IPVS: Enable connection tracking by default
[ipfire-2.x.git] / config / etc / sysctl.conf
CommitLineData
cd1a2927
MT
1net.ipv4.ip_forward = 1
2net.ipv4.ip_dynaddr = 1
fa822954 3
1c0cfaa5
MT
4# Disable Path MTU Discovery
5net.ipv4.ip_no_pmtu_disc = 1
6
cd1a2927
MT
7net.ipv4.icmp_echo_ignore_broadcasts = 1
8net.ipv4.icmp_ignore_bogus_error_responses = 1
32c6ebdc
MT
9net.ipv4.icmp_ratelimit = 1000
10net.ipv4.icmp_ratemask = 6168
cd1a2927 11
cd1a2927
MT
12net.ipv4.tcp_syncookies = 1
13net.ipv4.tcp_fin_timeout = 30
cd1a2927
MT
14net.ipv4.tcp_syn_retries = 3
15net.ipv4.tcp_synack_retries = 3
16
ed37f707 17net.ipv4.conf.default.arp_filter = 1
cd1a2927
MT
18net.ipv4.conf.default.rp_filter = 0
19net.ipv4.conf.default.accept_redirects = 0
20net.ipv4.conf.default.accept_source_route = 0
21net.ipv4.conf.default.log_martians = 1
22
ed37f707 23net.ipv4.conf.all.arp_filter = 1
cd1a2927
MT
24net.ipv4.conf.all.rp_filter = 0
25net.ipv4.conf.all.accept_redirects = 0
26net.ipv4.conf.all.accept_source_route = 0
27net.ipv4.conf.all.log_martians = 1
28
af2cc3be
MT
29# Enable connection tracking for IPVS
30net.ipv4.vs.conntrack = 1
31
cd1a2927 32kernel.printk = 1 4 1 7
dfb985ca 33vm.swappiness=1
dc931fba 34vm.mmap_min_addr = 4096
d1605d08 35vm.min_free_kbytes = 8192
a30c7aa3
MT
36
37# Disable IPv6 by default.
38net.ipv6.conf.all.disable_ipv6 = 1
39net.ipv6.conf.default.disable_ipv6 = 1
1108a15c
MT
40
41# Enable netfilter accounting
42net.netfilter.nf_conntrack_acct=1
0f1cda21
JS
43
44# Disable netfilter on bridges.
45net.bridge.bridge-nf-call-ip6tables = 0
46net.bridge.bridge-nf-call-iptables = 0
47net.bridge.bridge-nf-call-arptables = 0
373590b7
PM
48
49# Try to keep kernel address exposures out of various /proc files (kallsyms, modules, etc).
d5fe3322 50kernel.kptr_restrict = 2
373590b7
PM
51
52# Avoid kernel memory address exposures via dmesg.
53kernel.dmesg_restrict = 1