Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #
- # /etc/sysctl.conf - Configuration file for setting system variables
- # See /etc/sysctl.d/ for additional system variables.
- # See sysctl.conf (5) for information.
- #
- #kernel.domainname = example.com
- # Uncomment the following to stop low-level messages on console
- #kernel.printk = 3 4 1 3
- ##############################################################3
- # Functions previously found in netbase
- #
- # Uncomment the next two lines to enable Spoof protection (reverse-path filter)
- # Turn on Source Address Verification in all interfaces to
- # prevent some spoofing attacks
- #net.ipv4.conf.default.rp_filter=1
- #net.ipv4.conf.all.rp_filter=1
- # Uncomment the next line to enable TCP/IP SYN cookies
- # See http://lwn.net/Articles/277146/
- # Note: This may impact IPv6 TCP sessions too
- #net.ipv4.tcp_syncookies=1
- # Uncomment the next line to enable packet forwarding for IPv4
- net.ipv4.ip_forward=1
- # Uncomment the next line to enable packet forwarding for IPv6
- # Enabling this option disables Stateless Address Autoconfiguration
- # based on Router Advertisements for this host
- #net.ipv6.conf.all.forwarding=1
- ###################################################################
- # Additional settings - these settings can improve the network
- # security of the host and prevent against some network attacks
- # including spoofing attacks and man in the middle attacks through
- # redirection. Some network environments, however, require that these
- # settings are disabled so review and enable them as needed.
- #
- # Do not accept ICMP redirects (prevent MITM attacks)
- #net.ipv4.conf.all.accept_redirects = 0
- #net.ipv6.conf.all.accept_redirects = 0
- # _or_
- # Accept ICMP redirects only for gateways listed in our default
- # gateway list (enabled by default)
- # net.ipv4.conf.all.secure_redirects = 1
- #
- # Do not send ICMP redirects (we are not a router)
- #net.ipv4.conf.all.send_redirects = 0
- #
- # Do not accept IP source route packets (we are not a router)
- #net.ipv4.conf.all.accept_source_route = 0
- #net.ipv6.conf.all.accept_source_route = 0
- #
- # Log Martian Packets
- #net.ipv4.conf.all.log_martians = 1
- #
- #net.ipv4.tcp_fin_timeout = 60
- #net.ipv4.tcp_retries1 = 3
- net.ipv4.tcp_keepalive_probes = 9
- net.ipv4.tcp_keepalive_time = 7200
- net.ipv4.tcp_syn_retries = 5
- kernel.sem = 250 32000 100 128
- kernel.shmall = 209715200
- kernel.shmmax = 214748364800
- kernel.shmmni = 4096
- fs.file-max = 1000000
- vm.swappiness = 0
- vm.vfs_cache_pressure = 50
- net.ipv4.tcp_fin_timeout = 3
- net.core.netdev_max_backlog = 30000
- net.ipv4.tcp_no_metrics_save = 1
- net.ipv4.tcp_synack_retries = 2
- net.ipv4.tcp_syn_retries = 2
- net.ipv4.tcp_max_syn_backlog = 8192
- net.core.rmem_max = 16777216
- net.core.wmem_max = 16777216
- net.ipv4.tcp_rmem = 4096 87380 16777216
- net.ipv4.tcp_wmem = 4096 65536 16777216
- net.core.somaxconn = 8192
- vm.min_free_kbytes = 65536
- #net.core.rmem_max = 16777216
- #net.core.wmem_max = 16777216
- #net.ipv4.tcp_rmem = 4096 87380 16777216
- #net.ipv4.tcp_wmem = 4096 65536 16777216
- #net.ipv4.tcp_no_metrics_save = 1
- #net.ipv4.tcp_syncookies = 1
- #net.ipv4.tcp_max_syn_backlog = 2048
- #net.ipv4.tcp_synack_retries = 2
- #net.ipv4.tcp_syncookies
- net.ipv4.tcp_tw_reuse = 1
- net.ipv4.tcp_tw_recycle = 1
- net.ipv4.tcp_mem = 786432 1048576 1572864
- kernel.pid_max = 65536
- net.ipv6.conf.all.disable_ipv6=1
- net.ipv4.tcp_syncookies = 0
- net.bridge.bridge-nf-call-iptables = 0
- net.ipv4.ip_local_port_range = 2000 65000
- net.ipv4.tcp_window_scaling = 1
- # number of packets to keep in backlog before the kernel starts dropping them
- net.ipv4.tcp_max_syn_backlog = 8240000
- # increase socket listen backlog
- #net.core.somaxconn = 824000
- net.ipv4.tcp_max_tw_buckets = 1440000
- # Increase TCP buffer sizes
- net.core.rmem_default = 8388608
- net.core.rmem_max = 16777216
- net.core.wmem_max = 16777216
- net.ipv4.tcp_rmem = 4096 87380 16777216
- net.ipv4.tcp_wmem = 4096 65536 16777216
- net.ipv4.tcp_congestion_control = cubic
- net.bridge.bridge-nf-call-iptables = 0
- kernel.perf_event_max_sample_rate = 25000
- net.netfilter.nf_conntrack_max = 556000
- net.ipv4.tcp_congestion_control=htcp
- net.ipv4.netfilter.ip_conntrack_max = 409600
- kernel.printk_ratelimit = 30
- kernel.printk_ratelimit_burst = 500
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement