Documentation
VyOS Documentation
VyOS System Configuration
VyOS System IP Parameters

VyOS System IP Parameters

System-level IP and IPv6 settings in VyOS let you manage the network stack, optimize performance, and fine-tune the behavior of the IPv4 and IPv6 protocols at the operating system kernel level.

Key Capabilities

  • IPv4 parameters: Manage IP forwarding, ARP, ICMP, RP filter
  • IPv6 parameters: Configure IPv6 forwarding, Router Advertisement, privacy extensions
  • Multipath routing: Balance traffic across multiple paths
  • ARP settings: Control address resolution and the ARP cache
  • TCP/IP parameters: Tune TCP for performance
  • ICMP settings: Control responses to ping and other ICMP messages
  • Source validation: Protect against IP spoofing with the RP filter

IPv4 Configuration

IP Forwarding

# Enable IP forwarding (enabled by default on VyOS)
set system ip disable-forwarding

# IP forwarding is enabled by default; this command DISABLES it
# A router must have it enabled - do NOT use this command

Note: By default, VyOS operates as a router with IP forwarding enabled. The disable-forwarding command is used only for special cases (for example, a firewall without routing).

ARP Settings

# Configure the ARP cache timeout (default is 30 seconds)
set system ip arp table-size 8192

# Ignore ARP requests for addresses not configured locally
set system ip arp-reply-mode restricted

commit
save

ARP Modes:

  • restricted: Reply only to ARP for local IPs
  • reply-any: Reply to ARP for any IP (default)

Disable ICMP Redirects

# Disable sending of ICMP redirects
set system ip disable-icmp-redirect

commit
save

Use case: Improves security and prevents manipulation of client routing.

Multipath Routing

# Enable balancing across equal-cost paths
set system ip multipath layer4-hashing

commit
save

Layer4-hashing: Uses source IP, destination IP, protocol, source port, and destination port to distribute traffic. Ensures packet ordering is preserved within a single session.

IP Source Validation (RP Filter)

# Enable Reverse Path Filtering to protect against spoofing
set system ip source-validation strict

commit
save

Modes:

  • strict: Verify that an incoming packet arrived on the interface that has a route back to the source IP (RFC 3704)
  • loose: Verify only that a route to the source IP exists in the routing table
  • Absent (default): RP filter disabled

Ignore Bogons (RFC 1918, RFC 5735)

# Reject packets with bogon sources on the external interface
# Implemented through the firewall
set firewall group network-group BOGONS network 0.0.0.0/8
set firewall group network-group BOGONS network 10.0.0.0/8
set firewall group network-group BOGONS network 100.64.0.0/10
set firewall group network-group BOGONS network 127.0.0.0/8
set firewall group network-group BOGONS network 169.254.0.0/16
set firewall group network-group BOGONS network 172.16.0.0/12
set firewall group network-group BOGONS network 192.0.0.0/24
set firewall group network-group BOGONS network 192.0.2.0/24
set firewall group network-group BOGONS network 192.168.0.0/16
set firewall group network-group BOGONS network 198.18.0.0/15
set firewall group network-group BOGONS network 198.51.100.0/24
set firewall group network-group BOGONS network 203.0.113.0/24
set firewall group network-group BOGONS network 224.0.0.0/4
set firewall group network-group BOGONS network 240.0.0.0/4

set firewall name WAN_IN rule 10 action drop
set firewall name WAN_IN rule 10 source group network-group BOGONS
set firewall name WAN_IN rule 10 description 'Drop bogon sources'

commit
save

IPv6 Configuration

IPv6 Forwarding

# Enable IPv6 forwarding (enabled by default)
# Disabling (special cases only):
set system ipv6 disable-forwarding

# For a router, IPv6 forwarding must be ENABLED
# Do not use this command on production routers

IPv6 Neighbor Discovery

# Configure IPv6 Neighbor Discovery parameters
# Increase the neighbor cache size
set system ipv6 neighbor table-size 8192

commit
save

Disable IPv6

# Fully disable IPv6 (if it is not used)
set system ipv6 disable

commit
save

Use case: Only if IPv6 is not needed on the network. Reduces the attack surface.

IPv6 Multipath

# Enable balancing across equal-cost IPv6 paths
set system ipv6 multipath layer4-hashing

commit
save

IPv6 Source Validation

# Enable the RP filter for IPv6
set system ipv6 source-validation strict

commit
save

Accept Router Advertisements

# Control acceptance of Router Advertisements on interfaces
# By default VyOS does not accept RA (it acts as a router)

# Enable RA acceptance on a specific interface (for example, a dual-stack WAN)
set interfaces ethernet eth0 ipv6 address autoconf

commit
save

Note: A router usually does not need RAs. This is used only on a WAN interface when receiving IPv6 from a provider via SLAAC.

IPv6 Privacy Extensions (RFC 4941)

# Enable privacy extensions to generate temporary IPv6 addresses
set interfaces ethernet eth1 ipv6 privacy-extension prefer-temporary

commit
save

Privacy Extension Modes:

  • prefer-temporary: Use temporary addresses for outgoing connections
  • prefer-public: Use permanent addresses (default)

Advanced Configuration

TCP Performance Tuning

VyOS lets you tune TCP parameters to optimize performance:

# Settings are applied through sysctl
# Increase TCP buffers for high-speed connections
sudo sysctl -w net.ipv4.tcp_rmem="4096 87380 16777216"
sudo sysctl -w net.ipv4.tcp_wmem="4096 65536 16777216"

# Enable TCP window scaling
sudo sysctl -w net.ipv4.tcp_window_scaling=1

# Enable TCP timestamps
sudo sysctl -w net.ipv4.tcp_timestamps=1

# Enable SACK (Selective Acknowledgment)
sudo sysctl -w net.ipv4.tcp_sack=1

# To apply persistently, add to /etc/sysctl.conf

Creating a persistent configuration:

sudo tee -a /etc/sysctl.d/99-vyos-tcp.conf > /dev/null <<'EOF'
# TCP Performance Tuning
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
EOF

sudo sysctl -p /etc/sysctl.d/99-vyos-tcp.conf

High-Performance Router Settings

# Increase the connection tracking table size
sudo sysctl -w net.netfilter.nf_conntrack_max=262144

# Increase the conntrack hashsize
echo 65536 | sudo tee /sys/module/nf_conntrack/parameters/hashsize

# ARP cache optimization
sudo sysctl -w net.ipv4.neigh.default.gc_thresh1=1024
sudo sysctl -w net.ipv4.neigh.default.gc_thresh2=4096
sudo sysctl -w net.ipv4.neigh.default.gc_thresh3=8192

# IPv6 neighbor cache
sudo sysctl -w net.ipv6.neigh.default.gc_thresh1=1024
sudo sysctl -w net.ipv6.neigh.default.gc_thresh2=4096
sudo sysctl -w net.ipv6.neigh.default.gc_thresh3=8192

# Persistent configuration
sudo tee /etc/sysctl.d/99-vyos-performance.conf > /dev/null <<'EOF'
# Connection Tracking
net.netfilter.nf_conntrack_max = 262144

# ARP Cache
net.ipv4.neigh.default.gc_thresh1 = 1024
net.ipv4.neigh.default.gc_thresh2 = 4096
net.ipv4.neigh.default.gc_thresh3 = 8192

# IPv6 Neighbor Cache
net.ipv6.neigh.default.gc_thresh1 = 1024
net.ipv6.neigh.default.gc_thresh2 = 4096
net.ipv6.neigh.default.gc_thresh3 = 8192
EOF

sudo sysctl -p /etc/sysctl.d/99-vyos-performance.conf

DDoS Protection Settings

# SYN flood protection
sudo sysctl -w net.ipv4.tcp_syncookies=1
sudo sysctl -w net.ipv4.tcp_max_syn_backlog=4096
sudo sysctl -w net.ipv4.tcp_synack_retries=2

# ICMP flood protection
sudo sysctl -w net.ipv4.icmp_ratelimit=100
sudo sysctl -w net.ipv4.icmp_ratemask=6168

# Ignore broadcast ping
sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

# Ignore bogus ICMP errors
sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1

# Persistent configuration
sudo tee /etc/sysctl.d/99-vyos-ddos-protection.conf > /dev/null <<'EOF'
# SYN Flood Protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_synack_retries = 2

# ICMP Flood Protection
net.ipv4.icmp_ratelimit = 100
net.ipv4.icmp_ratemask = 6168
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
EOF

sudo sysctl -p /etc/sysctl.d/99-vyos-ddos-protection.conf

Configuration Examples

1. Edge Router with Spoofing Protection

Goal: Configure an edge router with protection against IP spoofing and bogons.

# Enable strict source validation (RP filter)
set system ip source-validation strict

# Disable ICMP redirects
set system ip disable-icmp-redirect

# Multipath with layer4 hashing
set system ip multipath layer4-hashing

# Firewall to block bogons on the WAN
set firewall group network-group BOGONS network 0.0.0.0/8
set firewall group network-group BOGONS network 10.0.0.0/8
set firewall group network-group BOGONS network 127.0.0.0/8
set firewall group network-group BOGONS network 169.254.0.0/16
set firewall group network-group BOGONS network 172.16.0.0/12
set firewall group network-group BOGONS network 192.168.0.0/16
set firewall group network-group BOGONS network 224.0.0.0/4
set firewall group network-group BOGONS network 240.0.0.0/4

set firewall name WAN_IN rule 10 action drop
set firewall name WAN_IN rule 10 source group network-group BOGONS
set firewall name WAN_IN rule 10 description 'Drop bogon sources'

set firewall name WAN_LOCAL rule 10 action drop
set firewall name WAN_LOCAL rule 10 source group network-group BOGONS

set firewall interface eth0 in name WAN_IN
set firewall interface eth0 local name WAN_LOCAL

commit
save

Additional sysctl settings:

sudo tee /etc/sysctl.d/99-edge-router-security.conf > /dev/null <<'EOF'
# Reverse Path Filtering
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Do not send ICMP redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Ignore source routed packets
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Log Martians (packets with impossible addresses)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
EOF

sudo sysctl -p /etc/sysctl.d/99-edge-router-security.conf

2. Dual-Stack Router with IPv6

Goal: Configure a router to run IPv4 and IPv6 simultaneously.

# IPv4 settings
set system ip multipath layer4-hashing
set system ip source-validation strict

# IPv6 settings
set system ipv6 multipath layer4-hashing
set system ipv6 source-validation strict

# WAN interface - receiving IPv6 from the provider
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 address dhcpv6
set interfaces ethernet eth0 ipv6 address autoconf

# LAN interface - serving IPv4 and IPv6
set interfaces ethernet eth1 address 192.168.1.1/24
set interfaces ethernet eth1 address 2001:db8:1::1/64

# DHCPv4 server
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start 192.168.1.100
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop 192.168.1.200
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option default-router 192.168.1.1
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option name-server 192.168.1.1

# Router Advertisement for IPv6
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 name-server 2001:4860:4860::8888
set service router-advert interface eth1 name-server 2001:4860:4860::8844

# DHCPv6 server (stateless - options only)
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888

# NAT for IPv4
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

commit
save

Verification:

# Check IPv4 connectivity
ping -c 3 8.8.8.8

# Check IPv6 connectivity
ping6 -c 3 2001:4860:4860::8888

# Check dual-stack DNS
host google.com

3. High-Performance Data Center Router

Goal: Optimize VyOS for a high-load environment (10+ Gbps).

# Base configuration
set system ip multipath layer4-hashing
set system ipv6 multipath layer4-hashing

commit
save

Advanced sysctl optimizations:

sudo tee /etc/sysctl.d/99-datacenter-performance.conf > /dev/null <<'EOF'
# TCP Performance for 10GbE+
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.core.rmem_default = 16777216
net.core.wmem_default = 16777216
net.ipv4.tcp_rmem = 4096 87380 67108864
net.ipv4.tcp_wmem = 4096 65536 67108864
net.ipv4.tcp_mem = 134217728 134217728 134217728

# TCP Tuning
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.tcp_moderate_rcvbuf = 1

# Congestion Control (BBR for low latency)
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# Connection Tracking for high load
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_tcp_timeout_established = 7200
net.netfilter.nf_conntrack_generic_timeout = 120

# ARP/Neighbor Cache
net.ipv4.neigh.default.gc_thresh1 = 8192
net.ipv4.neigh.default.gc_thresh2 = 16384
net.ipv4.neigh.default.gc_thresh3 = 32768
net.ipv6.neigh.default.gc_thresh1 = 8192
net.ipv6.neigh.default.gc_thresh2 = 16384
net.ipv6.neigh.default.gc_thresh3 = 32768

# Receive Packet Steering (RPS) - distribution across CPUs
net.core.netdev_max_backlog = 30000

# Optimize for low latency
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_slow_start_after_idle = 0
EOF

sudo sysctl -p /etc/sysctl.d/99-datacenter-performance.conf

# Configure conntrack hashsize
echo 262144 | sudo tee /sys/module/nf_conntrack/parameters/hashsize

IRQ balancing for a 10GbE NIC:

# Install irqbalance for automatic IRQ distribution
sudo apt-get update
sudo apt-get install irqbalance

# Enable and start
sudo systemctl enable irqbalance
sudo systemctl start irqbalance

Performance monitoring:

# View conntrack statistics
cat /proc/net/stat/nf_conntrack

# Check TCP statistics
cat /proc/net/snmp | grep Tcp

# Check network buffer drops
netstat -s | grep -i drop

# Check IRQ distribution
cat /proc/interrupts

4. IPv6-Only Network with NAT64

Goal: Configure an IPv6-only LAN with NAT64 for access to IPv4 resources.

# IPv6 on the LAN
set interfaces ethernet eth1 address 2001:db8:1::1/64

# Router Advertisement
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 name-server 2001:db8:1::1

# DHCPv6 server
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:db8:1::1

# DNS64 (via bind9 or unbound)
# Requires installing additional software
# See the DNS documentation for DNS64 setup

# NAT64 (via Jool or Tayga)
# Requires installing additional software

commit
save

Installing Tayga for NAT64:

# Install tayga
sudo apt-get update
sudo apt-get install tayga

# Tayga configuration
sudo tee /etc/tayga.conf > /dev/null <<'EOF'
tun-device nat64
ipv4-addr 192.0.2.1
ipv6-addr 2001:db8:ffff::1
prefix 64:ff9b::/96
dynamic-pool 192.0.2.128/25
data-dir /var/spool/tayga
EOF

# Enable IP forwarding for tayga
sudo systemctl enable tayga
sudo systemctl start tayga

# Routing for NAT64
sudo ip route add 64:ff9b::/96 dev nat64

Verifying NAT64:

# From an IPv6-only client
ping6 64:ff9b::8.8.8.8
# This is translated into an IPv4 ping to 8.8.8.8

5. Router with ARP Spoofing Protection

Goal: Protect the local network against ARP spoofing attacks.

# Restricted ARP reply mode
set system ip arp-reply-mode restricted

# Static ARP entries for critical servers
set protocols static arp 192.168.1.10 hwaddr 00:50:56:12:34:56
set protocols static arp 192.168.1.11 hwaddr 00:50:56:12:34:57
set protocols static arp 192.168.1.12 hwaddr 00:50:56:12:34:58

commit
save

Dynamic ARP Inspection via the firewall:

# Create a whitelist of allowed MAC addresses
set firewall group mac-group TRUSTED_MACS mac-address 00:50:56:12:34:56
set firewall group mac-group TRUSTED_MACS mac-address 00:50:56:12:34:57
set firewall group mac-group TRUSTED_MACS mac-address 00:50:56:12:34:58

# Block ARP from unknown devices (requires a custom script)
# VyOS has no built-in DAI; a bridge + ebtables is required

ARP monitoring:

# Script to monitor ARP changes
sudo tee /config/scripts/arp-monitor.sh > /dev/null <<'EOF'
#!/bin/bash
# Monitor the ARP table and alert on changes

ARP_LOG="/var/log/arp-changes.log"
TELEGRAM_BOT_TOKEN="YOUR_TOKEN"
TELEGRAM_CHAT_ID="YOUR_CHAT_ID"

send_alert() {
    local message="$1"
    curl -s -X POST "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/sendMessage" \
        -d "chat_id=$TELEGRAM_CHAT_ID" \
        -d "text=$message" > /dev/null
}

# Save the current ARP table
CURRENT_ARP=$(ip neigh show | sort)

# Compare with the previous one
if [ -f /tmp/previous_arp.txt ]; then
    DIFF=$(diff /tmp/previous_arp.txt <(echo "$CURRENT_ARP"))

    if [ -n "$DIFF" ]; then
        echo "$(date): ARP table changed" >> "$ARP_LOG"
        echo "$DIFF" >> "$ARP_LOG"

        # Send an alert
        send_alert "ARP Table Changed on $(hostname):
$DIFF"
    fi
fi

# Save for the next check
echo "$CURRENT_ARP" > /tmp/previous_arp.txt
EOF

sudo chmod +x /config/scripts/arp-monitor.sh

# Schedule a check every 5 minutes
set system task-scheduler task arp-monitor interval '*/5 * * * *'
set system task-scheduler task arp-monitor executable path '/config/scripts/arp-monitor.sh'

commit
save

6. Router for IPv6 Transition (Dual-Stack Lite)

Goal: Configure DS-Lite for a provider with a shortage of IPv4 addresses.

# IPv6 on the WAN (from the provider)
set interfaces ethernet eth0 address dhcpv6
set interfaces ethernet eth0 ipv6 address autoconf

# IPv4 on the LAN (private network)
set interfaces ethernet eth1 address 192.168.1.1/24

# DHCP for clients
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start 192.168.1.100
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop 192.168.1.200
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option default-router 192.168.1.1

# DS-Lite tunnel (AFTR endpoint from the provider)
set interfaces tunnel tun0 encapsulation ipip6
set interfaces tunnel tun0 source-address 2001:db8:1::2
set interfaces tunnel tun0 remote 2001:db8:aftr::1
set interfaces tunnel tun0 address 192.0.0.2/30

# Route IPv4 through the tunnel
set protocols static route 0.0.0.0/0 interface tun0

commit
save

Note: DS-Lite requires provider support (AFTR - Address Family Transition Router). The provider must supply the AFTR endpoint address.

Monitoring and Diagnostics

Operational Commands

# Show current IP parameters
show system ip

# Show IPv6 parameters
show system ipv6

# ARP table
show arp

# IPv6 neighbor table
show ipv6 neighbors

# Connection tracking statistics
show conntrack table ipv4
show conntrack table ipv6

# ICMP statistics
show interfaces ethernet eth0 statistics

# TCP statistics
netstat -s

Sysctl Parameters

# Show all IP-related sysctl
sysctl -a | grep net.ipv4
sysctl -a | grep net.ipv6

# Check a specific parameter
sysctl net.ipv4.ip_forward
sysctl net.ipv4.conf.all.rp_filter

# Change temporarily (until reboot)
sudo sysctl -w net.ipv4.tcp_syncookies=1

# Show all changed parameters
sudo sysctl -a | grep -v "= 0$"

Connection Tracking

# Number of conntrack entries
cat /proc/sys/net/netfilter/nf_conntrack_count

# Conntrack maximum
cat /proc/sys/net/netfilter/nf_conntrack_max

# Conntrack table
conntrack -L

# Conntrack statistics
cat /proc/net/stat/nf_conntrack

# Top sources by number of connections
conntrack -L | awk '{print $5}' | cut -d= -f2 | sort | uniq -c | sort -rn | head -10

Performance Monitoring

# Check network drops
netstat -s | grep -i drop

# Check TCP retransmits
netstat -s | grep -i retrans

# Check UDP statistics
netstat -s | grep -i udp

# Interface statistics
show interfaces ethernet eth0 statistics

Troubleshooting

1. IP Forwarding Not Working

Symptoms: Clients cannot reach the internet through the router.

Check:

# Check IP forwarding
sysctl net.ipv4.ip_forward
# Should be: net.ipv4.ip_forward = 1

# Check the VyOS configuration
show configuration system ip | grep forwarding
# Should NOT show: disable-forwarding

Fix:

# If forwarding is disabled, remove disable
delete system ip disable-forwarding

commit
save

# Check in the kernel
sudo sysctl -w net.ipv4.ip_forward=1

2. No IPv6 Connectivity

Symptoms: IPv4 works, IPv6 does not.

Check:

# Check IPv6 forwarding
sysctl net.ipv6.conf.all.forwarding
# Should be: 1

# Check whether IPv6 is disabled
show configuration system ipv6

# Check IPv6 addresses on the interfaces
show interfaces

# Check IPv6 connectivity
ping6 2001:4860:4860::8888

Fix:

# If IPv6 is disabled, enable it
delete system ipv6 disable

commit
save

# Check Router Advertisement (if this is a LAN)
show service router-advert

# Check the firewall (make sure it does not block ICMPv6)
show firewall
# ICMPv6 types 133-137 must be allowed

3. Conntrack Table Full

Symptoms: “nf_conntrack: table full, dropping packet” in the logs.

Check:

# Current number of conntrack entries
cat /proc/sys/net/netfilter/nf_conntrack_count

# Maximum
cat /proc/sys/net/netfilter/nf_conntrack_max

# If count is close to max, the table is full

Fix:

# Increase nf_conntrack_max
sudo sysctl -w net.netfilter.nf_conntrack_max=262144

# Increase the hashsize
echo 65536 | sudo tee /sys/module/nf_conntrack/parameters/hashsize

# Reduce the timeout for established connections
sudo sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=3600

# Make it persistent
sudo tee /etc/sysctl.d/99-conntrack.conf > /dev/null <<'EOF'
net.netfilter.nf_conntrack_max = 262144
net.netfilter.nf_conntrack_tcp_timeout_established = 3600
EOF

sudo sysctl -p /etc/sysctl.d/99-conntrack.conf

4. ARP Cache Full

Symptoms: Unable to resolve ARP for new hosts.

Check:

# ARP cache size
ip neigh show | wc -l

# Check the sysctl thresholds
sysctl net.ipv4.neigh.default.gc_thresh1
sysctl net.ipv4.neigh.default.gc_thresh2
sysctl net.ipv4.neigh.default.gc_thresh3

Fix:

# Increase the ARP cache thresholds
sudo sysctl -w net.ipv4.neigh.default.gc_thresh1=2048
sudo sysctl -w net.ipv4.neigh.default.gc_thresh2=4096
sudo sysctl -w net.ipv4.neigh.default.gc_thresh3=8192

# For IPv6
sudo sysctl -w net.ipv6.neigh.default.gc_thresh1=2048
sudo sysctl -w net.ipv6.neigh.default.gc_thresh2=4096
sudo sysctl -w net.ipv6.neigh.default.gc_thresh3=8192

# Make it persistent
sudo tee /etc/sysctl.d/99-arp-cache.conf > /dev/null <<'EOF'
net.ipv4.neigh.default.gc_thresh1 = 2048
net.ipv4.neigh.default.gc_thresh2 = 4096
net.ipv4.neigh.default.gc_thresh3 = 8192
net.ipv6.neigh.default.gc_thresh1 = 2048
net.ipv6.neigh.default.gc_thresh2 = 4096
net.ipv6.neigh.default.gc_thresh3 = 8192
EOF

sudo sysctl -p /etc/sysctl.d/99-arp-cache.conf

5. Poor TCP Performance

Symptoms: Slow download/upload speeds for large files.

Check:

# Check the TCP buffers
sysctl net.ipv4.tcp_rmem
sysctl net.ipv4.tcp_wmem

# Check window scaling
sysctl net.ipv4.tcp_window_scaling

# Check congestion control
sysctl net.ipv4.tcp_congestion_control

Fix:

# Increase the TCP buffers
sudo sysctl -w net.core.rmem_max=16777216
sudo sysctl -w net.core.wmem_max=16777216
sudo sysctl -w net.ipv4.tcp_rmem="4096 87380 16777216"
sudo sysctl -w net.ipv4.tcp_wmem="4096 65536 16777216"

# Enable the important options
sudo sysctl -w net.ipv4.tcp_window_scaling=1
sudo sysctl -w net.ipv4.tcp_timestamps=1
sudo sysctl -w net.ipv4.tcp_sack=1

# Use BBR for congestion control (requires Linux 4.9+)
sudo sysctl -w net.core.default_qdisc=fq
sudo sysctl -w net.ipv4.tcp_congestion_control=bbr

# Make it persistent
sudo tee /etc/sysctl.d/99-tcp-performance.conf > /dev/null <<'EOF'
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
EOF

sudo sysctl -p /etc/sysctl.d/99-tcp-performance.conf

6. RP Filter Blocking Legitimate Traffic

Symptoms: Asymmetric routing does not work; packets are dropped.

Check:

# Check the RP filter mode
sysctl net.ipv4.conf.all.rp_filter

# Check the logs (if log_martians is enabled)
dmesg | grep -i "martian"

# Check the VyOS configuration
show configuration system ip | grep source-validation

Fix:

# Switch to loose mode (less strict)
delete system ip source-validation
set system ip source-validation loose

commit
save

# Or disable the RP filter for specific interfaces
sudo sysctl -w net.ipv4.conf.eth1.rp_filter=0

# To apply persistently
sudo tee /etc/sysctl.d/99-rp-filter.conf > /dev/null <<'EOF'
net.ipv4.conf.eth1.rp_filter = 0
EOF

Best Practices

  1. IP Forwarding

    • Keep it enabled on routers (the default)
    • Disable it only on a firewall without routing
    • Verify it after a VyOS upgrade

  2. Source Validation (RP Filter)

    • Use strict mode on edge routers
    • Use loose mode with asymmetric routing
    • Disable it only in extreme cases (VRF, complex topology)

  3. IPv6 Configuration

    • Enable IPv6 even if it is not used yet
    • Plan for dual-stack from the start
    • Use Router Advertisement for SLAAC
    • Use DHCPv6 for additional options (DNS)

  4. Connection Tracking

    • Increase nf_conntrack_max on high-load routers
    • Monitor the conntrack count/max ratio
    • Tune timeouts to the load
    • Hashsize = conntrack_max / 8 (optimal)

  5. Performance Tuning

    • Increase TCP buffers for WAN > 100 Mbps
    • Use BBR congestion control for low latency
    • Enable TCP window scaling, SACK, timestamps
    • Configure IRQ balancing on multi-core systems

  6. Security

    • Disable ICMP redirects on the WAN
    • Block bogon sources at the edge
    • Enable SYN cookies for protection against SYN flood
    • Rate limit ICMP

  7. ARP/Neighbor Cache

    • Increase thresholds for large networks (>1000 hosts)
    • Use static ARP for critical servers
    • Monitor ARP changes to detect spoofing

  8. Multipath Routing

    • Use layer4-hashing to preserve packet ordering
    • Apply it to both IPv4 and IPv6
    • Required for ECMP and load balancing

  9. Monitoring

    • Monitor conntrack usage
    • Track TCP retransmits
    • Check network drops
    • Log martians on edge routers

  10. Documentation

    • Document all non-standard sysctl parameters
    • Store configuration files in /etc/sysctl.d/
    • Use descriptive file names
    • Test changes before production

Conclusion

Proper configuration of the system IP and IPv6 parameters is critical to the performance, security, and stability of a VyOS router. Tuning the RP filter, multipath routing, connection tracking, TCP parameters, and other network stack options lets you optimize the router for specific network requirements - from an edge router with spoofing protection to a high-performance data center router.

Reviewed by OpenNix LLC · Last updated on
Time Zone Configuration in VyOSTask Scheduler in VyOS