# VyOS System IP Parameters

> Configure VyOS system IP settings: ARP tables, IP forwarding, multipath routing, ECMP balancing, and TCP/UDP tuning for Yandex Cloud and VK Cloud.

Source: https://opennix.org/en/docs/vyos/system/vyos-ip/



System-level IP and IPv6 settings in VyOS let you manage the network stack, optimize performance, and fine-tune the behavior of the IPv4 and IPv6 protocols at the operating system kernel level.

## Key Capabilities

- **IPv4 parameters**: Manage IP forwarding, ARP, ICMP, RP filter
- **IPv6 parameters**: Configure IPv6 forwarding, Router Advertisement, privacy extensions
- **Multipath routing**: Balance traffic across multiple paths
- **ARP settings**: Control address resolution and the ARP cache
- **TCP/IP parameters**: Tune TCP for performance
- **ICMP settings**: Control responses to ping and other ICMP messages
- **Source validation**: Protect against IP spoofing with the RP filter

## IPv4 Configuration

### IP Forwarding

```bash
# Enable IP forwarding (enabled by default on VyOS)
set system ip disable-forwarding

# IP forwarding is enabled by default; this command DISABLES it
# A router must have it enabled - do NOT use this command
```

**Note**: By default, VyOS operates as a router with IP forwarding enabled. The `disable-forwarding` command is used only for special cases (for example, a firewall without routing).

### ARP Settings

```bash
# Configure the ARP cache timeout (default is 30 seconds)
set system ip arp table-size 8192

# Ignore ARP requests for addresses not configured locally
set system ip arp-reply-mode restricted

commit
save
```

**ARP Modes**:
- `restricted`: Reply only to ARP for local IPs
- `reply-any`: Reply to ARP for any IP (default)

### Disable ICMP Redirects

```bash
# Disable sending of ICMP redirects
set system ip disable-icmp-redirect

commit
save
```

**Use case**: Improves security and prevents manipulation of client routing.

### Multipath Routing

```bash
# Enable balancing across equal-cost paths
set system ip multipath layer4-hashing

commit
save
```

**Layer4-hashing**: Uses source IP, destination IP, protocol, source port, and destination port to distribute traffic. Ensures packet ordering is preserved within a single session.

### IP Source Validation (RP Filter)

```bash
# Enable Reverse Path Filtering to protect against spoofing
set system ip source-validation strict

commit
save
```

**Modes**:
- `strict`: Verify that an incoming packet arrived on the interface that has a route back to the source IP (RFC 3704)
- `loose`: Verify only that a route to the source IP exists in the routing table
- Absent (default): RP filter disabled

### Ignore Bogons (RFC 1918, RFC 5735)

```bash
# Reject packets with bogon sources on the external interface
# Implemented through the firewall
set firewall group network-group BOGONS network 0.0.0.0/8
set firewall group network-group BOGONS network 10.0.0.0/8
set firewall group network-group BOGONS network 100.64.0.0/10
set firewall group network-group BOGONS network 127.0.0.0/8
set firewall group network-group BOGONS network 169.254.0.0/16
set firewall group network-group BOGONS network 172.16.0.0/12
set firewall group network-group BOGONS network 192.0.0.0/24
set firewall group network-group BOGONS network 192.0.2.0/24
set firewall group network-group BOGONS network 192.168.0.0/16
set firewall group network-group BOGONS network 198.18.0.0/15
set firewall group network-group BOGONS network 198.51.100.0/24
set firewall group network-group BOGONS network 203.0.113.0/24
set firewall group network-group BOGONS network 224.0.0.0/4
set firewall group network-group BOGONS network 240.0.0.0/4

set firewall name WAN_IN rule 10 action drop
set firewall name WAN_IN rule 10 source group network-group BOGONS
set firewall name WAN_IN rule 10 description 'Drop bogon sources'

commit
save
```

## IPv6 Configuration

### IPv6 Forwarding

```bash
# Enable IPv6 forwarding (enabled by default)
# Disabling (special cases only):
set system ipv6 disable-forwarding

# For a router, IPv6 forwarding must be ENABLED
# Do not use this command on production routers
```

### IPv6 Neighbor Discovery

```bash
# Configure IPv6 Neighbor Discovery parameters
# Increase the neighbor cache size
set system ipv6 neighbor table-size 8192

commit
save
```

### Disable IPv6

```bash
# Fully disable IPv6 (if it is not used)
set system ipv6 disable

commit
save
```

**Use case**: Only if IPv6 is not needed on the network. Reduces the attack surface.

### IPv6 Multipath

```bash
# Enable balancing across equal-cost IPv6 paths
set system ipv6 multipath layer4-hashing

commit
save
```

### IPv6 Source Validation

```bash
# Enable the RP filter for IPv6
set system ipv6 source-validation strict

commit
save
```

### Accept Router Advertisements

```bash
# Control acceptance of Router Advertisements on interfaces
# By default VyOS does not accept RA (it acts as a router)

# Enable RA acceptance on a specific interface (for example, a dual-stack WAN)
set interfaces ethernet eth0 ipv6 address autoconf

commit
save
```

**Note**: A router usually does not need RAs. This is used only on a WAN interface when receiving IPv6 from a provider via SLAAC.

### IPv6 Privacy Extensions (RFC 4941)

```bash
# Enable privacy extensions to generate temporary IPv6 addresses
set interfaces ethernet eth1 ipv6 privacy-extension prefer-temporary

commit
save
```

**Privacy Extension Modes**:
- `prefer-temporary`: Use temporary addresses for outgoing connections
- `prefer-public`: Use permanent addresses (default)

## Advanced Configuration

### TCP Performance Tuning

VyOS lets you tune TCP parameters to optimize performance:

```bash
# Settings are applied through sysctl
# Increase TCP buffers for high-speed connections
sudo sysctl -w net.ipv4.tcp_rmem="4096 87380 16777216"
sudo sysctl -w net.ipv4.tcp_wmem="4096 65536 16777216"

# Enable TCP window scaling
sudo sysctl -w net.ipv4.tcp_window_scaling=1

# Enable TCP timestamps
sudo sysctl -w net.ipv4.tcp_timestamps=1

# Enable SACK (Selective Acknowledgment)
sudo sysctl -w net.ipv4.tcp_sack=1

# To apply persistently, add to /etc/sysctl.conf
```

**Creating a persistent configuration**:
```bash
sudo tee -a /etc/sysctl.d/99-vyos-tcp.conf > /dev/null <<'EOF'
# TCP Performance Tuning
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
EOF

sudo sysctl -p /etc/sysctl.d/99-vyos-tcp.conf
```

### High-Performance Router Settings

```bash
# Increase the connection tracking table size
sudo sysctl -w net.netfilter.nf_conntrack_max=262144

# Increase the conntrack hashsize
echo 65536 | sudo tee /sys/module/nf_conntrack/parameters/hashsize

# ARP cache optimization
sudo sysctl -w net.ipv4.neigh.default.gc_thresh1=1024
sudo sysctl -w net.ipv4.neigh.default.gc_thresh2=4096
sudo sysctl -w net.ipv4.neigh.default.gc_thresh3=8192

# IPv6 neighbor cache
sudo sysctl -w net.ipv6.neigh.default.gc_thresh1=1024
sudo sysctl -w net.ipv6.neigh.default.gc_thresh2=4096
sudo sysctl -w net.ipv6.neigh.default.gc_thresh3=8192

# Persistent configuration
sudo tee /etc/sysctl.d/99-vyos-performance.conf > /dev/null <<'EOF'
# Connection Tracking
net.netfilter.nf_conntrack_max = 262144

# ARP Cache
net.ipv4.neigh.default.gc_thresh1 = 1024
net.ipv4.neigh.default.gc_thresh2 = 4096
net.ipv4.neigh.default.gc_thresh3 = 8192

# IPv6 Neighbor Cache
net.ipv6.neigh.default.gc_thresh1 = 1024
net.ipv6.neigh.default.gc_thresh2 = 4096
net.ipv6.neigh.default.gc_thresh3 = 8192
EOF

sudo sysctl -p /etc/sysctl.d/99-vyos-performance.conf
```

### DDoS Protection Settings

```bash
# SYN flood protection
sudo sysctl -w net.ipv4.tcp_syncookies=1
sudo sysctl -w net.ipv4.tcp_max_syn_backlog=4096
sudo sysctl -w net.ipv4.tcp_synack_retries=2

# ICMP flood protection
sudo sysctl -w net.ipv4.icmp_ratelimit=100
sudo sysctl -w net.ipv4.icmp_ratemask=6168

# Ignore broadcast ping
sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

# Ignore bogus ICMP errors
sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1

# Persistent configuration
sudo tee /etc/sysctl.d/99-vyos-ddos-protection.conf > /dev/null <<'EOF'
# SYN Flood Protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_synack_retries = 2

# ICMP Flood Protection
net.ipv4.icmp_ratelimit = 100
net.ipv4.icmp_ratemask = 6168
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
EOF

sudo sysctl -p /etc/sysctl.d/99-vyos-ddos-protection.conf
```

## Configuration Examples

### 1. Edge Router with Spoofing Protection

**Goal**: Configure an edge router with protection against IP spoofing and bogons.

```bash
# Enable strict source validation (RP filter)
set system ip source-validation strict

# Disable ICMP redirects
set system ip disable-icmp-redirect

# Multipath with layer4 hashing
set system ip multipath layer4-hashing

# Firewall to block bogons on the WAN
set firewall group network-group BOGONS network 0.0.0.0/8
set firewall group network-group BOGONS network 10.0.0.0/8
set firewall group network-group BOGONS network 127.0.0.0/8
set firewall group network-group BOGONS network 169.254.0.0/16
set firewall group network-group BOGONS network 172.16.0.0/12
set firewall group network-group BOGONS network 192.168.0.0/16
set firewall group network-group BOGONS network 224.0.0.0/4
set firewall group network-group BOGONS network 240.0.0.0/4

set firewall name WAN_IN rule 10 action drop
set firewall name WAN_IN rule 10 source group network-group BOGONS
set firewall name WAN_IN rule 10 description 'Drop bogon sources'

set firewall name WAN_LOCAL rule 10 action drop
set firewall name WAN_LOCAL rule 10 source group network-group BOGONS

set firewall interface eth0 in name WAN_IN
set firewall interface eth0 local name WAN_LOCAL

commit
save
```

**Additional sysctl settings**:
```bash
sudo tee /etc/sysctl.d/99-edge-router-security.conf > /dev/null <<'EOF'
# Reverse Path Filtering
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Do not send ICMP redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Ignore source routed packets
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Log Martians (packets with impossible addresses)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
EOF

sudo sysctl -p /etc/sysctl.d/99-edge-router-security.conf
```

### 2. Dual-Stack Router with IPv6

**Goal**: Configure a router to run IPv4 and IPv6 simultaneously.

```bash
# IPv4 settings
set system ip multipath layer4-hashing
set system ip source-validation strict

# IPv6 settings
set system ipv6 multipath layer4-hashing
set system ipv6 source-validation strict

# WAN interface - receiving IPv6 from the provider
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 address dhcpv6
set interfaces ethernet eth0 ipv6 address autoconf

# LAN interface - serving IPv4 and IPv6
set interfaces ethernet eth1 address 192.168.1.1/24
set interfaces ethernet eth1 address 2001:db8:1::1/64

# DHCPv4 server
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start 192.168.1.100
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop 192.168.1.200
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option default-router 192.168.1.1
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option name-server 192.168.1.1

# Router Advertisement for IPv6
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 name-server 2001:4860:4860::8888
set service router-advert interface eth1 name-server 2001:4860:4860::8844

# DHCPv6 server (stateless - options only)
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888

# NAT for IPv4
set nat source rule 100 outbound-interface eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

commit
save
```

**Verification**:
```bash
# Check IPv4 connectivity
ping -c 3 8.8.8.8

# Check IPv6 connectivity
ping6 -c 3 2001:4860:4860::8888

# Check dual-stack DNS
host google.com
```

### 3. High-Performance Data Center Router

**Goal**: Optimize VyOS for a high-load environment (10+ Gbps).

```bash
# Base configuration
set system ip multipath layer4-hashing
set system ipv6 multipath layer4-hashing

commit
save
```

**Advanced sysctl optimizations**:
```bash
sudo tee /etc/sysctl.d/99-datacenter-performance.conf > /dev/null <<'EOF'
# TCP Performance for 10GbE+
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.core.rmem_default = 16777216
net.core.wmem_default = 16777216
net.ipv4.tcp_rmem = 4096 87380 67108864
net.ipv4.tcp_wmem = 4096 65536 67108864
net.ipv4.tcp_mem = 134217728 134217728 134217728

# TCP Tuning
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.tcp_moderate_rcvbuf = 1

# Congestion Control (BBR for low latency)
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# Connection Tracking for high load
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_tcp_timeout_established = 7200
net.netfilter.nf_conntrack_generic_timeout = 120

# ARP/Neighbor Cache
net.ipv4.neigh.default.gc_thresh1 = 8192
net.ipv4.neigh.default.gc_thresh2 = 16384
net.ipv4.neigh.default.gc_thresh3 = 32768
net.ipv6.neigh.default.gc_thresh1 = 8192
net.ipv6.neigh.default.gc_thresh2 = 16384
net.ipv6.neigh.default.gc_thresh3 = 32768

# Receive Packet Steering (RPS) - distribution across CPUs
net.core.netdev_max_backlog = 30000

# Optimize for low latency
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_slow_start_after_idle = 0
EOF

sudo sysctl -p /etc/sysctl.d/99-datacenter-performance.conf

# Configure conntrack hashsize
echo 262144 | sudo tee /sys/module/nf_conntrack/parameters/hashsize
```

**IRQ balancing for a 10GbE NIC**:
```bash
# Install irqbalance for automatic IRQ distribution
sudo apt-get update
sudo apt-get install irqbalance

# Enable and start
sudo systemctl enable irqbalance
sudo systemctl start irqbalance
```

**Performance monitoring**:
```bash
# View conntrack statistics
cat /proc/net/stat/nf_conntrack

# Check TCP statistics
cat /proc/net/snmp | grep Tcp

# Check network buffer drops
netstat -s | grep -i drop

# Check IRQ distribution
cat /proc/interrupts
```

### 4. IPv6-Only Network with NAT64

**Goal**: Configure an IPv6-only LAN with NAT64 for access to IPv4 resources.

```bash
# IPv6 on the LAN
set interfaces ethernet eth1 address 2001:db8:1::1/64

# Router Advertisement
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 name-server 2001:db8:1::1

# DHCPv6 server
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:db8:1::1

# DNS64 (via bind9 or unbound)
# Requires installing additional software
# See the DNS documentation for DNS64 setup

# NAT64 (via Jool or Tayga)
# Requires installing additional software

commit
save
```

**Installing Tayga for NAT64**:
```bash
# Install tayga
sudo apt-get update
sudo apt-get install tayga

# Tayga configuration
sudo tee /etc/tayga.conf > /dev/null <<'EOF'
tun-device nat64
ipv4-addr 192.0.2.1
ipv6-addr 2001:db8:ffff::1
prefix 64:ff9b::/96
dynamic-pool 192.0.2.128/25
data-dir /var/spool/tayga
EOF

# Enable IP forwarding for tayga
sudo systemctl enable tayga
sudo systemctl start tayga

# Routing for NAT64
sudo ip route add 64:ff9b::/96 dev nat64
```

**Verifying NAT64**:
```bash
# From an IPv6-only client
ping6 64:ff9b::8.8.8.8
# This is translated into an IPv4 ping to 8.8.8.8
```

### 5. Router with ARP Spoofing Protection

**Goal**: Protect the local network against ARP spoofing attacks.

```bash
# Restricted ARP reply mode
set system ip arp-reply-mode restricted

# Static ARP entries for critical servers
set protocols static arp 192.168.1.10 hwaddr 00:50:56:12:34:56
set protocols static arp 192.168.1.11 hwaddr 00:50:56:12:34:57
set protocols static arp 192.168.1.12 hwaddr 00:50:56:12:34:58

commit
save
```

**Dynamic ARP Inspection via the firewall**:
```bash
# Create a whitelist of allowed MAC addresses
set firewall group mac-group TRUSTED_MACS mac-address 00:50:56:12:34:56
set firewall group mac-group TRUSTED_MACS mac-address 00:50:56:12:34:57
set firewall group mac-group TRUSTED_MACS mac-address 00:50:56:12:34:58

# Block ARP from unknown devices (requires a custom script)
# VyOS has no built-in DAI; a bridge + ebtables is required
```

**ARP monitoring**:
```bash
# Script to monitor ARP changes
sudo tee /config/scripts/arp-monitor.sh > /dev/null <<'EOF'
#!/bin/bash
# Monitor the ARP table and alert on changes

ARP_LOG="/var/log/arp-changes.log"
TELEGRAM_BOT_TOKEN="YOUR_TOKEN"
TELEGRAM_CHAT_ID="YOUR_CHAT_ID"

send_alert() {
    local message="$1"
    curl -s -X POST "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/sendMessage" \
        -d "chat_id=$TELEGRAM_CHAT_ID" \
        -d "text=$message" > /dev/null
}

# Save the current ARP table
CURRENT_ARP=$(ip neigh show | sort)

# Compare with the previous one
if [ -f /tmp/previous_arp.txt ]; then
    DIFF=$(diff /tmp/previous_arp.txt <(echo "$CURRENT_ARP"))

    if [ -n "$DIFF" ]; then
        echo "$(date): ARP table changed" >> "$ARP_LOG"
        echo "$DIFF" >> "$ARP_LOG"

        # Send an alert
        send_alert "ARP Table Changed on $(hostname):
$DIFF"
    fi
fi

# Save for the next check
echo "$CURRENT_ARP" > /tmp/previous_arp.txt
EOF

sudo chmod +x /config/scripts/arp-monitor.sh

# Schedule a check every 5 minutes
set system task-scheduler task arp-monitor interval '*/5 * * * *'
set system task-scheduler task arp-monitor executable path '/config/scripts/arp-monitor.sh'

commit
save
```

### 6. Router for IPv6 Transition (Dual-Stack Lite)

**Goal**: Configure DS-Lite for a provider with a shortage of IPv4 addresses.

```bash
# IPv6 on the WAN (from the provider)
set interfaces ethernet eth0 address dhcpv6
set interfaces ethernet eth0 ipv6 address autoconf

# IPv4 on the LAN (private network)
set interfaces ethernet eth1 address 192.168.1.1/24

# DHCP for clients
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start 192.168.1.100
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop 192.168.1.200
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option default-router 192.168.1.1

# DS-Lite tunnel (AFTR endpoint from the provider)
set interfaces tunnel tun0 encapsulation ipip6
set interfaces tunnel tun0 source-address 2001:db8:1::2
set interfaces tunnel tun0 remote 2001:db8:aftr::1
set interfaces tunnel tun0 address 192.0.0.2/30

# Route IPv4 through the tunnel
set protocols static route 0.0.0.0/0 interface tun0

commit
save
```

**Note**: DS-Lite requires provider support (AFTR - Address Family Transition Router). The provider must supply the AFTR endpoint address.

## Monitoring and Diagnostics

### Operational Commands

```bash
# Show current IP parameters
show system ip

# Show IPv6 parameters
show system ipv6

# ARP table
show arp

# IPv6 neighbor table
show ipv6 neighbors

# Connection tracking statistics
show conntrack table ipv4
show conntrack table ipv6

# ICMP statistics
show interfaces ethernet eth0 statistics

# TCP statistics
netstat -s
```

### Sysctl Parameters

```bash
# Show all IP-related sysctl
sysctl -a | grep net.ipv4
sysctl -a | grep net.ipv6

# Check a specific parameter
sysctl net.ipv4.ip_forward
sysctl net.ipv4.conf.all.rp_filter

# Change temporarily (until reboot)
sudo sysctl -w net.ipv4.tcp_syncookies=1

# Show all changed parameters
sudo sysctl -a | grep -v "= 0$"
```

### Connection Tracking

```bash
# Number of conntrack entries
cat /proc/sys/net/netfilter/nf_conntrack_count

# Conntrack maximum
cat /proc/sys/net/netfilter/nf_conntrack_max

# Conntrack table
conntrack -L

# Conntrack statistics
cat /proc/net/stat/nf_conntrack

# Top sources by number of connections
conntrack -L | awk '{print $5}' | cut -d= -f2 | sort | uniq -c | sort -rn | head -10
```

### Performance Monitoring

```bash
# Check network drops
netstat -s | grep -i drop

# Check TCP retransmits
netstat -s | grep -i retrans

# Check UDP statistics
netstat -s | grep -i udp

# Interface statistics
show interfaces ethernet eth0 statistics
```

## Troubleshooting

### 1. IP Forwarding Not Working

**Symptoms**: Clients cannot reach the internet through the router.

**Check**:
```bash
# Check IP forwarding
sysctl net.ipv4.ip_forward
# Should be: net.ipv4.ip_forward = 1

# Check the VyOS configuration
show configuration system ip | grep forwarding
# Should NOT show: disable-forwarding
```

**Fix**:
```bash
# If forwarding is disabled, remove disable
delete system ip disable-forwarding

commit
save

# Check in the kernel
sudo sysctl -w net.ipv4.ip_forward=1
```

### 2. No IPv6 Connectivity

**Symptoms**: IPv4 works, IPv6 does not.

**Check**:
```bash
# Check IPv6 forwarding
sysctl net.ipv6.conf.all.forwarding
# Should be: 1

# Check whether IPv6 is disabled
show configuration system ipv6

# Check IPv6 addresses on the interfaces
show interfaces

# Check IPv6 connectivity
ping6 2001:4860:4860::8888
```

**Fix**:
```bash
# If IPv6 is disabled, enable it
delete system ipv6 disable

commit
save

# Check Router Advertisement (if this is a LAN)
show service router-advert

# Check the firewall (make sure it does not block ICMPv6)
show firewall
# ICMPv6 types 133-137 must be allowed
```

### 3. Conntrack Table Full

**Symptoms**: "nf_conntrack: table full, dropping packet" in the logs.

**Check**:
```bash
# Current number of conntrack entries
cat /proc/sys/net/netfilter/nf_conntrack_count

# Maximum
cat /proc/sys/net/netfilter/nf_conntrack_max

# If count is close to max, the table is full
```

**Fix**:
```bash
# Increase nf_conntrack_max
sudo sysctl -w net.netfilter.nf_conntrack_max=262144

# Increase the hashsize
echo 65536 | sudo tee /sys/module/nf_conntrack/parameters/hashsize

# Reduce the timeout for established connections
sudo sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=3600

# Make it persistent
sudo tee /etc/sysctl.d/99-conntrack.conf > /dev/null <<'EOF'
net.netfilter.nf_conntrack_max = 262144
net.netfilter.nf_conntrack_tcp_timeout_established = 3600
EOF

sudo sysctl -p /etc/sysctl.d/99-conntrack.conf
```

### 4. ARP Cache Full

**Symptoms**: Unable to resolve ARP for new hosts.

**Check**:
```bash
# ARP cache size
ip neigh show | wc -l

# Check the sysctl thresholds
sysctl net.ipv4.neigh.default.gc_thresh1
sysctl net.ipv4.neigh.default.gc_thresh2
sysctl net.ipv4.neigh.default.gc_thresh3
```

**Fix**:
```bash
# Increase the ARP cache thresholds
sudo sysctl -w net.ipv4.neigh.default.gc_thresh1=2048
sudo sysctl -w net.ipv4.neigh.default.gc_thresh2=4096
sudo sysctl -w net.ipv4.neigh.default.gc_thresh3=8192

# For IPv6
sudo sysctl -w net.ipv6.neigh.default.gc_thresh1=2048
sudo sysctl -w net.ipv6.neigh.default.gc_thresh2=4096
sudo sysctl -w net.ipv6.neigh.default.gc_thresh3=8192

# Make it persistent
sudo tee /etc/sysctl.d/99-arp-cache.conf > /dev/null <<'EOF'
net.ipv4.neigh.default.gc_thresh1 = 2048
net.ipv4.neigh.default.gc_thresh2 = 4096
net.ipv4.neigh.default.gc_thresh3 = 8192
net.ipv6.neigh.default.gc_thresh1 = 2048
net.ipv6.neigh.default.gc_thresh2 = 4096
net.ipv6.neigh.default.gc_thresh3 = 8192
EOF

sudo sysctl -p /etc/sysctl.d/99-arp-cache.conf
```

### 5. Poor TCP Performance

**Symptoms**: Slow download/upload speeds for large files.

**Check**:
```bash
# Check the TCP buffers
sysctl net.ipv4.tcp_rmem
sysctl net.ipv4.tcp_wmem

# Check window scaling
sysctl net.ipv4.tcp_window_scaling

# Check congestion control
sysctl net.ipv4.tcp_congestion_control
```

**Fix**:
```bash
# Increase the TCP buffers
sudo sysctl -w net.core.rmem_max=16777216
sudo sysctl -w net.core.wmem_max=16777216
sudo sysctl -w net.ipv4.tcp_rmem="4096 87380 16777216"
sudo sysctl -w net.ipv4.tcp_wmem="4096 65536 16777216"

# Enable the important options
sudo sysctl -w net.ipv4.tcp_window_scaling=1
sudo sysctl -w net.ipv4.tcp_timestamps=1
sudo sysctl -w net.ipv4.tcp_sack=1

# Use BBR for congestion control (requires Linux 4.9+)
sudo sysctl -w net.core.default_qdisc=fq
sudo sysctl -w net.ipv4.tcp_congestion_control=bbr

# Make it persistent
sudo tee /etc/sysctl.d/99-tcp-performance.conf > /dev/null <<'EOF'
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
EOF

sudo sysctl -p /etc/sysctl.d/99-tcp-performance.conf
```

### 6. RP Filter Blocking Legitimate Traffic

**Symptoms**: Asymmetric routing does not work; packets are dropped.

**Check**:
```bash
# Check the RP filter mode
sysctl net.ipv4.conf.all.rp_filter

# Check the logs (if log_martians is enabled)
dmesg | grep -i "martian"

# Check the VyOS configuration
show configuration system ip | grep source-validation
```

**Fix**:
```bash
# Switch to loose mode (less strict)
delete system ip source-validation
set system ip source-validation loose

commit
save

# Or disable the RP filter for specific interfaces
sudo sysctl -w net.ipv4.conf.eth1.rp_filter=0

# To apply persistently
sudo tee /etc/sysctl.d/99-rp-filter.conf > /dev/null <<'EOF'
net.ipv4.conf.eth1.rp_filter = 0
EOF
```

## Best Practices

1. **IP Forwarding**
   - Keep it enabled on routers (the default)
   - Disable it only on a firewall without routing
   - Verify it after a VyOS upgrade

2. **Source Validation (RP Filter)**
   - Use strict mode on edge routers
   - Use loose mode with asymmetric routing
   - Disable it only in extreme cases (VRF, complex topology)

3. **IPv6 Configuration**
   - Enable IPv6 even if it is not used yet
   - Plan for dual-stack from the start
   - Use Router Advertisement for SLAAC
   - Use DHCPv6 for additional options (DNS)

4. **Connection Tracking**
   - Increase nf_conntrack_max on high-load routers
   - Monitor the conntrack count/max ratio
   - Tune timeouts to the load
   - Hashsize = conntrack_max / 8 (optimal)

5. **Performance Tuning**
   - Increase TCP buffers for WAN > 100 Mbps
   - Use BBR congestion control for low latency
   - Enable TCP window scaling, SACK, timestamps
   - Configure IRQ balancing on multi-core systems

6. **Security**
   - Disable ICMP redirects on the WAN
   - Block bogon sources at the edge
   - Enable SYN cookies for protection against SYN flood
   - Rate limit ICMP

7. **ARP/Neighbor Cache**
   - Increase thresholds for large networks (>1000 hosts)
   - Use static ARP for critical servers
   - Monitor ARP changes to detect spoofing

8. **Multipath Routing**
   - Use layer4-hashing to preserve packet ordering
   - Apply it to both IPv4 and IPv6
   - Required for ECMP and load balancing

9. **Monitoring**
   - Monitor conntrack usage
   - Track TCP retransmits
   - Check network drops
   - Log martians on edge routers

10. **Documentation**
    - Document all non-standard sysctl parameters
    - Store configuration files in /etc/sysctl.d/
    - Use descriptive file names
    - Test changes before production

## Conclusion

Proper configuration of the system IP and IPv6 parameters is critical to the performance, security, and stability of a VyOS router. Tuning the RP filter, multipath routing, connection tracking, TCP parameters, and other network stack options lets you optimize the router for specific network requirements - from an edge router with spoofing protection to a high-performance data center router.