-
-
Save renyu-io/088d34817c4478fea864 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# | |
# /etc/sysctl.conf - Configuration file for setting system variables | |
# See /etc/sysctl.d/ for additonal system variables | |
# See sysctl.conf (5) for information. | |
# | |
#kernel.domainname = example.com | |
# Uncomment the following to stop low-level messages on console | |
#kernel.printk = 3 4 1 3 | |
##############################################################3 | |
# Functions previously found in netbase | |
# | |
# Uncomment the next two lines to enable Spoof protection (reverse-path filter) | |
# Turn on Source Address Verification in all interfaces to | |
# prevent some spoofing attacks | |
#net.ipv4.conf.default.rp_filter=1 | |
#net.ipv4.conf.all.rp_filter=1 | |
# Uncomment the next line to enable TCP/IP SYN cookies | |
# See http://lwn.net/Articles/277146/ | |
# Note: This may impact IPv6 TCP sessions too | |
#net.ipv4.tcp_syncookies=1 | |
# Uncomment the next line to enable packet forwarding for IPv4 | |
#net.ipv4.ip_forward=1 | |
# Uncomment the next line to enable packet forwarding for IPv6 | |
# Enabling this option disables Stateless Address Autoconfiguration | |
# based on Router Advertisements for this host | |
#net.ipv6.conf.all.forwarding=1 | |
################################################################### | |
# Additional settings - these settings can improve the network | |
# security of the host and prevent against some network attacks | |
# including spoofing attacks and man in the middle attacks through | |
# redirection. Some network environments, however, require that these | |
# settings are disabled so review and enable them as needed. | |
# | |
# Do not accept ICMP redirects (prevent MITM attacks) | |
#net.ipv4.conf.all.accept_redirects = 0 | |
#net.ipv6.conf.all.accept_redirects = 0 | |
# _or_ | |
# Accept ICMP redirects only for gateways listed in our default | |
# gateway list (enabled by default) | |
# net.ipv4.conf.all.secure_redirects = 1 | |
# | |
# Do not send ICMP redirects (we are not a router) | |
#net.ipv4.conf.all.send_redirects = 0 | |
# | |
# Do not accept IP source route packets (we are not a router) | |
#net.ipv4.conf.all.accept_source_route = 0 | |
#net.ipv6.conf.all.accept_source_route = 0 | |
# | |
# Log Martian Packets | |
#net.ipv4.conf.all.log_martians = 1 | |
# | |
# This line blow add by user. | |
# increase TCP max buffer size settable using setsockopt() | |
net.core.rmem_max = 67108864 | |
net.core.wmem_max = 67108864 | |
# increase Linux autotuning TCP buffer limit | |
net.ipv4.tcp_rmem = 4096 87380 67108864 | |
net.ipv4.tcp_wmem = 4096 65536 67108864 | |
# increase the length of the processor input queue | |
net.core.netdev_max_backlog = 250000 | |
# recommended for hosts with jumbo frames enabled | |
net.ipv4.tcp_mtu_probing = 1 | |
#使用hybla拥塞控制 | |
net.ipv4.tcp_congestion_control = hybla | |
net.ipv4.tcp_syncookies = 1 | |
# 表示开启 SYN Cookies。当出现 SYN 等待队列溢出时,启用 cookies 来处理,可防范少量 SYN 攻击,默认为 0,表示关闭; | |
net.ipv4.tcp_tw_reuse = 1 | |
# 表示开启重用。允许将 TIME-WAIT sockets 重新用于新的 TCP 连接,默认为 0,表示关闭; | |
net.ipv4.tcp_tw_recycle = 0 | |
# 此功能和Android系统冲突,必须禁用。 | |
net.ipv4.tcp_fin_timeout = 30 | |
# 修改系統默认的 TIMEOUT 时间。 | |
net.ipv4.tcp_keepalive_time = 1200 | |
# 表示当 keepalive 起用的时候,TCP 发送 keepalive 消息的频度。缺省是 2 小时,改为 20 分钟。 | |
net.ipv4.tcp_max_syn_backlog = 8192 | |
# 表示 SYN 队列的长度,默认为 1024,加大队列长度为 8192,可以容纳更多等待连接的网络连接数。 | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment