X-Git-Url: http://git.ipfire.org/?a=blobdiff_plain;f=man%2Fsysctl.d.xml;h=9f14289fef754a01687612154daa7f4ae8882669;hb=HEAD;hp=32084ee8d6b81d37b064b79edf482d6d0cb058f6;hpb=c16782577b696ec4e25d8922cea1bdc80401e9b9;p=thirdparty%2Fsystemd.git diff --git a/man/sysctl.d.xml b/man/sysctl.d.xml index 32084ee8d6b..7e1ecfa0305 100644 --- a/man/sysctl.d.xml +++ b/man/sysctl.d.xml @@ -1,7 +1,7 @@ - + "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd"> + @@ -21,9 +21,22 @@ - /etc/sysctl.d/*.conf - /run/sysctl.d/*.conf - /usr/lib/sysctl.d/*.conf + + /etc/sysctl.d/*.conf + /run/sysctl.d/*.conf + /usr/local/lib/sysctl.d/*.conf + /usr/lib/sysctl.d/*.conf + + + key.name.under.proc.sys = some value +key/name/under/proc/sys = some value +key/middle.part.with.dots/foo = 123 +key.middle/part/with/dots.foo = 123 +-key.that.will.not.fail = value +key.pattern.*.with.glob = whatever +-key.pattern.excluded.with.glob +key.pattern.overridden.with.glob = custom + @@ -44,34 +57,32 @@ first non-whitespace character is # or ; are ignored. - Note that either / or - . may be used as separators within sysctl - variable names. If the first separator is a slash, remaining - slashes and dots are left intact. If the first separator is a dot, - dots and slashes are interchanged. - kernel.domainname=foo and - kernel/domainname=foo are equivalent and will - cause foo to be written to + Note that either / or . may be used as separators within + sysctl variable names. If the first separator is a slash, remaining slashes and dots are left intact. If + the first separator is a dot, dots and slashes are interchanged. + kernel.domainname=foo and kernel/domainname=foo are equivalent and + will cause foo to be written to /proc/sys/kernel/domainname. Either net.ipv4.conf.enp3s0/200.forwarding or - net/ipv4/conf/enp3s0.200/forwarding may be used - to refer to - /proc/sys/net/ipv4/conf/enp3s0.200/forwarding. - - - Any access permission errors and attempts to write variables not defined on the local system are - logged, but do not cause the service to fail. Moreover, if a variable assignment is prefixed with a - single - character, failure to set the variable will be logged, but will not cause the - service to fail. All other errors when setting variables cause the service to return failure at the end - (other variables are still processed). - - The settings configured with sysctl.d - files will be applied early on boot. The network - interface-specific options will also be applied individually for - each network interface as it shows up in the system. (More - specifically, net.ipv4.conf.*, - net.ipv6.conf.*, - net.ipv4.neigh.* and + net/ipv4/conf/enp3s0.200/forwarding may be used to refer to + /proc/sys/net/ipv4/conf/enp3s0.200/forwarding. A glob + glob7 pattern may be + used to write the same value to all matching keys. Keys for which an explicit pattern exists will be + excluded from any glob matching. In addition, a key may be explicitly excluded from being set by any + matching glob patterns by specifying the key name prefixed with a - character and not + followed by =, see SYNOPSIS. + + Any access permission errors and attempts to write variables not present on the local system are + logged at debug level and do not cause the service to fail. Other types of errors when setting variables + are logged with higher priority and cause the service to return failure at the end (after processing + other variables). As an exception, if a variable assignment is prefixed with a single + - character, failure to set the variable for any reason will be logged at debug level + and will not cause the service to fail. + + The settings configured with sysctl.d files will be applied early on boot. The + network interface-specific options will also be applied individually for each network interface as it + shows up in the system. (More specifically, net.ipv4.conf.*, + net.ipv6.conf.*, net.ipv4.neigh.* and net.ipv6.neigh.*). Many sysctl parameters only become available when certain @@ -148,18 +159,38 @@ net.bridge.bridge-nf-call-arptables = 0 (starting with kernel 3.18), so simply not loading the module is sufficient to avoid filtering. + + + Set network routing properties for all interfaces + /etc/sysctl.d/20-rp_filter.conf: + + net.ipv4.conf.default.rp_filter = 2 +net.ipv4.conf.*.rp_filter = 2 +-net.ipv4.conf.all.rp_filter +net.ipv4.conf.hub0.rp_filter = 1 + + + The key will be set to "2" for all interfaces, except "hub0". We set + net.ipv4.conf.default.rp_filter first, so any interfaces which are added + later will get this value (this also covers any interfaces detected while we're + running). The glob matches any interfaces which were detected earlier. The glob + will also match net.ipv4.conf.all.rp_filter, which we don't want to set at all, so + it is explicitly excluded. And "hub0" is excluded from the glob because it has an explicit setting. + + + See Also - - systemd1, - systemd-sysctl.service8, - systemd-delta1, - sysctl8, - sysctl.conf5, - modprobe8 - + + systemd1 + systemd-sysctl.service8 + systemd-delta1 + sysctl8 + sysctl.conf5 + modprobe8 +