sysctl.conf

## https://github.com/cr-solutions/sysctl

## sysctl.conf settings from CR-Solutions.net (NSA security guide + Linux Network Tuning 2013 + Brendan Gregg/Netflix)
## enhancement for 100G with up to 200ms RTT

## Type the following command to reload settings from config files without rebooting the box
## sudo sysctl --system

##########################################################
## The contents of this file are subject to the Mozilla Public License
## Version 2.0 (the "License"); you may not use this file except in compliance
## with the License. You may obtain a copy of the License at
## https://www.mozilla.org/en-US/MPL/2.0/

## Software distributed under the License is distributed on an "AS IS" basis,
## WITHOUT WARRANTY OF ANY KIND, either expressed or implied. See the License for
## the specific language governing rights and limitations under the License.

## The Initial Developers of the Original Code are: 
## Copyright (c) 2020-2025, CR-Solutions (https://www.cr-solutions.net), Ricardo Cescon (https://www.cescon.de)
## All Rights Reserved.
##########################################################

## Protect ICMP attacks
net.ipv4.icmp_echo_ignore_broadcasts = 1

## Turn on protection for bad icmp error messages 
net.ipv4.icmp_ignore_bogus_error_responses = 1

## Turn on syncookies for SYN flood attack protection 
net.ipv4.tcp_syncookies = 1

## support large concurrency of TCP accept
net.core.somaxconn = 262144

## Log suspcicious packets, such as spoofed, source-routed, and redirect 
net.ipv4.conf.all.log_martians = 1 
net.ipv4.conf.default.log_martians = 1

## Disables these ipv4 features, not very legitimate uses 
## Note: accept_source_route may not be available in all kernel versions
#net.ipv4.conf.all.accept_source_route = 0 
#net.ipv4.conf.default.accept_source_route = 0

## Enables RFC-reccomended source validation (dont use on a router)
## 1 for strict
## 2 if you use an env with BGP routing, like AWS
net.ipv4.conf.all.rp_filter = 1 
net.ipv4.conf.default.rp_filter = 1

## Make sure no one can alter the routing tables 
net.ipv4.conf.all.accept_redirects = 0 
net.ipv4.conf.default.accept_redirects = 0 
net.ipv4.conf.all.secure_redirects = 0 
net.ipv4.conf.default.secure_redirects = 0

## Host only (we're not a router)
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0


## Turn on execshild
kernel.exec-shield = 1
kernel.randomize_va_space = 1

## Tune IPv6
net.ipv6.conf.default.router_solicitations = 0 
net.ipv6.conf.default.accept_ra_rtr_pref = 0
net.ipv6.conf.default.accept_ra_pinfo = 0 
net.ipv6.conf.default.accept_ra_defrtr = 0 
net.ipv6.conf.default.autoconf = 0 
net.ipv6.conf.default.dad_transmits = 0 
net.ipv6.conf.default.max_addresses = 1

## Optimization for port usefor LBs
## Increase system file descriptor limit
fs.file-max = 100000

## Increase inotify limits (default 8192/128 is too low for IDEs, file watchers, containers,
## zero-downtime deployments, log/cache management, and process managers/microservices)
## a swap file is recommended, see readme.md for more info
fs.inotify.max_user_watches = 524288
fs.inotify.max_user_instances = 512

## Allow for more PIDs (to reduce rollover problems); may break some programs 32768 
kernel.pid_max = 65536

## Increase system IP port limits
net.ipv4.ip_local_port_range = 2000 65534                                    

## Increase Linux auto tuning TCP buffer limits
## min, default, and max number of bytes to use
## Set max to at least 4MB, or higher if you use very high BDP paths
## Set max to 16MB (16777216) for 1GE or 32M (33554432) and 54M (56623104) for 10GE, 2GB (2147483647) for 100GE
## Don't set tcp_mem itself! Let the kernel scale it based on RAM.
net.core.rmem_max = 56623104
net.core.wmem_max = 56623104

net.core.optmem_max = 40960
net.ipv4.tcp_rmem = 4096 87380 56623104
net.ipv4.tcp_wmem = 4096 65536 56623104
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_timestamps = 0

## recommended default congestion control is htcp 
net.ipv4.tcp_congestion_control=htcp
## recommended for hosts with jumbo frames enabled
net.ipv4.tcp_mtu_probing=1
## recommended for CentOS7/Debian8 hosts
net.core.default_qdisc = fq


## Make room for more TIME_WAIT sockets due to more clients, 
## and allow them to be reused if we run out of sockets 
## Also increase the max packet backlog 
net.core.netdev_max_backlog = 50000 
net.ipv4.tcp_max_syn_backlog = 30000 
net.ipv4.tcp_max_tw_buckets = 2000000 
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout=10

net.ipv4.tcp_abort_on_overflow = 1


## Disable TCP slow start on idle connections 
net.ipv4.tcp_slow_start_after_idle = 0

######################################################
## set swappiness to 10 for not aggressive swapping
## set swappiness to 30 for normal swapping
## set swappiness to 60 for more aggressive swapping

## uses swap when needed but prefers RAM
vm.swappiness=10


## prefer inode/dentry-caches in RAM
vm.vfs_cache_pressure=50
## allows memory overcommit (good for containers or microservices)
vm.overcommit_memory=1
## kills the process causing OOM, not random ones
vm.oom_kill_allocating_task=1
## keeps 1GB free for emergencies
vm.min_free_kbytes=1048576 

## Page cache flushing is tuned to provide a more even behavior: Background flush earlier, aggressive flush later 
vm.dirty_ratio = 80   
vm.dirty_background_ratio = 5
vm.dirty_expire_centisecs = 12000  

## protect DDOS and SYN flood attacks
net.netfilter.nf_conntrack_tcp_timeout_time_wait=15
net.ipv4.netfilter.ip_conntrack_max = 65535

## Optimizing Performance
## Selective Acknowledgement, require 
net.ipv4.tcp_window_scaling=1 
net.ipv4.tcp_sack = 1
net.ipv4.tcp_fastopen = 3


#net.ipv4.tcp_tw_recycle = 1 make problems with RFC 1323, load balancing and varnish are dropping connections 
net.ipv4.tcp_tw_recycle = 0


## Shared Memory 512M
kernel.shmmax = 536870912
kernel.shmall = 536870912

## kernel.panic tunable
kernel.panic = 1
vm.panic_on_oom = 1