# ==============================================================================
# /etc/sysctl.d/99-homelab-gateway-hardening.conf
# ThinkPad T490 Kernel Hardening & Zero-Leak Subsystem Policy
# ==============================================================================

# 1. IP Forwarding (Mandatory for L3 Gateway Routing)
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 0

# 2. Strict IPv6 Disabling (Prevents SLAAC/RA leakage on wlan0)
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.wlan0.disable_ipv6 = 1
net.ipv6.conf.enp0s31f6.disable_ipv6 = 1

# 3. ICMP Redirect Suppression (CRITICAL: Zero leak to upstream Wi-Fi)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.wlan0.send_redirects = 0
net.ipv4.conf.enp0s31f6.send_redirects = 0

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.wlan0.accept_redirects = 0
net.ipv4.conf.enp0s31f6.accept_redirects = 0

# 4. ARP Hardening & Anti-Proxy ARP (Never answer ARP for internal IPs on wlan0)
net.ipv4.conf.all.proxy_arp = 0
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.wlan0.proxy_arp = 0
net.ipv4.conf.enp0s31f6.proxy_arp = 0

net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.default.arp_ignore = 1
net.ipv4.conf.wlan0.arp_ignore = 1
net.ipv4.conf.enp0s31f6.arp_ignore = 1

net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.wlan0.arp_announce = 2
net.ipv4.conf.enp0s31f6.arp_announce = 2

# 5. Strict Reverse Path Filtering (Anti-Spoofing)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.wlan0.rp_filter = 1
net.ipv4.conf.enp0s31f6.rp_filter = 1

# 6. TCP Connection Tracking & Window Optimization
net.netfilter.nf_conntrack_max = 262144
net.ipv4.tcp_fin_timeout = 15