Tweaked sysctl.conf example

# fuck ip6
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1

# syncookies are not useful nowadays and have privacy risks, so disable
net.ipv4.tcp_syncookies=0
net.ipv4.ip_local_port_range = 2000 65000
kernel.domainname = 0x2e88ce4

# tighten up standards for when to dump or refuse to instantiate TCP sessions
net.ipv4.tcp_sack=0
net.ipv4.tcp_timestamps=1
net.ipv4.tcp_synack_retries=2
net.ipv4.tcp_syn_retries=2
net.ipv4.tcp_window_scaling=0
net.ipv4.tcp_fin_timeout=15
net.ipv4.tcp_keepalive_time=42
net.ipv4.tcp_max_tw_buckets=777
net.ipv4.tcp_max_syn_backlog=666

# packet fragmentation constraints, pretty much super-paranoid settings
net.ipv4.ipfrag_high_thresh=4194
net.ipv4.ipfrag_low_thresh=3145
net.ipv4.ipfrag_max_dist=24
net.ipv4.ipfrag_secret_interval=99
net.ipv4.ipfrag_time=30

# tighten up kernel-defined auto-tuning TCP buffer limits
net.core.rmem_max=8388608
net.core.wmem_max=8388608
net.core.netdev_max_backlog=5000

# NIC bindings and other topopological hygeine
net.ipv4.ip_no_pmtu_disc=0
net.ipv4.ip_nonlocal_bind=0
net.ipv4.ip_forward=0
net.ipv4.ip_default_ttl=86
net.ipv4.ip_dynaddr=0
net.ipv4.ip_early_demux=1
net.ipv4.ip_forward_use_pmtu=0

# not routing redirected ICMP packets, in or out
net.ipv4.conf.all.accept_redirects=0
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.lo.accept_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.lo.send_redirects=0

# Do not accept packets using ‘source route’ function to convince usthey’re legit, ‘cause prolly not
net.ipv4.conf.all.accept_source_route=0
net.ipv4.conf.default.accept_source_route=0
net.ipv4.conf.lo.accept_source_route=0

# spoof protection heuristic, viz. ‘validation by reversed path’ (as specified in RFC1812)
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.lo.rp_filter=1

# esoteric metaparameters
kernel.sysrq=0
net.ipv4.fwmark_reflect=0
kernel.randomize_va_space=1
net.ipv4.igmp_max_memberships=13
net.ipv4.igmp_max_msf=10

# kernel packet logging mechanics
kernel.core_uses_pid=1
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.conf.default.log_martians=1
net.ipv4.conf.all.log_martians=1
net.ipv4.conf.lo.log_martians=1

# not interested in replying to pings... pretty much ever
net.ipv4.icmp_echo_ignore_all=1
net.ipv4.icmp_ratelimit=42
net.ipv4.icmp_ratemask=68
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_errors_use_inbound_ifaddr=1

# still fine-tuning these, tbh
net.ipv4.inet_peer_maxttl=300
net.ipv4.inet_peer_minttl=120
net.ipv4.inet_peer_threshold=6566
net.ipv4.conf.all.igmpv2_unsolicited_report_interval=10000
net.ipv4.conf.all.igmpv3_unsolicited_report_interval=1000
net.ipv4.conf.all.medium_id=0
net.ipv4.conf.all.promote_secondaries=0

# ARP-y paranoia on the LAN
net.ipv4.conf.all.accept_local=0
net.ipv4.conf.all.route_localnet=0
net.ipv4.conf.all.src_valid_mark=0
net.ipv4.conf.all.arp_accept=0
net.ipv4.conf.all.arp_announce=0
net.ipv4.conf.all.arp_ignore=0
net.ipv4.conf.all.arp_notify=0
net.ipv4.conf.all.bootp_relay=0
net.ipv4.conf.all.disable_policy=0
net.ipv4.conf.all.disable_xfrm=1

# some kernel-hardening stuff,
net.ipv4.conf.all.proxy_arp_pvlan=0
net.ipv4.conf.default.proxy_arp_pvlan=0
net.ipv4.conf.all.proxy_arp=0
net.ipv4.conf.default.proxy_arp=0
net.ipv4.conf.all.arp_filter=1
net.ipv4.conf.default.arp_filter=1
net.ipv4.conf.all.shared_media=0
net.ipv4.conf.default.shared_media=0