silently passes below — to your IP whitelist.
    # ATTENTION: meta l4proto { tcp, udp } and th dport cover both TCP and UDP (HTTP/3) with a single shield.
    meta l4proto { tcp, udp } th dport { 80, 443 } ct state new limit rate over 100/second burst 200 packets log prefix "🔥 OUT_WEB_LIMIT_BURST: " drop
    
    
    # =========================================================================
    # 2. DNS SERVICE
    # Strict binding only to Quad9 at IP 9.9.9.9
    # Length control, user filtering, and backup servers
    # =========================================================================

    # 2.1. For UDP, allow only short requests (<=150 bytes) and strictly from trusted users
    ip daddr { 9.9.9.9, 31.43.43.243, 31.43.43.143 } udp dport 53 meta length <= 150 meta skuid { user, _apt, root } ct state new accept

    # 2.2. For TCP, no length limit (for heavy DNSSEC responses), but strictly check the user
    ip daddr { 9.9.9.9, 31.43.43.243, 31.43.43.143 } tcp dport 53 meta skuid { user, _apt, root, systemd-timesync } ct state new accept

    # 2.3. All other attempts by any unauthorized services (or long UDP) — log and destroy
    ip daddr { 9.9.9.9, 31.43.43.243, 31.43.43.143 } meta l4proto { tcp, udp } th dport 53 log flags skuid prefix "🔥 OUT_BLOCK_LEAK_DNS: " drop


    # == Critically important ICMP for the network ==
    ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

    # == Important ICMPv6 for IPv6 ==
    ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
    ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept  # NS/NA
    ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept  # RS/RA
    
    # =========================================================================
    # BLOCKING RARE PROTOCOLS
    # =========================================================================
    # All rare protocols (SCTP, DCCP, and others) are automatically blocked
    # by the policy drop. Explicit rules are not required for them.
    # =========================================================================
    
    
    # ⬇️ INSERT: whitelist.nft file contents are inserted here
    
        include "/etc/nftables.d/whitelist.nft"
        
    # ⬆️ END OF INSERT


  } #  The penultimate brace closes the ruleset of the output chain. Do not remove!
  
  # ============================================
  # END OF OUTPUT CHAIN
  # ============================================
  
} #  The last brace closes the entire configuration ruleset. Do not remove!

# /etc/nftables.d/whitelist.nft
# Whitelist of IP addresses for outbound connections
# Also applies filtering by UID

# === Router web interface ===
ip daddr 192.168.0.1 tcp dport 80 meta skuid { user, _flatpak, root } ct state new accept

# =========================================================================
# === Internet service provider ===
# =========================================================================
# Provider's personal account and main website your.provider.net
# Defined using strict CIDR ranges of the autonomous system
# Opened for account top-up even during DNS failures and blocks
ip daddr {
    192.0.2.0/24,         # Location of the personal account web server
    198.51.100.0/24,      # Location of the information website
    192.0.2.0/19,         # Provider's main address pool
    198.51.100.0/20       # Subscriber routing pool
} tcp dport { 80, 443 } meta skuid { user, _flatpak, root } ct state new accept

# === Cloudflare (global CDN and DDoS protection network) ===
# Used by ChatGPT, DeepSeek, and many other services for
# faster loading and attack protection. Main pool 104.16.0.0/12.
ip daddr {
    104.16.0.0/12,        # Main Cloudflare pool (104.16.0.0 – 104.31.255.255)
    172.64.0.0/13,        # Additional Cloudflare pool
    162.158.0.0/15,       # European Cloudflare pool
    198.41.128.0/17       # American Cloudflare pool
} tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

# === Fastly (content delivery network) ===
# Used for loading static content, fonts, and scripts.
ip daddr {
    151.101.0.0/16,       # Main Fastly pool
    199.232.0.0/16        # Additional Fastly pool
} tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

# === Amazon CloudFront / AWS (cloud infrastructure) ===
# Widely used for hosting APIs, backends, and CDN.
ip daddr {
    13.32.0.0/15,         # CloudFront US East
    143.204.0.0/16,       # CloudFront EU
    54.239.128.0/18,      # CloudFront Asia Pacific
    13.224.0.0/14,        # CloudFront Edge (global)
    18.160.0.0/13,        # CloudFront Edge (additional)
    52.84.0.0/15,         # CloudFront authentication
    3.173.0.0/16,         # AWS Edge (general pool)
    23.211.0.0/16,        # AWS CloudFront (additional)
    23.47.0.0/16          # AWS CloudFront (backup)
} tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

# === Amazon Web Services (AWS CloudFront / EC2) ===
ip daddr {
    3.0.0.0/8,
    54.0.0.0/8,
    52.0.0.0/8,
    18.66.233.0/24
 } tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

# === Google Cloud / YouTube (Google infrastructure, ASN 15169) ===
ip daddr {
    64.233.160.0/19,      # Main Google pool (Search, Accounts)
    74.125.0.0/16,        # Google service pools, including Gmail and gstatic
    142.250.0.0/15,       # Largest subnet for YouTube and Gemini API
    172.217.0.0/16,       # Content delivery servers and googleusercontent
    173.194.0.0/16,       # Additional routes for Google Drive and authorization
    209.85.128.0/17,      # Regional Google Cloud/API data centers
    216.58.192.0/19,      # Old but active Google DNS and frontend pools
    35.190.0.0/16,        # Google Cloud (general pool)
    35.191.0.0/16         # Google Cloud (additional)
} tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

# === Google (AS15169) - search, YouTube, Gmail, API ===
ip daddr {
    142.250.0.0/15,
    172.217.0.0/16,
    74.125.0.0/16 
} tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

 # === Bing search engine and Microsoft services ===
 ip daddr {
    150.171.0.0/16,       # Main address pool of the Bing search engine
    40.126.0.0/18,        # Microsoft Live / Office authorization services
    20.190.128.0/18,      # Azure / Microsoft cloud backends
} tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

# === GitHub (development platform) ===
ip daddr {
    140.82.112.0/20,      # Main GitHub subnets
    192.30.252.0/22,      # Additional GitHub pools
    185.199.108.0/22      # CDN networks (raw.githubusercontent.com, githubassets.com)
} tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

# === Debian Infrastructure (official servers and mirrors) ===
ip daddr {
    130.89.148.0/24,      # Physical ftp.debian.org servers (Netherlands)
    128.31.0.0/16,        # Official Debian infrastructure networks (MIT/USA)
    149.20.4.0/24,        # Technological gateways for mirroring and forums
    206.12.19.0/24,       # SPI routing backup pools
    151.101.0.0/16,       # Fastly CDN for deb.debian.org
    199.232.0.0/16,       # Additional Fastly pool for security
    146.75.0.0/17,        # Backup Debian package delivery routes
    51.83.0.0/16          # Mirror repositories for deb.debian.org updates
} tcp dport { 80, 443 } meta skuid { user, _flatpak, _apt, root } ct state new accept

# === ⏰ Allow system time synchronization (NTP) ===
# This rule is paranoid: UDP port 123 is open EXCLUSIVELY for this process.
# No backdoor running as root or nobody will be able to exploit this loophole.
udp dport 123 meta skuid systemd-timesync ct state new accept

# === Debian Project & Wiki (By domain names in separate lines) ===
ip daddr {
        209.87.16.81 
} tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

# === openSUSE / Zeek (openSUSE infrastructure) ===
ip daddr {
    195.135.220.0/22,     # Main openSUSE data center
    130.57.0.0/16         # Additional Novell/SUSE server pools
} tcp dport { 80, 443 } meta skuid { user, _apt, root } ct state new accept

# === LibreWolf (update repository) ===
ip daddr {
    179.61.251.0/24,      # repo.librewolf.net server (Frantech/BuyVM)
    198.251.80.0/20,      # BuyVM range in Luxembourg/USA
    209.141.32.0/19       # Additional LibreWolf hosting routes
} tcp dport 443 meta skuid { user, _apt, root } ct state new accept

# === DeepSeek (specific IP addresses and subnets) ===
# Identified based on analysis of your list.
ip daddr {
    103.193.104.0/22,     # DeepSeek company's own technological routes
    154.8.0.0/16,         # Asian and global DeepSeek hosting pools
    159.69.48.177/32,     # Hetzner (Germany) - possible backend
    150.171.109.51/32,    # Possible backend or partner server
    43.109.10.32/27,      # Asian pool (range 43.109.10.32 - 43.109.10.63)
    38.54.123.48/32,      # Cogent Communications (possible route)
    95.101.61.198/32,     # Small range (Germany, possibly partner)
    95.101.61.209/32,
    95.101.61.218/32,
    111.170.168.113/32,   # Chinese provider (regional access)
    20.150.95.164/32,     # Microsoft Azure (possible backend)
    34.107.243.93/32      # Google Cloud (possible backend)
} tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

# === Wikipedia ===
ip daddr {
    185.15.59.224
} tcp dport { 443, 80 } meta skuid { user, _flatpak } ct state new accept

# === Facebook / Meta ===
ip daddr 57.144.0.0/14 tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

# === Hetzner Cloud (if you use it) ===
ip daddr 150.171.0.0/16 tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

# === Akamai (extended range 23.32.0.0/11) ===
ip daddr {
     23.32.0.0/11, 
     23.211.0.0/16, 
     23.64.0.0/16
} tcp dport { 80, 443 } meta skuid { user, _flatpak } ct state new accept

 # === Backup DNS Quad9 ===
 ip daddr  9.9.9.0/24 udp dport 53 meta skuid { user, _apt, root } accept

 # === Backup DNS Quad9 (149.112.0.0/16) ===
 ip daddr 149.112.0.0/16 udp dport 53 meta skuid { user, _apt, root } accept

# /etc/nftables.d/forward-tcp-udp.nft
# List of rules for the forward chain TCP UDP
# Status as of 26.06.2026 12:08

# = Allow necessary TCP/UDP ports and ranges =

# == Allow TCP ports required for applications ==
tcp dport {
  53,         # DNS — needed for domain name resolution
  80,         # HTTP — web traffic, downloading updates and resources
  443,        # HTTPS — secure web traffic, VPN, browser
  12043,      # Custom 3D application — specific client port
  13000-13050 # Custom 3D application — dynamic client port range
} accept

# == Allow UDP ports required for applications ==
udp dport {
  53,         # DNS — needed for domain name resolution
  443,        # HTTPS over QUIC/HTTP3, browser protocols
  3478,       # STUN/TURN — WebRTC and video conferencing
  3479-3481   # STUN/TURN — WebRTC and video conferencing
} accept

# = Block potentially dangerous and unnecessary TCP/UDP ports and ranges =

# These restrictions are designed for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, databases, IoT, and ports
# that are frequently used by malware, scanners, and C2 infrastructure.
#
# ⚠ If you are using the system as a SERVER, enable IP forwarding,
# or run services with their own routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# be sure to review the list of blocked ports and ranges in the forward chain —
# these services may require additional ports.
# If necessary, adjust or comment out the required ports and ranges.

# == Block various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
  22,     # SSH — brute-force target
  23,     # Telnet — outdated, no encryption
  3389,   # RDP — Windows remote access
  5900,   # VNC — remote access, frequent vulnerability
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
  21,     # FTP — insecure protocol
  137,    # NetBIOS Name Service
  138,    # NetBIOS Datagram
  139,    # NetBIOS Session
  445,    # SMB/CIFS — frequent exploit target
# === Databases (NEVER open to the internet) ===
  3306,   # MySQL/MariaDB
  1433,   # MS SQL Server
  1434,   # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (dangerous, frequently attacked) ===
  8080,   # HTTP proxy / web interfaces — often open test interfaces
  9200,   # Elasticsearch API — full remote data access
# === UPnP/IoT (inherently vulnerable by design) ===
  1900,   # SSDP / UPnP
# === Frequently used by malware (RAT, C2, reverse shells) ===
  4444,   # Metasploit reverse shell
  5555,   # Android ADB / IoT botnets
  9001,   # Tor transport (frequently used by malware)
  1234,   # Netcat / reverse connections
  1337,   # Frequent C2 infrastructure port for malware
#  === ⚠️ Ports for scanners and potentially vulnerable services === 
  1080,   # SOCKS proxy — often used by attackers to bypass filters
  3128,   # Squid HTTP proxy — can be used as a proxy/to bypass blocks
  8000,   # Alternative HTTP ports, web services — potentially vulnerable
  8888,   # Alternative web interfaces — test and proxy ports
  10000   # Webmin — web admin panel, attack target
} drop

# == Block various suspicious UDP ports ==
udp dport {
  161,    # SNMP — network monitoring; can be used by attackers
  162     # SNMP Trap — similarly, potential vulnerability
} drop

# Attention! When blocking wide port ranges, be careful!
# Do not harm the operation of the system and applications!

# == TCP port ranges not used by workstations during transit routing ==
# Blocked to prevent unwanted traffic forwarding, hidden tunnels,
# NAT bypass, parasitic connections, and potential attacks through the forward path.

tcp dport {
  1024-2047,    # System and outdated services; almost never needed in forward
  2048-4095,    # Proprietary and rare daemons; NFS (2049) — check if you use it
  4096-8191,    # Old VPNs, some games, P2P; rarely needed on a desktop
  8192-12287,   # Alternative HTTP/proxy, multimedia; test
  12288-16383,  # Media data/VoIP (TCP fallback); may break calls
  16384-24575,  # RTP/WebRTC (TCP fallback); block if audio/video not needed
  24576-32767,  # Dynamic ranges for games/VPN; possible side effects
  32768-49151,  # Main registered/ephemeral ports; dangerous, can break NAT, Docker, VM
  49152-65535   # High ephemeral; actively used by modern applications
} drop

# == 🚫 Block UDP ports — high and dynamic ranges ==
udp dport {
  1024-9999,     # Low and medium ephemeral ports, rarely used by system services,
                 # can be used by Trojans, P2P, games, VPNs
  10000-32767,   # Potentially dangerous ports for outbound connections
                 # We block them because they are not used by the kernel for ephemeral ports
                 # P2P clients, games, and malware may be hiding here
  32768-60999,   # Standard Linux ephemeral ports
                 # CAUTION! These ports are needed for normal operation:
                 # - Docker containers (downloading updates)
                 # - DNS queries (often use high ports)
                 # - APT and other package managers
                 # - Normal network operation
  61000-65535    # Upper reserved range
                 # Usually not used by standard applications
                 # We block to prevent non-standard outbound connections
} drop

# = 🕷️ Suspicious IPs — large ranges frequently used by botnets,
# spam networks, and scanners =
ip saddr {
  185.0.0.0/8,   # Abused hosting and proxy networks
  37.0.0.0/8,    # Cheap VPS, scanning sources
  88.0.0.0/8,    # Frequent brute-force and scanners
  77.0.0.0/8,    # Mass TOR/proxy nodes
  91.0.0.0/8     # Botnets and "gray" hosting
} drop

sysctl config

kernel parameters configuration

/etc/sysctl.d/99-protect.conf 

bash

# ============================================
# SYSTEM HARDENING CONFIG
# Debian 13 (Trixie) / MATE
# Version: v. 7.0 blackcat568
# Date: 04.03.2026 16:31
# ============================================
# ATTENTION: Apply with: sudo sysctl --system
# After applying, reboot the system to verify stability.
# ============================================

# ========== CORE NETWORK RULES ==========

# 1. Complete ICMP Echo (ping) ignore - INCOMING REQUESTS ONLY
# Effect: The system does not respond to incoming ping requests. Makes your PC "invisible"
#         to simple network scanners and automated bots.
# Important: This does NOT block outgoing ping requests from your system.
#
# Side effects:
#   - Other hosts on the network will not be able to check your PC's availability via ping.
#   - Some VPNs and tunnels may use ICMP for keepalive (rare).
#
# Suitable for:
#   ✅ Home/office PC not providing public services — completely safe.
#   ❌ Public server — comment this line out. In this case, item 16 
#      (icmp_ignore_bogus_error_responses) will only filter out erroneous ICMP packets.
#
# Note: Since IPv6 is disabled (item 11), this rule only applies to ICMPv4.
net.ipv4.icmp_echo_ignore_all = 1

# 2. Ignore ICMP broadcast requests
# Effect: Protection against Smurf attacks (traffic amplification via broadcast requests).
# Side effects: None for a typical PC.
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3. Enable SYN Cookies
# Effect: Protection against SYN flood attacks (DoS). When the SYN queue overflows, it enables cookie mechanism instead of dropping connections.
# Side effects: Slight increase in load during an attack. May affect some high-load servers, but safe for desktops.
net.ipv4.tcp_syncookies = 1

# 4. Disable Source Routing
# Effect: Prevents attackers from specifying packet routes through your system (spoofing protection).
# Side effects: None for regular users.
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5. Log "martian" packets
# Effect: Logs packets with impossible (obviously forged) source/destination addresses.
# Side effects: May fill logs (journalctl) during network attacks or misconfiguration.
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6. Disable ICMP redirects
# Effect: Prevents routing table modification via ICMP packets. Protection against man-in-the-middle attacks.
# Side effects: In complex networks with dynamic routing may require enabling, but safe for stationary PCs.
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7. Disable packet forwarding
# Effect: System does not act as a router (does not forward packets between interfaces).
# Side effects: None (default value).
net.ipv4.ip_forward = 0

# 8. Protection against empty TCP window attacks
# Effect: Enables RFC 1337 - protection against attacks using "empty" TCP segments to hold connections.
# Side effects: None.
net.ipv4.tcp_rfc1337 = 1

# 9. ARP request filtering
# Effect: Protects against ARP spoofing by forcing the kernel to filter ARP replies from multiple interfaces.
# Side effects: May cause issues in complex load-balanced networks (requires configuration).
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 10. TCP window limits
# Effect: Sets minimum, default, and maximum receive/send buffer sizes.
# Side effects: Too low values may reduce download speed, but the specified values are optimal.
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 11. COMPLETE IPv6 DISABLE
# Effect: Disables entire IPv6 stack. Eliminates a whole class of IPv6-related vulnerabilities.
# ⚠️ RED MARK ⚠️
# Side effects: Applications requiring IPv6 stop working (some torrents, Docker containers, some sites via IPv6).
# Note: If using Docker or modern browsers with IPv6 preferences, localhost issues may occur.
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 12. Reduce SYN-ACK retry attempts
# Effect: Speeds up closing of "half-open" connections during attacks.
# Side effects: Under poor connectivity, some legitimate connections may terminate faster.
net.ipv4.tcp_synack_retries = 2

# ========== NETWORK HARDENING ==========

# 13. Disable sending ICMP redirects
# Effect: Supplement to item 6 - prevents the system from sending redirects (system is not a router).
# Side effects: None.
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# 14. Reverse Path Filtering
# Effect: Strict protection against IP spoofing. Packet is dropped if it arrives on an interface it shouldn't have.
# ⚠️ RED MARK ⚠️
# Side effects: If you have a complex network with multiple interfaces (e.g., wired + Wi-Fi + VPN), strict mode (1) may disable internet on one of the interfaces.
# Solution: If network issues occur, try value 2 (loose mode).
# If that doesn't help - comment these lines out.
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.*.rp_filter = 1

# 15. Reduce TCP timeouts
# This parameter only works for outgoing (client) connections. For incoming connections (if you were running a server), it's useless.
# Effect: Fast resource release when connections are closed.
# Side effects: In rare cases, may prematurely close "slow" connections.
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_tw_reuse = 1

# 16. Ignore bogus ICMP error responses
# Effect: Drops ICMP packets with invalid error codes.
# Side effects: None.
net.ipv4.icmp_ignore_bogus_error_responses = 1

# ========== KERNEL HARDENING ==========

# 17. Restrict access to kernel logs and addresses
# Effect: dmesg_restrict - only root can see kernel message buffer.
#         kptr_restrict=2 - kernel pointer addresses are hidden from all, including root.
# Side effects: Makes debugging system issues harder for regular users.
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2

# 18. Full Address Space Layout Randomization (ASLR)
# Effect: Maximum protection against memory vulnerability exploitation (buffer overflow).
# Side effects: May cause rare issues with legacy software not compiled with PIC/PIE support.
kernel.randomize_va_space = 2

# 19. Restrict ptrace (YAMA)
# Effect: Prevents processes from tracing (debugging) other processes. Protects browser memory from being read by stealers.
# ⚠️ RED MARK ⚠️
# Side effects: Breaks debuggers (gdb, strace) when attaching to another PID. Does not affect child processes (e.g., terminal debugging still works).
# Note: For regular users - safe and recommended.
kernel.yama.ptrace_scope = 2

# 20. DISABLE USER NAMESPACES
# Effect: Closes the main vector for local privilege escalation. Prevents container isolation for unprivileged users.
# ⚠️⚠️⚠️ RED MARK (HIGH COMPATIBILITY RISK) ⚠️⚠️⚠️
# Side effects:
#   - COMPLETELY breaks Flatpak/Snap applications
#   - Breaks Docker/Podman for regular users
#   - Breaks Chrome/Chromium sandbox (browser may crash or become unstable)
#   - Some modern applications may fail to launch
# Test: If browser or app store fails to start after reboot - comment these two lines out (commented by default, uncomment only if necessary).
# kernel.unprivileged_userns_clone = 0
# user.max_user_namespaces = 0

# 21. Disable eBPF for unprivileged users
# Effect: Prevents creation of eBPF programs (frequently used by rootkits and exploits).
# Side effects: Breaks monitoring tools running via eBPF (e.g., bcc-tools) if not run as root.
kernel.unprivileged_bpf_disabled = 1

# 22. DISABLE AUTOMATIC TERMINAL LINE DISCIPLINE LOADING
# Effect: Prevents automatic loading of line disciplines via serial ports (TTY).
#         Closes attack vector related to terminal device manipulation.
# Side effects: For typical desktops without specialized hardware — none.
#                   Does not affect standard terminals, SSH, consoles.
dev.tty.ldisc_autoload = 0

# 23. PROTECTION OF FIFO FILES IN SHARED DIRECTORIES
# Effect: Prevents creation of named pipes (FIFO) in sticky-bit directories (/tmp, /var/tmp).
#         Prevents attacks using FIFO for privilege escalation or bypassing restrictions.
# Side effects: Does not affect normal application operation, as they should not create FIFOs
#                   in public temporary directories. Completely safe for desktops.
fs.protected_fifos = 2

# 24. COMPLETE DISABLE OF SYSREQ (MAGIC KEYS)
# Effect: Disables Alt+SysRq+command combinations, which allow low-level commands
#         even when the system freezes (reboot, sync, process termination).
#         Prevents accidental or malicious system reset via physical keyboard.
# Side effects: During actual system freeze, you won't be able to use SysRq for safe
#                   reboot (reboot, sync). For home PCs — not critical, as usually
#                   the power button or unplugging is used.
kernel.sysrq = 0

# 25. STRENGTHEN BPF JIT COMPILER PROTECTION
# Effect: Enables additional checks and randomization in Berkeley Packet Filter JIT compiler.
#         Hardens exploitation of vulnerabilities in eBPF programs that can be used by rootkits.
#         Value 2 enables maximum hardening without disabling eBPF.
# Side effects: Slight overhead when compiling BPF programs.
#                   Does not affect daily system operation. Docker and modern applications
#                   continue to work normally.
net.core.bpf_jit_harden = 2

# ========== END OF CONFIG ==========
# After applying, check browser and Flatpak application operation.
# For User Namespace issues - see item 20.

auditd rules config

/etc/audit/rules.d/audit.rules 

bash  

## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x

SSH client config

(?GitHub Access)

Local SSH client configuration file for the current user:

/home/user/.ssh/config 

bash

Host github.com
  HostName ssh.github.com   # GitHub SSH server
  Port 443                  # Use port 443 to bypass firewall restrictions
  User git                  # Default GitHub SSH user
  IdentityFile ~/.ssh/id_ed25519  # Private key for authentication
  AddKeysToAgent yes        # Automatically add key to ssh-agent