MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes
The `EnableICMPRedirect` registry value controls whether the IPv4 stack changes its routing information in response to received ICMP redirect messages.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableICMPRedirect
The EnableICMPRedirect registry value controls whether the IPv4 stack changes its routing information in response to received ICMP redirect messages. These messages inform a host that it should use a different next-hop router for a particular destination.
The value has the REG_DWORD type. A value of 0 prevents Windows from installing the associated host route or updating its path cache in response to an ICMP redirect. Consequently, redirects cannot use this mechanism to supersede routes learned through OSPF.
Notes
Security
A value of 0 prevents erroneous or malicious ICMP redirect messages from influencing the computer's route selection through this mechanism. This reduces the risk of traffic being temporarily directed through an unintended next-hop router or being routed incorrectly for the affected host.
This setting does not block all ICMP traffic and is not a substitute for a firewall. Its effect is limited to IPv4 routing changes triggered by ICMP redirect messages.
Possible side effects
Windows does not use legitimate ICMP redirects from routers to adjust the network path. On networks that intentionally rely on these messages for path optimization, the computer therefore retains a route obtained through other means even when a router advertises a more suitable next hop.
Notes
Microsoft's applicable baseline documentation describes EnableICMPRedirect as an IPv4-stack setting. The similarly named Windows Setup setting IcmpRedirectsEnabled, which also covers IPv6, is not equivalent to this individual registry value.
Microsoft documentation
Microsoft Learn: Reference — Azure Policy guest configuration baseline for Windows Server 2025
Microsoft Learn: Default configuration of Intune's Windows security baselines