The IPv6 source-routing blind spot in your Windows hardening

Almost every Windows hardening checklist you will ever read has a line for source routing. It usually looks like this: set DisableIPSourceRouting to 2 under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters and reboot. Done. Box checked.

Here is the problem: that key only governs the IPv4 stack. Windows has a completely separate TCP/IP stack for IPv6, and it has its own source-routing control - DisableIpSourceRouting under Tcpip6\Parameters. The IPv4 setting does not touch it. So on a modern dual-stack machine (which is nearly every Windows box shipped in the last decade, with IPv6 on by default), you can be fully hardened against IPv4 source routing and still honour source-routed packets over IPv6.

What source routing actually lets an attacker do

A source-routed packet carries its own hop-by-hop path inside an IP option. Instead of the routers deciding how a packet gets from A to B, the sender dictates the route - including the return path of a packet with a spoofed source address. That is the dangerous part. Normally, spoofing a source address is self-defeating: replies go to the real owner of that address, not to you. Source routing breaks that assumption. The attacker says "reply to this spoofed address, but route it back through me on the way."

The practical consequences:

• Anti-spoofing / ingress filter bypass. Filters that assume return traffic follows normal routing can be sidestepped.
• Reaching hosts normal routing would not expose. The attacker pins a path that ordinary routing tables would never choose.
• On-path interception. The forged return path can be steered through an attacker-controlled hop.

This is the same class of network-layer path manipulation as ICMP redirects and IRDP router-advertisement injection - vectors WinSentinel already checks. The only difference here is the address family.

Why the IPv6 side gets missed

Two reasons. First, the CIS and Microsoft MSS guidance historically centred on the IPv4 value, and a lot of hardening tooling simply codified that one key. Second, plenty of admins mentally file IPv6 under "not using it" - but "not using it" is not the same as "disabled." If the stack is bound and listening (it is, by default), it will process what arrives.

The default on Windows is not the safe value either. If Tcpip6\Parameters\DisableIpSourceRouting is 0, 1, or simply absent, the host is not fully hardened. Only 2 ("highest protection" - source routing completely disabled) is the state you want, matching the IPv4 recommendation exactly.

Check it - and fix it

WinSentinel's Network Posture module now audits the IPv6 control alongside the IPv4 one. Run the free single-machine audit:

winsentinel --audit

If the IPv6 stack still honours source-routed packets, you'll get a warning finding titled "IPv6 Source Routing Accepted (Spoofing / Filter-Bypass Risk)" with the exact one-line fix:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters' -Name DisableIpSourceRouting -Value 2

Then reboot - the TCP/IP stack reads this value at start-up, so it will not take effect until the next boot. Do the same for the IPv4 key if you have not already; on a dual-stack host you want both closed:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name DisableIPSourceRouting -Value 2

The bigger point

Every IPv4 network-layer hardening control you have ever set is worth a second look for its IPv6 twin. Source routing is the cleanest example, but the pattern repeats. This is exactly the kind of drift a real audit catches and a checklist misses - which is why WinSentinel grades your actual live posture rather than assuming a key you set once is still the key that matters.

All of this is free, forever, on a single machine - the full CLI, every audit module, the real-time monitor, scheduled scans, and PDF reports. If you run a fleet of machines and want this same posture rolled up across all of them, with drift alerts when one node regresses, that's what WinSentinel Pro adds on top.