For reading and verification only. You may not copy, use, modify or redistribute this code. Full notice on the main page.
tunnel/deploy/sysctl.conf
| 1 | # Kernel settings for an ALL tunnel node (the design plan, section 5): install as /etc/sysctl.d/99-all-tunnel.conf, then `sysctl --system`. |
| 2 | # |
| 3 | # SYN cookies: a flood of half-open connections never fills the accept queue, and a client that completes the handshake still gets served. |
| 4 | net.ipv4.tcp_syncookies = 1 |
| 5 | # the queues the node's listeners (Go's default backlog follows somaxconn) and the kernel's half-open table can hold |
| 6 | net.core.somaxconn = 4096 |
| 7 | net.ipv4.tcp_max_syn_backlog = 8192 |
| 8 | # a connection the peer abandoned in FIN-WAIT is let go sooner (the node's own idle limits and TCP keepalive end the rest) |
| 9 | net.ipv4.tcp_fin_timeout = 20 |
| 10 | # connection tracking must hold what nftables counts: the table is the size of the node's busiest day, with room |
| 11 | net.netfilter.nf_conntrack_max = 262144 |