Sysctl - Linux Kernel Parameters

This page describes how to configure Linux kernel parameters in VyOS through the sysctl interface. Kernel parameters let you change system behavior at a low level to optimize performance, security, and networking functionality.

Overview

What is sysctl

Sysctl is a mechanism for modifying Linux kernel parameters while the system is running (at runtime) without a reboot. In VyOS, sysctl is used for:

Optimizing network performance (TCP/UDP buffers, backlog, congestion control)
Hardening security (protection against spoofing, SYN flood, ICMP redirects)
Configuring IPv4/IPv6 (forwarding, routing, multicast)
Managing memory (swappiness, cache pressure, OOM behavior)
File system (maximum open files, inotify limits)
Kernel behavior (panic, core dumps, randomization)

Sysctl architecture in VyOS

VyOS Configuration
       |
       v
/opt/vyatta/etc/config/scripts/
       |
       v
/etc/sysctl.d/99-vyos.conf
       |
       v
/proc/sys/* (kernel runtime parameters)

Important:

Sysctl parameters in VyOS are stored in the configuration and applied at every boot
Changes take effect immediately after commit without a reboot
Do not edit /etc/sysctl.conf or /proc/sys/* manually - use the VyOS configuration
VyOS automatically generates /etc/sysctl.d/99-vyos.conf from its configuration

Structure of sysctl parameters

Sysctl parameters are organized in a hierarchical structure:

/proc/sys/
├── net/                    # Network parameters
│   ├── ipv4/              # IPv4 settings
│   ├── ipv6/              # IPv6 settings
│   ├── core/              # Common network parameters
│   └── netfilter/         # Netfilter/iptables
├── vm/                     # Virtual memory
├── fs/                     # File system
├── kernel/                 # System kernel
└── dev/                    # Devices

Basic configuration

Command syntax

set system sysctl parameter <parameter-name> value <value>

Parameter format:

Dotted notation: net.ipv4.ip_forward
Slash notation (in /proc/sys/): /proc/sys/net/ipv4/ip_forward
VyOS uses dotted notation only

Basic examples

Enabling IP forwarding for a router

# IPv4 forwarding (required for a router)
set system sysctl parameter net.ipv4.ip_forward value 1

# IPv6 forwarding
set system sysctl parameter net.ipv6.conf.all.forwarding value 1

commit
save

Disabling ICMP redirects (security)

# Refuse to accept ICMP redirects
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0

# Refuse to send ICMP redirects
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0

commit
save

Protection against IP spoofing (Reverse Path Filtering)

# Strict mode (recommended for most cases)
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1

commit
save

Increasing TCP buffer sizes

# Minimum, default, and maximum sizes (in bytes)
set system sysctl parameter net.ipv4.tcp_rmem value '4096 87380 16777216'
set system sysctl parameter net.ipv4.tcp_wmem value '4096 65536 16777216'

commit
save

Categories of sysctl parameters

1. IPv4 network parameters (net.ipv4.*)

IP Forwarding and Routing

# Enable IP forwarding (required for a router)
set system sysctl parameter net.ipv4.ip_forward value 1

# Allow non-local bind (for failover/VRRP)
set system sysctl parameter net.ipv4.ip_nonlocal_bind value 1

# Dynamic local port selection
set system sysctl parameter net.ipv4.ip_local_port_range value '1024 65535'

TCP Performance Tuning

TCP Window Scaling:

# Enable window scaling (RFC 1323)
set system sysctl parameter net.ipv4.tcp_window_scaling value 1

# TCP read buffer sizes
set system sysctl parameter net.ipv4.tcp_rmem value '4096 87380 16777216'

# TCP write buffer sizes
set system sysctl parameter net.ipv4.tcp_wmem value '4096 65536 16777216'

# Maximum buffer size (16 MB)
set system sysctl parameter net.core.rmem_max value 16777216
set system sysctl parameter net.core.wmem_max value 16777216

TCP Congestion Control:

# Congestion control algorithm (bbr, cubic, reno)
set system sysctl parameter net.ipv4.tcp_congestion_control value 'bbr'

# Available algorithms
set system sysctl parameter net.ipv4.tcp_allowed_congestion_control value 'bbr cubic reno'

TCP Keepalive:

# Time before keepalive probes start (seconds)
set system sysctl parameter net.ipv4.tcp_keepalive_time value 600

# Interval between keepalive probes
set system sysctl parameter net.ipv4.tcp_keepalive_intvl value 60

# Number of keepalive attempts
set system sysctl parameter net.ipv4.tcp_keepalive_probes value 3

TCP Timestamps:

# Enable TCP timestamps (RFC 1323)
set system sysctl parameter net.ipv4.tcp_timestamps value 1

TCP Fast Open:

# Enable TCP Fast Open (TFO)
# 1 = client, 2 = server, 3 = both
set system sysctl parameter net.ipv4.tcp_fastopen value 3

TCP Security Parameters

SYN Flood Protection:

# Enable SYN cookies (SYN flood protection)
set system sysctl parameter net.ipv4.tcp_syncookies value 1

# Maximum SYN backlog
set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 8192

# Number of SYN retries
set system sysctl parameter net.ipv4.tcp_syn_retries value 2
set system sysctl parameter net.ipv4.tcp_synack_retries value 2

TCP Reuse and Recycle:

# Allow reuse of TIME-WAIT sockets
set system sysctl parameter net.ipv4.tcp_tw_reuse value 1

# Lifetime of orphaned connections (seconds)
set system sysctl parameter net.ipv4.tcp_fin_timeout value 30

# Maximum orphan sockets
set system sysctl parameter net.ipv4.tcp_max_orphans value 65536

ICMP Parameters

# Ignore ICMP echo requests (ping)
set system sysctl parameter net.ipv4.icmp_echo_ignore_all value 0

# Ignore broadcast ping
set system sysctl parameter net.ipv4.icmp_echo_ignore_broadcasts value 1

# Rate-limit ICMP replies (flood protection)
set system sysctl parameter net.ipv4.icmp_ratelimit value 100

# Refuse ICMP redirects (security)
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0

# Refuse source routing
set system sysctl parameter net.ipv4.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv4.conf.default.accept_source_route value 0

Reverse Path Filtering (Anti-Spoofing)

# rp_filter modes:
# 0 = disabled
# 1 = strict mode (recommended for most cases)
# 2 = loose mode (for asymmetric routing)

# Strict mode (verifies the reverse route)
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1

# Loose mode (for complex topologies with asymmetric routing)
# set system sysctl parameter net.ipv4.conf.all.rp_filter value 2

ARP Parameters

# ARP entry lifetime (seconds)
set system sysctl parameter net.ipv4.neigh.default.gc_stale_time value 120

# ARP table - thresholds
set system sysctl parameter net.ipv4.neigh.default.gc_thresh1 value 128
set system sysctl parameter net.ipv4.neigh.default.gc_thresh2 value 512
set system sysctl parameter net.ipv4.neigh.default.gc_thresh3 value 1024

2. IPv6 network parameters (net.ipv6.*)

IPv6 Forwarding

# Enable IPv6 forwarding
set system sysctl parameter net.ipv6.conf.all.forwarding value 1
set system sysctl parameter net.ipv6.conf.default.forwarding value 1

IPv6 Security

# Refuse IPv6 router advertisements
set system sysctl parameter net.ipv6.conf.all.accept_ra value 0
set system sysctl parameter net.ipv6.conf.default.accept_ra value 0

# Refuse IPv6 redirects
set system sysctl parameter net.ipv6.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv6.conf.default.accept_redirects value 0

# Refuse source routing
set system sysctl parameter net.ipv6.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv6.conf.default.accept_source_route value 0

IPv6 Autoconfiguration

# Disable IPv6 autoconf (for static configuration)
set system sysctl parameter net.ipv6.conf.all.autoconf value 0
set system sysctl parameter net.ipv6.conf.default.autoconf value 0

Fully disabling IPv6 (if not used)

set system sysctl parameter net.ipv6.conf.all.disable_ipv6 value 1
set system sysctl parameter net.ipv6.conf.default.disable_ipv6 value 1
set system sysctl parameter net.ipv6.conf.lo.disable_ipv6 value 1

3. Core Network Parameters (net.core.*)

Network Buffers

# Maximum receive buffer size
set system sysctl parameter net.core.rmem_max value 16777216

# Maximum send buffer size
set system sysctl parameter net.core.wmem_max value 16777216

# Default receive buffer
set system sysctl parameter net.core.rmem_default value 262144

# Default send buffer
set system sysctl parameter net.core.wmem_default value 262144

# Buffer size for memory optimization
set system sysctl parameter net.core.optmem_max value 25165824

Network Device Queue

# Maximum length of the packet processing queue
set system sysctl parameter net.core.netdev_max_backlog value 5000

# Packet processing budget per poll
set system sysctl parameter net.core.netdev_budget value 600

Somaxconn

# Maximum backlog for the listen() system call
# Important for high-load web servers
set system sysctl parameter net.core.somaxconn value 4096

4. Virtual Memory (vm.*)

Swappiness

# Aggressiveness of swap usage (0-100)
# 0 = minimum swap, 100 = actively use swap
# Recommended: 10 for servers, 60 for desktop
set system sysctl parameter vm.swappiness value 10

Cache Pressure

# Pressure to reclaim cache (0-100)
# Lower value = more cache is retained
set system sysctl parameter vm.vfs_cache_pressure value 50

Dirty Memory

# Percentage of memory for dirty pages before writeback begins
set system sysctl parameter vm.dirty_ratio value 10

# Percentage of memory for background writeback
set system sysctl parameter vm.dirty_background_ratio value 5

# Lifetime of dirty data (centiseconds = 1/100 second)
set system sysctl parameter vm.dirty_expire_centisecs value 3000

# pdflush wakeup interval for writeback (centiseconds)
set system sysctl parameter vm.dirty_writeback_centisecs value 500

OOM (Out of Memory) Killer

# OOM killer behavior
# 0 = kernel tries to avoid killing
# 1 = kernel kills process more aggressively
# 2 = kernel panics on OOM
set system sysctl parameter vm.panic_on_oom value 0

# OOM score re-evaluation
set system sysctl parameter vm.oom_kill_allocating_task value 0

5. File System (fs.*)

File Descriptors

# Maximum number of open files (system-wide)
set system sysctl parameter fs.file-max value 2097152

# Maximum inotify watches (for file monitoring)
set system sysctl parameter fs.inotify.max_user_watches value 524288

AIO (Asynchronous I/O)

# Maximum asynchronous IO requests
set system sysctl parameter fs.aio-max-nr value 1048576

6. Kernel Parameters (kernel.*)

Kernel Panic

# Automatic reboot after panic (seconds)
# 0 = do not reboot
set system sysctl parameter kernel.panic value 10

# Panic on kernel oops
set system sysctl parameter kernel.panic_on_oops value 1

Core Dumps

# Core dump file name template
set system sysctl parameter kernel.core_pattern value '/tmp/core-%e-%p-%t'

PID Max

# Maximum PID (Process ID)
set system sysctl parameter kernel.pid_max value 65536

SysRq

# Enable SysRq magic keys (for emergency control)
# 1 = enabled, 0 = disabled
set system sysctl parameter kernel.sysrq value 1

Address Space Layout Randomization (ASLR)

# ASLR for protection against exploits
# 0 = disabled
# 1 = random stack/vdso/heap
# 2 = full randomization (recommended)
set system sysctl parameter kernel.randomize_va_space value 2

Configuration examples for common scenarios

Scenario 1: Basic security (Security Hardening)

Configuring security parameters to protect against common attacks.

configure

# === IPv4 Security ===

# Enable IP forwarding for a router
set system sysctl parameter net.ipv4.ip_forward value 1

# Protection against IP spoofing (Reverse Path Filtering)
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1

# Refuse source routing
set system sysctl parameter net.ipv4.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv4.conf.default.accept_source_route value 0

# Refuse ICMP redirects
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0
set system sysctl parameter net.ipv4.conf.all.secure_redirects value 0
set system sysctl parameter net.ipv4.conf.default.secure_redirects value 0

# Ignore broadcast ping
set system sysctl parameter net.ipv4.icmp_echo_ignore_broadcasts value 1

# Ignore bogus ICMP error responses
set system sysctl parameter net.ipv4.icmp_ignore_bogus_error_responses value 1

# SYN flood protection
set system sysctl parameter net.ipv4.tcp_syncookies value 1
set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 8192

# Log martian packets (impossible addresses)
set system sysctl parameter net.ipv4.conf.all.log_martians value 1
set system sysctl parameter net.ipv4.conf.default.log_martians value 1

# === IPv6 Security ===

# Refuse IPv6 router advertisements
set system sysctl parameter net.ipv6.conf.all.accept_ra value 0
set system sysctl parameter net.ipv6.conf.default.accept_ra value 0

# Refuse IPv6 redirects
set system sysctl parameter net.ipv6.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv6.conf.default.accept_redirects value 0

# Refuse IPv6 source routing
set system sysctl parameter net.ipv6.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv6.conf.default.accept_source_route value 0

# === Kernel Security ===

# Address Space Layout Randomization
set system sysctl parameter kernel.randomize_va_space value 2

# Restrict access to kernel logs
set system sysctl parameter kernel.dmesg_restrict value 1

# Restrict access to kernel pointers
set system sysctl parameter kernel.kptr_restrict value 2

commit
save
exit

Scenario 2: High-Performance TCP Tuning

Optimization for high-performance network applications (1 Gbps+ links).

configure

# === TCP Buffer Sizes ===

# Enlarged TCP buffers for high-speed links
# Format: min default max (in bytes)

# TCP receive buffer (4KB, 128KB, 64MB)
set system sysctl parameter net.ipv4.tcp_rmem value '4096 131072 67108864'

# TCP write buffer (4KB, 128KB, 64MB)
set system sysctl parameter net.ipv4.tcp_wmem value '4096 131072 67108864'

# Maximum socket buffer sizes
set system sysctl parameter net.core.rmem_max value 67108864
set system sysctl parameter net.core.wmem_max value 67108864
set system sysctl parameter net.core.rmem_default value 262144
set system sysctl parameter net.core.wmem_default value 262144

# === TCP Performance ===

# TCP window scaling (RFC 1323)
set system sysctl parameter net.ipv4.tcp_window_scaling value 1

# TCP timestamps (RFC 1323)
set system sysctl parameter net.ipv4.tcp_timestamps value 1

# SACK (Selective Acknowledgement)
set system sysctl parameter net.ipv4.tcp_sack value 1

# TCP Fast Open
set system sysctl parameter net.ipv4.tcp_fastopen value 3

# BBR congestion control (best for high-speed links)
set system sysctl parameter net.ipv4.tcp_congestion_control value 'bbr'
set system sysctl parameter net.core.default_qdisc value 'fq'

# === Connection Handling ===

# Reuse of TIME-WAIT sockets
set system sysctl parameter net.ipv4.tcp_tw_reuse value 1

# Reduce FIN timeout
set system sysctl parameter net.ipv4.tcp_fin_timeout value 15

# Increase maximum orphan sockets
set system sysctl parameter net.ipv4.tcp_max_orphans value 131072

# === Network Queue ===

# Increase backlog for packet processing
set system sysctl parameter net.core.netdev_max_backlog value 10000

# Increase listen backlog
set system sysctl parameter net.core.somaxconn value 8192

# === TCP SYN Queue ===

set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 16384

# === Local Port Range ===

set system sysctl parameter net.ipv4.ip_local_port_range value '10000 65535'

commit
save
exit

Scenario 3: Memory optimization for a router

Tuning virtual memory parameters for a network device.

configure

# === Swappiness ===

# Minimize swap usage
set system sysctl parameter vm.swappiness value 10

# === Cache Pressure ===

# Keep more cache in memory
set system sysctl parameter vm.vfs_cache_pressure value 50

# === Dirty Memory ===

# Tune dirty page writeback
set system sysctl parameter vm.dirty_ratio value 10
set system sysctl parameter vm.dirty_background_ratio value 5
set system sysctl parameter vm.dirty_expire_centisecs value 3000
set system sysctl parameter vm.dirty_writeback_centisecs value 500

# === OOM Killer ===

# Do not panic on OOM
set system sysctl parameter vm.panic_on_oom value 0

# Minimum free memory (KB)
set system sysctl parameter vm.min_free_kbytes value 65536

commit
save
exit

Scenario 4: Increasing file descriptor limits

For routers with a large number of concurrent connections (BGP, VPN, NAT).

configure

# === File Descriptors ===

# Maximum open files (system-wide)
set system sysctl parameter fs.file-max value 2097152

# === Network Connection Tracking ===

# Increase conntrack max (if NAT/Firewall is used)
# Note: this is a netfilter module, requires the nf_conntrack module
set system sysctl parameter net.netfilter.nf_conntrack_max value 524288

# === Inotify ===

# Increase inotify limits (for file monitoring)
set system sysctl parameter fs.inotify.max_user_watches value 524288
set system sysctl parameter fs.inotify.max_user_instances value 512

commit
save
exit

Examples for cloud platforms

Example 1: Yandex Cloud - High-Performance TCP for Cloud Workloads

Optimizing VyOS in Yandex Cloud for high-performance traffic processing between VMs.

configure

# === Description ===
# Configuration for VyOS in Yandex Cloud
# Optimization for high-speed internal connections (up to 10 Gbps)
# Improved latency and throughput for cloud workloads

# === Basic Forwarding ===

set system sysctl parameter net.ipv4.ip_forward value 1
set system sysctl parameter net.ipv6.conf.all.forwarding value 1

# === TCP Performance for Cloud ===

# Enlarged buffers for high throughput
set system sysctl parameter net.ipv4.tcp_rmem value '4096 131072 67108864'
set system sysctl parameter net.ipv4.tcp_wmem value '4096 131072 67108864'
set system sysctl parameter net.core.rmem_max value 67108864
set system sysctl parameter net.core.wmem_max value 67108864

# BBR congestion control (optimal for cloud networks)
set system sysctl parameter net.ipv4.tcp_congestion_control value 'bbr'
set system sysctl parameter net.core.default_qdisc value 'fq'

# TCP Fast Open to reduce latency
set system sysctl parameter net.ipv4.tcp_fastopen value 3

# TCP window optimization
set system sysctl parameter net.ipv4.tcp_window_scaling value 1
set system sysctl parameter net.ipv4.tcp_timestamps value 1
set system sysctl parameter net.ipv4.tcp_sack value 1

# === Connection Management ===

# Fast socket reuse
set system sysctl parameter net.ipv4.tcp_tw_reuse value 1
set system sysctl parameter net.ipv4.tcp_fin_timeout value 15

# Increased connection limits
set system sysctl parameter net.ipv4.tcp_max_orphans value 131072
set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 16384

# === Network Queue for Cloud NIC ===

# Increase backlog (important for burst traffic in the cloud)
set system sysctl parameter net.core.netdev_max_backlog value 10000
set system sysctl parameter net.core.somaxconn value 8192

# === Security for Yandex Cloud ===

# Reverse Path Filtering (strict mode)
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1

# SYN flood protection
set system sysctl parameter net.ipv4.tcp_syncookies value 1

# Refuse ICMP redirects
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0

# === Memory for Cloud VM ===

# Minimize swap (cloud VMs usually have enough RAM)
set system sysctl parameter vm.swappiness value 10

# Dirty page optimization
set system sysctl parameter vm.dirty_ratio value 10
set system sysctl parameter vm.dirty_background_ratio value 5

# === File Descriptors for Cloud Services ===

set system sysctl parameter fs.file-max value 2097152

commit
save
exit

Verifying that parameters are applied in Yandex Cloud:

# Check BBR congestion control
sysctl net.ipv4.tcp_congestion_control
sysctl net.ipv4.tcp_available_congestion_control

# Check buffers
sysctl net.ipv4.tcp_rmem
sysctl net.ipv4.tcp_wmem

# Monitor TCP statistics
netstat -s | grep -i tcp

# Check queue length
ip -s link show eth0

Example 2: VK Cloud - Security Hardening for a DMZ router

Enhanced security for VyOS in VK Cloud operating as an edge router in a DMZ.

configure

# === Description ===
# VyOS Edge Router in VK Cloud DMZ
# Maximum security to protect against external threats
# Optimization for handling mixed trusted/untrusted traffic

# === Basic Routing ===

set system sysctl parameter net.ipv4.ip_forward value 1

# === Strict Security - IP Spoofing Protection ===

# Reverse Path Filtering - strict mode
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1

# Refuse source routing (protection against routing attacks)
set system sysctl parameter net.ipv4.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv4.conf.default.accept_source_route value 0

# === ICMP Security ===

# Refuse ICMP redirects
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0
set system sysctl parameter net.ipv4.conf.all.secure_redirects value 0
set system sysctl parameter net.ipv4.conf.default.secure_redirects value 0

# Ignore broadcast ping (smurf attack protection)
set system sysctl parameter net.ipv4.icmp_echo_ignore_broadcasts value 1

# Ignore bogus ICMP responses
set system sysctl parameter net.ipv4.icmp_ignore_bogus_error_responses value 1

# Rate limit ICMP responses
set system sysctl parameter net.ipv4.icmp_ratelimit value 100

# === SYN Flood Protection ===

# Enable SYN cookies
set system sysctl parameter net.ipv4.tcp_syncookies value 1

# Increase SYN backlog
set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 8192

# Reduce SYN retries (drop attacks faster)
set system sysctl parameter net.ipv4.tcp_syn_retries value 2
set system sysctl parameter net.ipv4.tcp_synack_retries value 2

# === Connection Limits for DMZ ===

# Limit orphan sockets
set system sysctl parameter net.ipv4.tcp_max_orphans value 65536

# Fast connection close
set system sysctl parameter net.ipv4.tcp_fin_timeout value 20

# === Logging and Monitoring ===

# Log martian packets (suspicious addresses)
set system sysctl parameter net.ipv4.conf.all.log_martians value 1
set system sysctl parameter net.ipv4.conf.default.log_martians value 1

# === IPv6 Security (if used) ===

# Refuse IPv6 router advertisements
set system sysctl parameter net.ipv6.conf.all.accept_ra value 0
set system sysctl parameter net.ipv6.conf.default.accept_ra value 0

# Refuse IPv6 redirects
set system sysctl parameter net.ipv6.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv6.conf.default.accept_redirects value 0

# If IPv6 is not used - disable it completely
# set system sysctl parameter net.ipv6.conf.all.disable_ipv6 value 1
# set system sysctl parameter net.ipv6.conf.default.disable_ipv6 value 1

# === Kernel Security ===

# Address Space Layout Randomization (full)
set system sysctl parameter kernel.randomize_va_space value 2

# Restrict access to kernel logs (for unauthorized users)
set system sysctl parameter kernel.dmesg_restrict value 1

# Hide kernel pointers
set system sysctl parameter kernel.kptr_restrict value 2

# Panic and reboot on critical errors
set system sysctl parameter kernel.panic value 10
set system sysctl parameter kernel.panic_on_oops value 1

# === Network Performance (balanced with security) ===

# Moderate buffers
set system sysctl parameter net.ipv4.tcp_rmem value '4096 87380 16777216'
set system sysctl parameter net.ipv4.tcp_wmem value '4096 65536 16777216'
set system sysctl parameter net.core.rmem_max value 16777216
set system sysctl parameter net.core.wmem_max value 16777216

# Backlog for processing
set system sysctl parameter net.core.netdev_max_backlog value 5000
set system sysctl parameter net.core.somaxconn value 4096

# === Connection Tracking for Firewall/NAT ===

# Increase conntrack table for NAT
set system sysctl parameter net.netfilter.nf_conntrack_max value 524288

# Timeout for conntrack (more aggressive for DMZ)
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_established value 3600

commit
save
exit

Verifying security in VK Cloud:

# Check rp_filter (should be 1)
sysctl net.ipv4.conf.all.rp_filter

# Check SYN cookies
sysctl net.ipv4.tcp_syncookies

# Check ICMP redirects (should be 0)
sysctl net.ipv4.conf.all.accept_redirects
sysctl net.ipv4.conf.all.send_redirects

# Check martian packet logging
sysctl net.ipv4.conf.all.log_martians

# Monitor SYN flood attacks
netstat -s | grep -i syn

# Monitor conntrack usage
conntrack -C
cat /proc/sys/net/netfilter/nf_conntrack_count
cat /proc/sys/net/netfilter/nf_conntrack_max

Example 3: Multi-Cloud VPN Gateway (Yandex + VK Cloud)

Configuration for VyOS operating as a VPN gateway between Yandex Cloud and VK Cloud.

configure

# === Description ===
# Multi-cloud VPN Gateway
# Optimization for VPN tunnels (IPsec/WireGuard)
# Balancing performance and security

# === Forwarding ===

set system sysctl parameter net.ipv4.ip_forward value 1
set system sysctl parameter net.ipv6.conf.all.forwarding value 1

# === VPN Specific - PMTU Discovery ===

# Enable PMTU discovery (important for VPN)
set system sysctl parameter net.ipv4.ip_no_pmtu_disc value 0

# === TCP Optimizations for VPN ===

# TCP MTU probing (automatic MTU detection)
set system sysctl parameter net.ipv4.tcp_mtu_probing value 1

# TCP buffers (moderate for VPN overhead)
set system sysctl parameter net.ipv4.tcp_rmem value '4096 87380 33554432'
set system sysctl parameter net.ipv4.tcp_wmem value '4096 65536 33554432'
set system sysctl parameter net.core.rmem_max value 33554432
set system sysctl parameter net.core.wmem_max value 33554432

# === Congestion Control for VPN ===

# BBR for better operation through tunnels
set system sysctl parameter net.ipv4.tcp_congestion_control value 'bbr'
set system sysctl parameter net.core.default_qdisc value 'fq'

# === Security (Moderate for VPN) ===

# Loose rp_filter for VPN tunnels (asymmetric routing)
set system sysctl parameter net.ipv4.conf.all.rp_filter value 2
set system sysctl parameter net.ipv4.conf.default.rp_filter value 2

# SYN flood protection
set system sysctl parameter net.ipv4.tcp_syncookies value 1
set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 8192

# Refuse ICMP redirects
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0

# === IPsec Specific ===

# Disable ICMP redirects on VPN interfaces
# (applied to specific interfaces via configuration)

# === Performance for IPsec ===

# Increase backlog for processing encrypted traffic
set system sysctl parameter net.core.netdev_max_backlog value 10000
set system sysctl parameter net.core.somaxconn value 8192

# === Memory Optimization ===

set system sysctl parameter vm.swappiness value 10
set system sysctl parameter vm.vfs_cache_pressure value 50

# === Connection Limits ===

set system sysctl parameter net.ipv4.tcp_max_orphans value 131072
set system sysctl parameter fs.file-max value 2097152

commit
save
exit

Verification and monitoring commands

Viewing current sysctl values

# Show all sysctl parameters
sysctl -a

# Show a specific parameter
sysctl net.ipv4.ip_forward

# Show all parameters in a category
sysctl -a | grep net.ipv4
sysctl -a | grep vm

# Read directly from /proc/sys
cat /proc/sys/net/ipv4/ip_forward

Viewing the VyOS sysctl configuration

# Show all configured sysctl parameters in VyOS
show configuration system sysctl

# Show in set commands format
show configuration commands | match sysctl

# Show a specific parameter
show configuration system sysctl parameter net.ipv4.ip_forward

Applying parameters manually (temporarily)

# Apply a parameter without changing the configuration (until reboot)
sudo sysctl -w net.ipv4.ip_forward=1

# Apply from a file
sudo sysctl -p /etc/sysctl.d/99-vyos.conf

# Load all sysctl configurations
sudo sysctl --system

Monitoring network performance

# TCP statistics
netstat -s | grep -i tcp

# Show retransmits
ss -ti

# Show the congestion control algorithm in use
ss -ti | grep -i cubic
ss -ti | grep -i bbr

# Check buffer sizes for active connections
ss -m

# Monitor backlog
ss -l | grep -i listen

Checking buffers and queues

# Current buffer sizes
sysctl net.core.rmem_max
sysctl net.core.wmem_max
sysctl net.ipv4.tcp_rmem
sysctl net.ipv4.tcp_wmem

# Network queue statistics
ip -s link show eth0

# Backlog statistics
cat /proc/net/netstat | grep -i tcpext

# Conntrack statistics (if used)
conntrack -C
cat /proc/sys/net/netfilter/nf_conntrack_count
cat /proc/sys/net/netfilter/nf_conntrack_max

Monitoring memory

# Memory usage
free -h

# Current swappiness value
sysctl vm.swappiness

# Swap statistics
vmstat 1 5

# Dirty pages statistics
cat /proc/meminfo | grep -i dirty
sysctl vm.dirty_ratio
sysctl vm.dirty_background_ratio

# OOM killer logs
dmesg | grep -i oom
journalctl -k | grep -i oom

Checking file descriptors

# Current file descriptor usage (system-wide)
cat /proc/sys/fs/file-nr

# Maximum file descriptors
sysctl fs.file-max

# File descriptors per process
lsof | wc -l

# Top processes by open files
lsof | awk '{print $1}' | sort | uniq -c | sort -rn | head -10

Troubleshooting

Problem 1: A sysctl parameter is not applied after commit

Symptoms:

The show configuration system sysctl command shows the parameter
sysctl <parameter> shows the old value
The parameter is not applied in /proc/sys/

Diagnostics:

# Check the VyOS configuration
show configuration system sysctl parameter net.ipv4.ip_forward

# Check the current value
sysctl net.ipv4.ip_forward

# Check the generated file
cat /etc/sysctl.d/99-vyos.conf | grep ip_forward

# Check the logs
journalctl -xe | grep sysctl

Possible causes:

Incorrect parameter name

# Wrong (underscores instead of dots)
set system sysctl parameter net_ipv4_ip_forward value 1

# Correct
set system sysctl parameter net.ipv4.ip_forward value 1

The parameter does not exist in the current kernel

# Check parameter availability
ls -la /proc/sys/net/ipv4/ | grep ip_forward

The kernel module is not loaded

# Some parameters require modules
# For example, nf_conntrack for conntrack parameters
lsmod | grep nf_conntrack

# Load the module if needed
sudo modprobe nf_conntrack

Solution:

# 1. Fix the configuration
configure
delete system sysctl parameter <incorrect-parameter>
set system sysctl parameter <correct-parameter> value <value>
commit
save
exit

# 2. Apply manually for immediate effect
sudo sysctl -w net.ipv4.ip_forward=1

# 3. Reboot (if the parameter is critical)
sudo reboot

Problem 2: Network performance did not improve after changing buffers

Symptoms:

TCP buffers are increased in sysctl
Throughput remains low
Latency does not improve

Diagnostics:

# Check applied parameters
sysctl net.ipv4.tcp_rmem
sysctl net.ipv4.tcp_wmem
sysctl net.core.rmem_max
sysctl net.core.wmem_max

# Check autotuning
sysctl net.ipv4.tcp_moderate_rcvbuf

# Monitor active connections
ss -ti | head -20

# Check congestion control
sysctl net.ipv4.tcp_congestion_control

# Retransmit statistics
netstat -s | grep -i retrans

# Check NIC ring buffers
ethtool -g eth0

Possible causes:

net.core.rmem_max / wmem_max is smaller than the tcp_rmem / tcp_wmem maximums

# Problem: tcp_rmem max = 67108864, but rmem_max = 212992
sysctl net.ipv4.tcp_rmem  # 4096 87380 67108864
sysctl net.core.rmem_max  # 212992

# Solution: increase the core limits
configure
set system sysctl parameter net.core.rmem_max value 67108864
set system sysctl parameter net.core.wmem_max value 67108864
commit
save

Congestion control is not optimized

# BBR may not be available
sysctl net.ipv4.tcp_available_congestion_control

# If BBR is not in the list, use cubic
configure
set system sysctl parameter net.ipv4.tcp_congestion_control value 'cubic'
commit
save

QDisc is not optimized for BBR

# BBR requires the fq qdisc
sysctl net.core.default_qdisc

configure
set system sysctl parameter net.core.default_qdisc value 'fq'
commit
save

NIC offloading is disabled

# Check offloading
ethtool -k eth0 | grep offload

# Enable it if disabled
sudo ethtool -K eth0 tso on
sudo ethtool -K eth0 gso on
sudo ethtool -K eth0 gro on

Problem 3: The system does not boot after changing kernel parameters

Symptoms:

VyOS does not boot or kernel panic
The system hangs during boot
Unable to log in

Solution via GRUB rescue:

Boot into single user mode:

# During boot, press 'e' in the GRUB menu
# Add to the linux line:
linux ... single init=/bin/bash

# Boot

Roll back the changes:

# Remount the filesystem read-write
mount -o remount,rw /

# Remove the problematic parameter from the configuration
# Edit /config/config.boot
vi /config/config.boot

# Find and remove the line with the problematic sysctl parameter

# Or remove the entire sysctl config
rm -f /etc/sysctl.d/99-vyos.conf

# Reboot
reboot

Alternative: boot from the previous configuration:

# During VyOS boot, select the previous commit from the boot menu
# VyOS will automatically roll back to the previous working configuration

Prevention:

# Always test critical changes before save
configure
set system sysctl parameter <parameter> value <value>
commit

# DO NOT run save immediately!
# Test operability

# If everything works - save
save

# If there are problems - roll back
rollback

Problem 4: The conntrack table overflows (NAT/Firewall)

Symptoms:

Message “nf_conntrack: table full, dropping packet”
New connections are not established
Intermittent connectivity issues

Diagnostics:

# Check current conntrack usage
conntrack -C

# Check the maximum
cat /proc/sys/net/netfilter/nf_conntrack_max

# Check kernel logs
dmesg | grep -i conntrack
journalctl -k | grep -i conntrack

# Conntrack statistics
cat /proc/net/nf_conntrack | wc -l

Solution:

configure

# Increase nf_conntrack_max
set system sysctl parameter net.netfilter.nf_conntrack_max value 524288

# Increase hashsize (requires reloading the module)
# hashsize is usually = nf_conntrack_max / 4

# Reduce the timeout for established connections (more aggressive)
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_established value 3600

# Reduce the timeout for TIME_WAIT
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_time_wait value 30

commit
save
exit

# For immediate effect
sudo sysctl -w net.netfilter.nf_conntrack_max=524288

Increasing hashsize (requires a reboot):

# Add a module parameter
sudo vi /etc/modprobe.d/nf_conntrack.conf

# Add:
options nf_conntrack hashsize=131072

# Reload the module (caution! This resets all existing connections)
sudo rmmod nf_conntrack
sudo modprobe nf_conntrack

# Or reboot the system
sudo reboot

Problem 5: The OOM Killer kills processes

Symptoms:

The system kills processes when memory runs out
Log messages “Out of memory: Kill process”
Unpredictable system behavior

Diagnostics:

# Check OOM killer logs
dmesg | grep -i oom
journalctl -k | grep -i oom

# Check memory usage
free -h

# Check swap
swapon --show

# Check OOM parameters
sysctl vm.panic_on_oom
sysctl vm.oom_kill_allocating_task

# Processes with a high OOM score
cat /proc/*/oom_score | sort -n | tail -10

Solution:

configure

# Do not panic on OOM (allow a process to be killed)
set system sysctl parameter vm.panic_on_oom value 0

# Increase swappiness if swap is needed
set system sysctl parameter vm.swappiness value 30

# Increase min_free_kbytes (reserve more memory)
set system sysctl parameter vm.min_free_kbytes value 131072

commit
save
exit

Adding swap (if RAM is insufficient):

# Create a swap file (1GB)
sudo dd if=/dev/zero of=/swap bs=1M count=1024
sudo chmod 600 /swap
sudo mkswap /swap
sudo swapon /swap

# Make it persistent
sudo vi /etc/fstab
# Add:
/swap none swap sw 0 0

Best Practices

1. Testing changes

Always test before saving:

configure

# Make changes
set system sysctl parameter <parameter> value <value>

# Apply
commit

# TEST THE SYSTEM!
# Check:
# - Network operability
# - Service availability
# - Performance
# - Logs for errors

# If everything works - save
save

# If there are problems - roll back
rollback

2. Documenting changes

Use commit comments:

configure
set system sysctl parameter net.ipv4.tcp_rmem value '4096 131072 67108864'
commit comment "Increased TCP receive buffers for high-speed 10G link - Ticket #12345"
save

Keep a changelog:

# View change history
show system commit
show system commit diff 5

3. Gradual rollout

Do not change all parameters at once:

# Bad: 50 parameters at once
# Impossible to identify the cause of a problem

# Good: phased rollout
# Step 1: Security (rp_filter, syn_cookies)
# Test
# Step 2: TCP buffers
# Test
# Step 3: Congestion control
# Test

4. Baseline measurements

Measure BEFORE and AFTER:

# Baseline before changes
iperf3 -c server -t 60 > before.txt
netstat -s > netstat-before.txt

# Make sysctl changes

# Test after changes
iperf3 -c server -t 60 > after.txt
netstat -s > netstat-after.txt

# Compare the results
diff netstat-before.txt netstat-after.txt

5. Backing up the configuration

Back up before critical changes:

# Save the current configuration
save /config/backup-before-sysctl-$(date +%Y%m%d).config

# View available backups
ls -lh /config/backup-*

# Restore from a backup (if needed)
load /config/backup-before-sysctl-20250115.config
commit
save

6. Scenario-specific parameters

Do not use a universal config for all scenarios:

Scenario	Priorities	Key parameters
Edge Router (DMZ)	Security	rp_filter=1, syn_cookies=1, log_martians=1
Core Router	Performance	tcp_rmem/wmem (large), bbr, netdev_max_backlog
VPN Gateway	Tunneling	tcp_mtu_probing=1, rp_filter=2, ip_no_pmtu_disc=0
NAT Gateway	Conntrack	nf_conntrack_max (large), tcp_tw_reuse=1
Lab/Testing	Monitoring	log_martians=1, tcp_timestamps=1

7. Monitoring after rollout

Set up monitoring of key metrics:

# Sysctl parameter monitoring script
#!/bin/bash
# /config/scripts/monitor-sysctl.sh

echo "=== Critical sysctl parameters ==="
echo "IP Forwarding: $(sysctl -n net.ipv4.ip_forward)"
echo "SYN Cookies: $(sysctl -n net.ipv4.tcp_syncookies)"
echo "RP Filter: $(sysctl -n net.ipv4.conf.all.rp_filter)"
echo "Conntrack Max: $(sysctl -n net.netfilter.nf_conntrack_max)"
echo "Conntrack Current: $(conntrack -C)"
echo "TCP Retransmits: $(netstat -s | grep -i retrans)"

8. Caution with dangerous parameters

Parameters that can break the system:

# DANGEROUS: Disabling IP forwarding on a router
# set system sysctl parameter net.ipv4.ip_forward value 0

# DANGEROUS: Disabling all ICMP (can break PMTU discovery)
# set system sysctl parameter net.ipv4.icmp_echo_ignore_all value 1

# DANGEROUS: kernel.panic = 0 (the system hangs on panic instead of rebooting)
# set system sysctl parameter kernel.panic value 0

# DANGEROUS: vm.swappiness = 100 (constant swap, performance degradation)
# set system sysctl parameter vm.swappiness value 100

9. Compliance with security requirements

Security standards (CIS, NIST):

# Minimum set for compliance
configure

# CIS Benchmark - Network Parameters
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv4.conf.default.accept_source_route value 0
set system sysctl parameter net.ipv4.icmp_echo_ignore_broadcasts value 1
set system sysctl parameter net.ipv4.icmp_ignore_bogus_error_responses value 1
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1
set system sysctl parameter net.ipv4.tcp_syncookies value 1
set system sysctl parameter net.ipv4.conf.all.log_martians value 1

# Kernel hardening
set system sysctl parameter kernel.randomize_va_space value 2
set system sysctl parameter kernel.dmesg_restrict value 1
set system sysctl parameter kernel.kptr_restrict value 2

commit
save

10. Versioning and compatibility

Account for the kernel version:

# Check the kernel version
uname -r

# Some parameters are available only in newer versions
# For example, tcp_bbr appeared in Linux 4.9+

# Check parameter availability
ls /proc/sys/net/ipv4/tcp_congestion_control

# Check available congestion control algorithms
sysctl net.ipv4.tcp_available_congestion_control

Useful resources and documentation

Official documentation

TCP/IP Tuning Guides

Security Hardening

Cloud-specific

Conclusion

Proper tuning of kernel parameters through sysctl is a critically important part of optimizing VyOS for specific use cases. Key takeaways:

Key principles:

Understand the parameters: Do not change parameters without understanding their impact
Testing: Always test changes before saving to production
Monitoring: Track the effect of changes through metrics
Documentation: Record the reasons for and results of changes
Incrementality: Make changes in stages, not all at once

Priorities by scenario:

Edge Router (DMZ):

Security above all (rp_filter, syn_cookies, no redirects)
Moderate performance
Logging of suspicious activity

High-Performance Core Router:

Maximum throughput (large buffers, BBR, optimized queues)
Moderate security
Minimal latency

VPN Gateway:

PMTU discovery for tunnels
Loose rp_filter for asymmetric routing
Optimized congestion control for encrypted traffic

NAT Gateway:

Maximum conntrack entries
Fast connection reuse
Large file descriptor limits

Recommendations for cloud platforms:

Yandex Cloud:

Use BBR for optimal performance
Account for the burst nature of cloud networking
Configure large buffers for high-speed links

VK Cloud:

Prioritize security hardening for DMZ routers
Optimize conntrack for NAT workloads
Balance performance and security

Follow best practices, test changes, and adapt the configuration to your specific requirements to achieve optimal performance and security for VyOS in your infrastructure.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

sFlow Updates - Upgrading the VyOS System