Prevent ICMP redirects not default Tunable

[AhnHEL]

This issue has been reported by Keropiko in the forum since 19.1.3 but has not been resolved or addressed by a Dev. I can confirm this issue still exists in 19.1.6

See the following post for details:

https://forum.opnsense.org/index.php?topic=11956.msg54541#msg54541

Tunable appears to default to off instead of on as it should.

net.inet.icmp.drop_redirect=default (0) and must manually be edited to (1).

[AdSchellevis]

This only influences new installs / factory resets b424a2f
We didn't intent to change defaults for existing installs. Its intentional, as stated in the release notes:

o system: new tunables factory default to prevent ICMP redirects being sent (net.inet.icmp.drop_redirect=1)

[AhnHEL]

Are these rules handled like the firewall rules processing order (from top to bottom) because I see them duplicated now at the bottom of the list after hitting the "Default" Red button now in System: Settings: Tunables?

The file at src/etc/config.xml.sample has these tunables duplicated in them.

[AdSchellevis]

They shouldn't duplicate, but if you want to be sure what the current value is, on a console execute:

sysctl net.inet.icmp.drop_redirect

I'll take a look at the tunables/default button, but you can always remove the first (faulty) entry to make sure you have the correct setting.

[AdSchellevis]

@AhnHEL I've removed the duplicates in 6101ba8, you can fix manually by removing the wrong entries. It looks like I missed the values already there. Thanks for the report.