# Sysctl - Linux Kernel Parameters

> Tune Linux kernel parameters via sysctl in VyOS - optimize performance, networking, and security for cloud environments and high-load routers

Source: https://opennix.org/en/docs/vyos/system/vyos-sysctl/


## Sysctl - Linux Kernel Parameters

This page describes how to configure Linux kernel parameters in VyOS through the sysctl interface. Kernel parameters let you change system behavior at a low level to optimize performance, security, and networking functionality.

## Overview

### What is sysctl

Sysctl is a mechanism for modifying Linux kernel parameters while the system is running (at runtime) without a reboot. In VyOS, sysctl is used for:

- **Optimizing network performance** (TCP/UDP buffers, backlog, congestion control)
- **Hardening security** (protection against spoofing, SYN flood, ICMP redirects)
- **Configuring IPv4/IPv6** (forwarding, routing, multicast)
- **Managing memory** (swappiness, cache pressure, OOM behavior)
- **File system** (maximum open files, inotify limits)
- **Kernel behavior** (panic, core dumps, randomization)

### Sysctl architecture in VyOS

```
VyOS Configuration
       |
       v
/opt/vyatta/etc/config/scripts/
       |
       v
/etc/sysctl.d/99-vyos.conf
       |
       v
/proc/sys/* (kernel runtime parameters)
```

**Important:**
- Sysctl parameters in VyOS are stored in the configuration and applied at every boot
- Changes take effect immediately after commit without a reboot
- Do not edit `/etc/sysctl.conf` or `/proc/sys/*` manually - use the VyOS configuration
- VyOS automatically generates `/etc/sysctl.d/99-vyos.conf` from its configuration

### Structure of sysctl parameters

Sysctl parameters are organized in a hierarchical structure:

```
/proc/sys/
├── net/                    # Network parameters
│   ├── ipv4/              # IPv4 settings
│   ├── ipv6/              # IPv6 settings
│   ├── core/              # Common network parameters
│   └── netfilter/         # Netfilter/iptables
├── vm/                     # Virtual memory
├── fs/                     # File system
├── kernel/                 # System kernel
└── dev/                    # Devices
```

## Basic configuration

### Command syntax

```bash
set system sysctl parameter <parameter-name> value <value>
```

**Parameter format:**
- Dotted notation: `net.ipv4.ip_forward`
- Slash notation (in `/proc/sys/`): `/proc/sys/net/ipv4/ip_forward`
- VyOS uses dotted notation only

### Basic examples

#### Enabling IP forwarding for a router

```bash
# IPv4 forwarding (required for a router)
set system sysctl parameter net.ipv4.ip_forward value 1

# IPv6 forwarding
set system sysctl parameter net.ipv6.conf.all.forwarding value 1

commit
save
```

#### Disabling ICMP redirects (security)

```bash
# Refuse to accept ICMP redirects
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0

# Refuse to send ICMP redirects
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0

commit
save
```

#### Protection against IP spoofing (Reverse Path Filtering)

```bash
# Strict mode (recommended for most cases)
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1

commit
save
```

#### Increasing TCP buffer sizes

```bash
# Minimum, default, and maximum sizes (in bytes)
set system sysctl parameter net.ipv4.tcp_rmem value '4096 87380 16777216'
set system sysctl parameter net.ipv4.tcp_wmem value '4096 65536 16777216'

commit
save
```

## Categories of sysctl parameters

### 1. IPv4 network parameters (net.ipv4.*)

#### IP Forwarding and Routing

```bash
# Enable IP forwarding (required for a router)
set system sysctl parameter net.ipv4.ip_forward value 1

# Allow non-local bind (for failover/VRRP)
set system sysctl parameter net.ipv4.ip_nonlocal_bind value 1

# Dynamic local port selection
set system sysctl parameter net.ipv4.ip_local_port_range value '1024 65535'
```

#### TCP Performance Tuning

**TCP Window Scaling:**

```bash
# Enable window scaling (RFC 1323)
set system sysctl parameter net.ipv4.tcp_window_scaling value 1

# TCP read buffer sizes
set system sysctl parameter net.ipv4.tcp_rmem value '4096 87380 16777216'

# TCP write buffer sizes
set system sysctl parameter net.ipv4.tcp_wmem value '4096 65536 16777216'

# Maximum buffer size (16 MB)
set system sysctl parameter net.core.rmem_max value 16777216
set system sysctl parameter net.core.wmem_max value 16777216
```

**TCP Congestion Control:**

```bash
# Congestion control algorithm (bbr, cubic, reno)
set system sysctl parameter net.ipv4.tcp_congestion_control value 'bbr'

# Available algorithms
set system sysctl parameter net.ipv4.tcp_allowed_congestion_control value 'bbr cubic reno'
```

**TCP Keepalive:**

```bash
# Time before keepalive probes start (seconds)
set system sysctl parameter net.ipv4.tcp_keepalive_time value 600

# Interval between keepalive probes
set system sysctl parameter net.ipv4.tcp_keepalive_intvl value 60

# Number of keepalive attempts
set system sysctl parameter net.ipv4.tcp_keepalive_probes value 3
```

**TCP Timestamps:**

```bash
# Enable TCP timestamps (RFC 1323)
set system sysctl parameter net.ipv4.tcp_timestamps value 1
```

**TCP Fast Open:**

```bash
# Enable TCP Fast Open (TFO)
# 1 = client, 2 = server, 3 = both
set system sysctl parameter net.ipv4.tcp_fastopen value 3
```

#### TCP Security Parameters

**SYN Flood Protection:**

```bash
# Enable SYN cookies (SYN flood protection)
set system sysctl parameter net.ipv4.tcp_syncookies value 1

# Maximum SYN backlog
set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 8192

# Number of SYN retries
set system sysctl parameter net.ipv4.tcp_syn_retries value 2
set system sysctl parameter net.ipv4.tcp_synack_retries value 2
```

**TCP Reuse and Recycle:**

```bash
# Allow reuse of TIME-WAIT sockets
set system sysctl parameter net.ipv4.tcp_tw_reuse value 1

# Lifetime of orphaned connections (seconds)
set system sysctl parameter net.ipv4.tcp_fin_timeout value 30

# Maximum orphan sockets
set system sysctl parameter net.ipv4.tcp_max_orphans value 65536
```

#### ICMP Parameters

```bash
# Ignore ICMP echo requests (ping)
set system sysctl parameter net.ipv4.icmp_echo_ignore_all value 0

# Ignore broadcast ping
set system sysctl parameter net.ipv4.icmp_echo_ignore_broadcasts value 1

# Rate-limit ICMP replies (flood protection)
set system sysctl parameter net.ipv4.icmp_ratelimit value 100

# Refuse ICMP redirects (security)
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0

# Refuse source routing
set system sysctl parameter net.ipv4.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv4.conf.default.accept_source_route value 0
```

#### Reverse Path Filtering (Anti-Spoofing)

```bash
# rp_filter modes:
# 0 = disabled
# 1 = strict mode (recommended for most cases)
# 2 = loose mode (for asymmetric routing)

# Strict mode (verifies the reverse route)
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1

# Loose mode (for complex topologies with asymmetric routing)
# set system sysctl parameter net.ipv4.conf.all.rp_filter value 2
```

#### ARP Parameters

```bash
# ARP entry lifetime (seconds)
set system sysctl parameter net.ipv4.neigh.default.gc_stale_time value 120

# ARP table - thresholds
set system sysctl parameter net.ipv4.neigh.default.gc_thresh1 value 128
set system sysctl parameter net.ipv4.neigh.default.gc_thresh2 value 512
set system sysctl parameter net.ipv4.neigh.default.gc_thresh3 value 1024
```

### 2. IPv6 network parameters (net.ipv6.*)

#### IPv6 Forwarding

```bash
# Enable IPv6 forwarding
set system sysctl parameter net.ipv6.conf.all.forwarding value 1
set system sysctl parameter net.ipv6.conf.default.forwarding value 1
```

#### IPv6 Security

```bash
# Refuse IPv6 router advertisements
set system sysctl parameter net.ipv6.conf.all.accept_ra value 0
set system sysctl parameter net.ipv6.conf.default.accept_ra value 0

# Refuse IPv6 redirects
set system sysctl parameter net.ipv6.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv6.conf.default.accept_redirects value 0

# Refuse source routing
set system sysctl parameter net.ipv6.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv6.conf.default.accept_source_route value 0
```

#### IPv6 Autoconfiguration

```bash
# Disable IPv6 autoconf (for static configuration)
set system sysctl parameter net.ipv6.conf.all.autoconf value 0
set system sysctl parameter net.ipv6.conf.default.autoconf value 0
```

#### Fully disabling IPv6 (if not used)

```bash
set system sysctl parameter net.ipv6.conf.all.disable_ipv6 value 1
set system sysctl parameter net.ipv6.conf.default.disable_ipv6 value 1
set system sysctl parameter net.ipv6.conf.lo.disable_ipv6 value 1
```

### 3. Core Network Parameters (net.core.*)

#### Network Buffers

```bash
# Maximum receive buffer size
set system sysctl parameter net.core.rmem_max value 16777216

# Maximum send buffer size
set system sysctl parameter net.core.wmem_max value 16777216

# Default receive buffer
set system sysctl parameter net.core.rmem_default value 262144

# Default send buffer
set system sysctl parameter net.core.wmem_default value 262144

# Buffer size for memory optimization
set system sysctl parameter net.core.optmem_max value 25165824
```

#### Network Device Queue

```bash
# Maximum length of the packet processing queue
set system sysctl parameter net.core.netdev_max_backlog value 5000

# Packet processing budget per poll
set system sysctl parameter net.core.netdev_budget value 600
```

#### Somaxconn

```bash
# Maximum backlog for the listen() system call
# Important for high-load web servers
set system sysctl parameter net.core.somaxconn value 4096
```

### 4. Virtual Memory (vm.*)

#### Swappiness

```bash
# Aggressiveness of swap usage (0-100)
# 0 = minimum swap, 100 = actively use swap
# Recommended: 10 for servers, 60 for desktop
set system sysctl parameter vm.swappiness value 10
```

#### Cache Pressure

```bash
# Pressure to reclaim cache (0-100)
# Lower value = more cache is retained
set system sysctl parameter vm.vfs_cache_pressure value 50
```

#### Dirty Memory

```bash
# Percentage of memory for dirty pages before writeback begins
set system sysctl parameter vm.dirty_ratio value 10

# Percentage of memory for background writeback
set system sysctl parameter vm.dirty_background_ratio value 5

# Lifetime of dirty data (centiseconds = 1/100 second)
set system sysctl parameter vm.dirty_expire_centisecs value 3000

# pdflush wakeup interval for writeback (centiseconds)
set system sysctl parameter vm.dirty_writeback_centisecs value 500
```

#### OOM (Out of Memory) Killer

```bash
# OOM killer behavior
# 0 = kernel tries to avoid killing
# 1 = kernel kills process more aggressively
# 2 = kernel panics on OOM
set system sysctl parameter vm.panic_on_oom value 0

# OOM score re-evaluation
set system sysctl parameter vm.oom_kill_allocating_task value 0
```

### 5. File System (fs.*)

#### File Descriptors

```bash
# Maximum number of open files (system-wide)
set system sysctl parameter fs.file-max value 2097152

# Maximum inotify watches (for file monitoring)
set system sysctl parameter fs.inotify.max_user_watches value 524288
```

#### AIO (Asynchronous I/O)

```bash
# Maximum asynchronous IO requests
set system sysctl parameter fs.aio-max-nr value 1048576
```

### 6. Kernel Parameters (kernel.*)

#### Kernel Panic

```bash
# Automatic reboot after panic (seconds)
# 0 = do not reboot
set system sysctl parameter kernel.panic value 10

# Panic on kernel oops
set system sysctl parameter kernel.panic_on_oops value 1
```

#### Core Dumps

```bash
# Core dump file name template
set system sysctl parameter kernel.core_pattern value '/tmp/core-%e-%p-%t'
```

#### PID Max

```bash
# Maximum PID (Process ID)
set system sysctl parameter kernel.pid_max value 65536
```

#### SysRq

```bash
# Enable SysRq magic keys (for emergency control)
# 1 = enabled, 0 = disabled
set system sysctl parameter kernel.sysrq value 1
```

#### Address Space Layout Randomization (ASLR)

```bash
# ASLR for protection against exploits
# 0 = disabled
# 1 = random stack/vdso/heap
# 2 = full randomization (recommended)
set system sysctl parameter kernel.randomize_va_space value 2
```

## Configuration examples for common scenarios

### Scenario 1: Basic security (Security Hardening)

Configuring security parameters to protect against common attacks.

```bash
configure

# === IPv4 Security ===

# Enable IP forwarding for a router
set system sysctl parameter net.ipv4.ip_forward value 1

# Protection against IP spoofing (Reverse Path Filtering)
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1

# Refuse source routing
set system sysctl parameter net.ipv4.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv4.conf.default.accept_source_route value 0

# Refuse ICMP redirects
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0
set system sysctl parameter net.ipv4.conf.all.secure_redirects value 0
set system sysctl parameter net.ipv4.conf.default.secure_redirects value 0

# Ignore broadcast ping
set system sysctl parameter net.ipv4.icmp_echo_ignore_broadcasts value 1

# Ignore bogus ICMP error responses
set system sysctl parameter net.ipv4.icmp_ignore_bogus_error_responses value 1

# SYN flood protection
set system sysctl parameter net.ipv4.tcp_syncookies value 1
set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 8192

# Log martian packets (impossible addresses)
set system sysctl parameter net.ipv4.conf.all.log_martians value 1
set system sysctl parameter net.ipv4.conf.default.log_martians value 1

# === IPv6 Security ===

# Refuse IPv6 router advertisements
set system sysctl parameter net.ipv6.conf.all.accept_ra value 0
set system sysctl parameter net.ipv6.conf.default.accept_ra value 0

# Refuse IPv6 redirects
set system sysctl parameter net.ipv6.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv6.conf.default.accept_redirects value 0

# Refuse IPv6 source routing
set system sysctl parameter net.ipv6.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv6.conf.default.accept_source_route value 0

# === Kernel Security ===

# Address Space Layout Randomization
set system sysctl parameter kernel.randomize_va_space value 2

# Restrict access to kernel logs
set system sysctl parameter kernel.dmesg_restrict value 1

# Restrict access to kernel pointers
set system sysctl parameter kernel.kptr_restrict value 2

commit
save
exit
```

### Scenario 2: High-Performance TCP Tuning

Optimization for high-performance network applications (1 Gbps+ links).

```bash
configure

# === TCP Buffer Sizes ===

# Enlarged TCP buffers for high-speed links
# Format: min default max (in bytes)

# TCP receive buffer (4KB, 128KB, 64MB)
set system sysctl parameter net.ipv4.tcp_rmem value '4096 131072 67108864'

# TCP write buffer (4KB, 128KB, 64MB)
set system sysctl parameter net.ipv4.tcp_wmem value '4096 131072 67108864'

# Maximum socket buffer sizes
set system sysctl parameter net.core.rmem_max value 67108864
set system sysctl parameter net.core.wmem_max value 67108864
set system sysctl parameter net.core.rmem_default value 262144
set system sysctl parameter net.core.wmem_default value 262144

# === TCP Performance ===

# TCP window scaling (RFC 1323)
set system sysctl parameter net.ipv4.tcp_window_scaling value 1

# TCP timestamps (RFC 1323)
set system sysctl parameter net.ipv4.tcp_timestamps value 1

# SACK (Selective Acknowledgement)
set system sysctl parameter net.ipv4.tcp_sack value 1

# TCP Fast Open
set system sysctl parameter net.ipv4.tcp_fastopen value 3

# BBR congestion control (best for high-speed links)
set system sysctl parameter net.ipv4.tcp_congestion_control value 'bbr'
set system sysctl parameter net.core.default_qdisc value 'fq'

# === Connection Handling ===

# Reuse of TIME-WAIT sockets
set system sysctl parameter net.ipv4.tcp_tw_reuse value 1

# Reduce FIN timeout
set system sysctl parameter net.ipv4.tcp_fin_timeout value 15

# Increase maximum orphan sockets
set system sysctl parameter net.ipv4.tcp_max_orphans value 131072

# === Network Queue ===

# Increase backlog for packet processing
set system sysctl parameter net.core.netdev_max_backlog value 10000

# Increase listen backlog
set system sysctl parameter net.core.somaxconn value 8192

# === TCP SYN Queue ===

set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 16384

# === Local Port Range ===

set system sysctl parameter net.ipv4.ip_local_port_range value '10000 65535'

commit
save
exit
```

### Scenario 3: Memory optimization for a router

Tuning virtual memory parameters for a network device.

```bash
configure

# === Swappiness ===

# Minimize swap usage
set system sysctl parameter vm.swappiness value 10

# === Cache Pressure ===

# Keep more cache in memory
set system sysctl parameter vm.vfs_cache_pressure value 50

# === Dirty Memory ===

# Tune dirty page writeback
set system sysctl parameter vm.dirty_ratio value 10
set system sysctl parameter vm.dirty_background_ratio value 5
set system sysctl parameter vm.dirty_expire_centisecs value 3000
set system sysctl parameter vm.dirty_writeback_centisecs value 500

# === OOM Killer ===

# Do not panic on OOM
set system sysctl parameter vm.panic_on_oom value 0

# Minimum free memory (KB)
set system sysctl parameter vm.min_free_kbytes value 65536

commit
save
exit
```

### Scenario 4: Increasing file descriptor limits

For routers with a large number of concurrent connections (BGP, VPN, NAT).

```bash
configure

# === File Descriptors ===

# Maximum open files (system-wide)
set system sysctl parameter fs.file-max value 2097152

# === Network Connection Tracking ===

# Increase conntrack max (if NAT/Firewall is used)
# Note: this is a netfilter module, requires the nf_conntrack module
set system sysctl parameter net.netfilter.nf_conntrack_max value 524288

# === Inotify ===

# Increase inotify limits (for file monitoring)
set system sysctl parameter fs.inotify.max_user_watches value 524288
set system sysctl parameter fs.inotify.max_user_instances value 512

commit
save
exit
```

## Examples for cloud platforms

### Example 1: Yandex Cloud - High-Performance TCP for Cloud Workloads

Optimizing VyOS in Yandex Cloud for high-performance traffic processing between VMs.

```bash
configure

# === Description ===
# Configuration for VyOS in Yandex Cloud
# Optimization for high-speed internal connections (up to 10 Gbps)
# Improved latency and throughput for cloud workloads

# === Basic Forwarding ===

set system sysctl parameter net.ipv4.ip_forward value 1
set system sysctl parameter net.ipv6.conf.all.forwarding value 1

# === TCP Performance for Cloud ===

# Enlarged buffers for high throughput
set system sysctl parameter net.ipv4.tcp_rmem value '4096 131072 67108864'
set system sysctl parameter net.ipv4.tcp_wmem value '4096 131072 67108864'
set system sysctl parameter net.core.rmem_max value 67108864
set system sysctl parameter net.core.wmem_max value 67108864

# BBR congestion control (optimal for cloud networks)
set system sysctl parameter net.ipv4.tcp_congestion_control value 'bbr'
set system sysctl parameter net.core.default_qdisc value 'fq'

# TCP Fast Open to reduce latency
set system sysctl parameter net.ipv4.tcp_fastopen value 3

# TCP window optimization
set system sysctl parameter net.ipv4.tcp_window_scaling value 1
set system sysctl parameter net.ipv4.tcp_timestamps value 1
set system sysctl parameter net.ipv4.tcp_sack value 1

# === Connection Management ===

# Fast socket reuse
set system sysctl parameter net.ipv4.tcp_tw_reuse value 1
set system sysctl parameter net.ipv4.tcp_fin_timeout value 15

# Increased connection limits
set system sysctl parameter net.ipv4.tcp_max_orphans value 131072
set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 16384

# === Network Queue for Cloud NIC ===

# Increase backlog (important for burst traffic in the cloud)
set system sysctl parameter net.core.netdev_max_backlog value 10000
set system sysctl parameter net.core.somaxconn value 8192

# === Security for Yandex Cloud ===

# Reverse Path Filtering (strict mode)
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1

# SYN flood protection
set system sysctl parameter net.ipv4.tcp_syncookies value 1

# Refuse ICMP redirects
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0

# === Memory for Cloud VM ===

# Minimize swap (cloud VMs usually have enough RAM)
set system sysctl parameter vm.swappiness value 10

# Dirty page optimization
set system sysctl parameter vm.dirty_ratio value 10
set system sysctl parameter vm.dirty_background_ratio value 5

# === File Descriptors for Cloud Services ===

set system sysctl parameter fs.file-max value 2097152

commit
save
exit
```

**Verifying that parameters are applied in Yandex Cloud:**

```bash
# Check BBR congestion control
sysctl net.ipv4.tcp_congestion_control
sysctl net.ipv4.tcp_available_congestion_control

# Check buffers
sysctl net.ipv4.tcp_rmem
sysctl net.ipv4.tcp_wmem

# Monitor TCP statistics
netstat -s | grep -i tcp

# Check queue length
ip -s link show eth0
```

### Example 2: VK Cloud - Security Hardening for a DMZ router

Enhanced security for VyOS in VK Cloud operating as an edge router in a DMZ.

```bash
configure

# === Description ===
# VyOS Edge Router in VK Cloud DMZ
# Maximum security to protect against external threats
# Optimization for handling mixed trusted/untrusted traffic

# === Basic Routing ===

set system sysctl parameter net.ipv4.ip_forward value 1

# === Strict Security - IP Spoofing Protection ===

# Reverse Path Filtering - strict mode
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1

# Refuse source routing (protection against routing attacks)
set system sysctl parameter net.ipv4.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv4.conf.default.accept_source_route value 0

# === ICMP Security ===

# Refuse ICMP redirects
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0
set system sysctl parameter net.ipv4.conf.all.secure_redirects value 0
set system sysctl parameter net.ipv4.conf.default.secure_redirects value 0

# Ignore broadcast ping (smurf attack protection)
set system sysctl parameter net.ipv4.icmp_echo_ignore_broadcasts value 1

# Ignore bogus ICMP responses
set system sysctl parameter net.ipv4.icmp_ignore_bogus_error_responses value 1

# Rate limit ICMP responses
set system sysctl parameter net.ipv4.icmp_ratelimit value 100

# === SYN Flood Protection ===

# Enable SYN cookies
set system sysctl parameter net.ipv4.tcp_syncookies value 1

# Increase SYN backlog
set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 8192

# Reduce SYN retries (drop attacks faster)
set system sysctl parameter net.ipv4.tcp_syn_retries value 2
set system sysctl parameter net.ipv4.tcp_synack_retries value 2

# === Connection Limits for DMZ ===

# Limit orphan sockets
set system sysctl parameter net.ipv4.tcp_max_orphans value 65536

# Fast connection close
set system sysctl parameter net.ipv4.tcp_fin_timeout value 20

# === Logging and Monitoring ===

# Log martian packets (suspicious addresses)
set system sysctl parameter net.ipv4.conf.all.log_martians value 1
set system sysctl parameter net.ipv4.conf.default.log_martians value 1

# === IPv6 Security (if used) ===

# Refuse IPv6 router advertisements
set system sysctl parameter net.ipv6.conf.all.accept_ra value 0
set system sysctl parameter net.ipv6.conf.default.accept_ra value 0

# Refuse IPv6 redirects
set system sysctl parameter net.ipv6.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv6.conf.default.accept_redirects value 0

# If IPv6 is not used - disable it completely
# set system sysctl parameter net.ipv6.conf.all.disable_ipv6 value 1
# set system sysctl parameter net.ipv6.conf.default.disable_ipv6 value 1

# === Kernel Security ===

# Address Space Layout Randomization (full)
set system sysctl parameter kernel.randomize_va_space value 2

# Restrict access to kernel logs (for unauthorized users)
set system sysctl parameter kernel.dmesg_restrict value 1

# Hide kernel pointers
set system sysctl parameter kernel.kptr_restrict value 2

# Panic and reboot on critical errors
set system sysctl parameter kernel.panic value 10
set system sysctl parameter kernel.panic_on_oops value 1

# === Network Performance (balanced with security) ===

# Moderate buffers
set system sysctl parameter net.ipv4.tcp_rmem value '4096 87380 16777216'
set system sysctl parameter net.ipv4.tcp_wmem value '4096 65536 16777216'
set system sysctl parameter net.core.rmem_max value 16777216
set system sysctl parameter net.core.wmem_max value 16777216

# Backlog for processing
set system sysctl parameter net.core.netdev_max_backlog value 5000
set system sysctl parameter net.core.somaxconn value 4096

# === Connection Tracking for Firewall/NAT ===

# Increase conntrack table for NAT
set system sysctl parameter net.netfilter.nf_conntrack_max value 524288

# Timeout for conntrack (more aggressive for DMZ)
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_established value 3600

commit
save
exit
```

**Verifying security in VK Cloud:**

```bash
# Check rp_filter (should be 1)
sysctl net.ipv4.conf.all.rp_filter

# Check SYN cookies
sysctl net.ipv4.tcp_syncookies

# Check ICMP redirects (should be 0)
sysctl net.ipv4.conf.all.accept_redirects
sysctl net.ipv4.conf.all.send_redirects

# Check martian packet logging
sysctl net.ipv4.conf.all.log_martians

# Monitor SYN flood attacks
netstat -s | grep -i syn

# Monitor conntrack usage
conntrack -C
cat /proc/sys/net/netfilter/nf_conntrack_count
cat /proc/sys/net/netfilter/nf_conntrack_max
```

### Example 3: Multi-Cloud VPN Gateway (Yandex + VK Cloud)

Configuration for VyOS operating as a VPN gateway between Yandex Cloud and VK Cloud.

```bash
configure

# === Description ===
# Multi-cloud VPN Gateway
# Optimization for VPN tunnels (IPsec/WireGuard)
# Balancing performance and security

# === Forwarding ===

set system sysctl parameter net.ipv4.ip_forward value 1
set system sysctl parameter net.ipv6.conf.all.forwarding value 1

# === VPN Specific - PMTU Discovery ===

# Enable PMTU discovery (important for VPN)
set system sysctl parameter net.ipv4.ip_no_pmtu_disc value 0

# === TCP Optimizations for VPN ===

# TCP MTU probing (automatic MTU detection)
set system sysctl parameter net.ipv4.tcp_mtu_probing value 1

# TCP buffers (moderate for VPN overhead)
set system sysctl parameter net.ipv4.tcp_rmem value '4096 87380 33554432'
set system sysctl parameter net.ipv4.tcp_wmem value '4096 65536 33554432'
set system sysctl parameter net.core.rmem_max value 33554432
set system sysctl parameter net.core.wmem_max value 33554432

# === Congestion Control for VPN ===

# BBR for better operation through tunnels
set system sysctl parameter net.ipv4.tcp_congestion_control value 'bbr'
set system sysctl parameter net.core.default_qdisc value 'fq'

# === Security (Moderate for VPN) ===

# Loose rp_filter for VPN tunnels (asymmetric routing)
set system sysctl parameter net.ipv4.conf.all.rp_filter value 2
set system sysctl parameter net.ipv4.conf.default.rp_filter value 2

# SYN flood protection
set system sysctl parameter net.ipv4.tcp_syncookies value 1
set system sysctl parameter net.ipv4.tcp_max_syn_backlog value 8192

# Refuse ICMP redirects
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0

# === IPsec Specific ===

# Disable ICMP redirects on VPN interfaces
# (applied to specific interfaces via configuration)

# === Performance for IPsec ===

# Increase backlog for processing encrypted traffic
set system sysctl parameter net.core.netdev_max_backlog value 10000
set system sysctl parameter net.core.somaxconn value 8192

# === Memory Optimization ===

set system sysctl parameter vm.swappiness value 10
set system sysctl parameter vm.vfs_cache_pressure value 50

# === Connection Limits ===

set system sysctl parameter net.ipv4.tcp_max_orphans value 131072
set system sysctl parameter fs.file-max value 2097152

commit
save
exit
```

## Verification and monitoring commands

### Viewing current sysctl values

```bash
# Show all sysctl parameters
sysctl -a

# Show a specific parameter
sysctl net.ipv4.ip_forward

# Show all parameters in a category
sysctl -a | grep net.ipv4
sysctl -a | grep vm

# Read directly from /proc/sys
cat /proc/sys/net/ipv4/ip_forward
```

### Viewing the VyOS sysctl configuration

```bash
# Show all configured sysctl parameters in VyOS
show configuration system sysctl

# Show in set commands format
show configuration commands | match sysctl

# Show a specific parameter
show configuration system sysctl parameter net.ipv4.ip_forward
```

### Applying parameters manually (temporarily)

```bash
# Apply a parameter without changing the configuration (until reboot)
sudo sysctl -w net.ipv4.ip_forward=1

# Apply from a file
sudo sysctl -p /etc/sysctl.d/99-vyos.conf

# Load all sysctl configurations
sudo sysctl --system
```

### Monitoring network performance

```bash
# TCP statistics
netstat -s | grep -i tcp

# Show retransmits
ss -ti

# Show the congestion control algorithm in use
ss -ti | grep -i cubic
ss -ti | grep -i bbr

# Check buffer sizes for active connections
ss -m

# Monitor backlog
ss -l | grep -i listen
```

### Checking buffers and queues

```bash
# Current buffer sizes
sysctl net.core.rmem_max
sysctl net.core.wmem_max
sysctl net.ipv4.tcp_rmem
sysctl net.ipv4.tcp_wmem

# Network queue statistics
ip -s link show eth0

# Backlog statistics
cat /proc/net/netstat | grep -i tcpext

# Conntrack statistics (if used)
conntrack -C
cat /proc/sys/net/netfilter/nf_conntrack_count
cat /proc/sys/net/netfilter/nf_conntrack_max
```

### Monitoring memory

```bash
# Memory usage
free -h

# Current swappiness value
sysctl vm.swappiness

# Swap statistics
vmstat 1 5

# Dirty pages statistics
cat /proc/meminfo | grep -i dirty
sysctl vm.dirty_ratio
sysctl vm.dirty_background_ratio

# OOM killer logs
dmesg | grep -i oom
journalctl -k | grep -i oom
```

### Checking file descriptors

```bash
# Current file descriptor usage (system-wide)
cat /proc/sys/fs/file-nr

# Maximum file descriptors
sysctl fs.file-max

# File descriptors per process
lsof | wc -l

# Top processes by open files
lsof | awk '{print $1}' | sort | uniq -c | sort -rn | head -10
```

## Troubleshooting

### Problem 1: A sysctl parameter is not applied after commit

**Symptoms:**
- The `show configuration system sysctl` command shows the parameter
- `sysctl <parameter>` shows the old value
- The parameter is not applied in `/proc/sys/`

**Diagnostics:**

```bash
# Check the VyOS configuration
show configuration system sysctl parameter net.ipv4.ip_forward

# Check the current value
sysctl net.ipv4.ip_forward

# Check the generated file
cat /etc/sysctl.d/99-vyos.conf | grep ip_forward

# Check the logs
journalctl -xe | grep sysctl
```

**Possible causes:**

1. **Incorrect parameter name**

```bash
# Wrong (underscores instead of dots)
set system sysctl parameter net_ipv4_ip_forward value 1

# Correct
set system sysctl parameter net.ipv4.ip_forward value 1
```

2. **The parameter does not exist in the current kernel**

```bash
# Check parameter availability
ls -la /proc/sys/net/ipv4/ | grep ip_forward
```

3. **The kernel module is not loaded**

```bash
# Some parameters require modules
# For example, nf_conntrack for conntrack parameters
lsmod | grep nf_conntrack

# Load the module if needed
sudo modprobe nf_conntrack
```

**Solution:**

```bash
# 1. Fix the configuration
configure
delete system sysctl parameter <incorrect-parameter>
set system sysctl parameter <correct-parameter> value <value>
commit
save
exit

# 2. Apply manually for immediate effect
sudo sysctl -w net.ipv4.ip_forward=1

# 3. Reboot (if the parameter is critical)
sudo reboot
```

### Problem 2: Network performance did not improve after changing buffers

**Symptoms:**
- TCP buffers are increased in sysctl
- Throughput remains low
- Latency does not improve

**Diagnostics:**

```bash
# Check applied parameters
sysctl net.ipv4.tcp_rmem
sysctl net.ipv4.tcp_wmem
sysctl net.core.rmem_max
sysctl net.core.wmem_max

# Check autotuning
sysctl net.ipv4.tcp_moderate_rcvbuf

# Monitor active connections
ss -ti | head -20

# Check congestion control
sysctl net.ipv4.tcp_congestion_control

# Retransmit statistics
netstat -s | grep -i retrans

# Check NIC ring buffers
ethtool -g eth0
```

**Possible causes:**

1. **net.core.rmem_max / wmem_max is smaller than the tcp_rmem / tcp_wmem maximums**

```bash
# Problem: tcp_rmem max = 67108864, but rmem_max = 212992
sysctl net.ipv4.tcp_rmem  # 4096 87380 67108864
sysctl net.core.rmem_max  # 212992

# Solution: increase the core limits
configure
set system sysctl parameter net.core.rmem_max value 67108864
set system sysctl parameter net.core.wmem_max value 67108864
commit
save
```

2. **Congestion control is not optimized**

```bash
# BBR may not be available
sysctl net.ipv4.tcp_available_congestion_control

# If BBR is not in the list, use cubic
configure
set system sysctl parameter net.ipv4.tcp_congestion_control value 'cubic'
commit
save
```

3. **QDisc is not optimized for BBR**

```bash
# BBR requires the fq qdisc
sysctl net.core.default_qdisc

configure
set system sysctl parameter net.core.default_qdisc value 'fq'
commit
save
```

4. **NIC offloading is disabled**

```bash
# Check offloading
ethtool -k eth0 | grep offload

# Enable it if disabled
sudo ethtool -K eth0 tso on
sudo ethtool -K eth0 gso on
sudo ethtool -K eth0 gro on
```

### Problem 3: The system does not boot after changing kernel parameters

**Symptoms:**
- VyOS does not boot or kernel panic
- The system hangs during boot
- Unable to log in

**Solution via GRUB rescue:**

1. **Boot into single user mode:**

```bash
# During boot, press 'e' in the GRUB menu
# Add to the linux line:
linux ... single init=/bin/bash

# Boot
```

2. **Roll back the changes:**

```bash
# Remount the filesystem read-write
mount -o remount,rw /

# Remove the problematic parameter from the configuration
# Edit /config/config.boot
vi /config/config.boot

# Find and remove the line with the problematic sysctl parameter

# Or remove the entire sysctl config
rm -f /etc/sysctl.d/99-vyos.conf

# Reboot
reboot
```

3. **Alternative: boot from the previous configuration:**

```bash
# During VyOS boot, select the previous commit from the boot menu
# VyOS will automatically roll back to the previous working configuration
```

**Prevention:**

```bash
# Always test critical changes before save
configure
set system sysctl parameter <parameter> value <value>
commit

# DO NOT run save immediately!
# Test operability

# If everything works - save
save

# If there are problems - roll back
rollback
```

### Problem 4: The conntrack table overflows (NAT/Firewall)

**Symptoms:**
- Message "nf_conntrack: table full, dropping packet"
- New connections are not established
- Intermittent connectivity issues

**Diagnostics:**

```bash
# Check current conntrack usage
conntrack -C

# Check the maximum
cat /proc/sys/net/netfilter/nf_conntrack_max

# Check kernel logs
dmesg | grep -i conntrack
journalctl -k | grep -i conntrack

# Conntrack statistics
cat /proc/net/nf_conntrack | wc -l
```

**Solution:**

```bash
configure

# Increase nf_conntrack_max
set system sysctl parameter net.netfilter.nf_conntrack_max value 524288

# Increase hashsize (requires reloading the module)
# hashsize is usually = nf_conntrack_max / 4

# Reduce the timeout for established connections (more aggressive)
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_established value 3600

# Reduce the timeout for TIME_WAIT
set system sysctl parameter net.netfilter.nf_conntrack_tcp_timeout_time_wait value 30

commit
save
exit

# For immediate effect
sudo sysctl -w net.netfilter.nf_conntrack_max=524288
```

**Increasing hashsize (requires a reboot):**

```bash
# Add a module parameter
sudo vi /etc/modprobe.d/nf_conntrack.conf

# Add:
options nf_conntrack hashsize=131072

# Reload the module (caution! This resets all existing connections)
sudo rmmod nf_conntrack
sudo modprobe nf_conntrack

# Or reboot the system
sudo reboot
```

### Problem 5: The OOM Killer kills processes

**Symptoms:**
- The system kills processes when memory runs out
- Log messages "Out of memory: Kill process"
- Unpredictable system behavior

**Diagnostics:**

```bash
# Check OOM killer logs
dmesg | grep -i oom
journalctl -k | grep -i oom

# Check memory usage
free -h

# Check swap
swapon --show

# Check OOM parameters
sysctl vm.panic_on_oom
sysctl vm.oom_kill_allocating_task

# Processes with a high OOM score
cat /proc/*/oom_score | sort -n | tail -10
```

**Solution:**

```bash
configure

# Do not panic on OOM (allow a process to be killed)
set system sysctl parameter vm.panic_on_oom value 0

# Increase swappiness if swap is needed
set system sysctl parameter vm.swappiness value 30

# Increase min_free_kbytes (reserve more memory)
set system sysctl parameter vm.min_free_kbytes value 131072

commit
save
exit
```

**Adding swap (if RAM is insufficient):**

```bash
# Create a swap file (1GB)
sudo dd if=/dev/zero of=/swap bs=1M count=1024
sudo chmod 600 /swap
sudo mkswap /swap
sudo swapon /swap

# Make it persistent
sudo vi /etc/fstab
# Add:
/swap none swap sw 0 0
```

## Best Practices

### 1. Testing changes

**Always test before saving:**

```bash
configure

# Make changes
set system sysctl parameter <parameter> value <value>

# Apply
commit

# TEST THE SYSTEM!
# Check:
# - Network operability
# - Service availability
# - Performance
# - Logs for errors

# If everything works - save
save

# If there are problems - roll back
rollback
```

### 2. Documenting changes

**Use commit comments:**

```bash
configure
set system sysctl parameter net.ipv4.tcp_rmem value '4096 131072 67108864'
commit comment "Increased TCP receive buffers for high-speed 10G link - Ticket #12345"
save
```

**Keep a changelog:**

```bash
# View change history
show system commit
show system commit diff 5
```

### 3. Gradual rollout

**Do not change all parameters at once:**

```bash
# Bad: 50 parameters at once
# Impossible to identify the cause of a problem

# Good: phased rollout
# Step 1: Security (rp_filter, syn_cookies)
# Test
# Step 2: TCP buffers
# Test
# Step 3: Congestion control
# Test
```

### 4. Baseline measurements

**Measure BEFORE and AFTER:**

```bash
# Baseline before changes
iperf3 -c server -t 60 > before.txt
netstat -s > netstat-before.txt

# Make sysctl changes

# Test after changes
iperf3 -c server -t 60 > after.txt
netstat -s > netstat-after.txt

# Compare the results
diff netstat-before.txt netstat-after.txt
```

### 5. Backing up the configuration

**Back up before critical changes:**

```bash
# Save the current configuration
save /config/backup-before-sysctl-$(date +%Y%m%d).config

# View available backups
ls -lh /config/backup-*

# Restore from a backup (if needed)
load /config/backup-before-sysctl-20250115.config
commit
save
```

### 6. Scenario-specific parameters

**Do not use a universal config for all scenarios:**

| Scenario | Priorities | Key parameters |
|----------|------------|-------------------|
| Edge Router (DMZ) | Security | rp_filter=1, syn_cookies=1, log_martians=1 |
| Core Router | Performance | tcp_rmem/wmem (large), bbr, netdev_max_backlog |
| VPN Gateway | Tunneling | tcp_mtu_probing=1, rp_filter=2, ip_no_pmtu_disc=0 |
| NAT Gateway | Conntrack | nf_conntrack_max (large), tcp_tw_reuse=1 |
| Lab/Testing | Monitoring | log_martians=1, tcp_timestamps=1 |

### 7. Monitoring after rollout

**Set up monitoring of key metrics:**

```bash
# Sysctl parameter monitoring script
#!/bin/bash
# /config/scripts/monitor-sysctl.sh

echo "=== Critical sysctl parameters ==="
echo "IP Forwarding: $(sysctl -n net.ipv4.ip_forward)"
echo "SYN Cookies: $(sysctl -n net.ipv4.tcp_syncookies)"
echo "RP Filter: $(sysctl -n net.ipv4.conf.all.rp_filter)"
echo "Conntrack Max: $(sysctl -n net.netfilter.nf_conntrack_max)"
echo "Conntrack Current: $(conntrack -C)"
echo "TCP Retransmits: $(netstat -s | grep -i retrans)"
```

### 8. Caution with dangerous parameters

**Parameters that can break the system:**

```bash
# DANGEROUS: Disabling IP forwarding on a router
# set system sysctl parameter net.ipv4.ip_forward value 0

# DANGEROUS: Disabling all ICMP (can break PMTU discovery)
# set system sysctl parameter net.ipv4.icmp_echo_ignore_all value 1

# DANGEROUS: kernel.panic = 0 (the system hangs on panic instead of rebooting)
# set system sysctl parameter kernel.panic value 0

# DANGEROUS: vm.swappiness = 100 (constant swap, performance degradation)
# set system sysctl parameter vm.swappiness value 100
```

### 9. Compliance with security requirements

**Security standards (CIS, NIST):**

```bash
# Minimum set for compliance
configure

# CIS Benchmark - Network Parameters
set system sysctl parameter net.ipv4.conf.all.send_redirects value 0
set system sysctl parameter net.ipv4.conf.default.send_redirects value 0
set system sysctl parameter net.ipv4.conf.all.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.default.accept_redirects value 0
set system sysctl parameter net.ipv4.conf.all.accept_source_route value 0
set system sysctl parameter net.ipv4.conf.default.accept_source_route value 0
set system sysctl parameter net.ipv4.icmp_echo_ignore_broadcasts value 1
set system sysctl parameter net.ipv4.icmp_ignore_bogus_error_responses value 1
set system sysctl parameter net.ipv4.conf.all.rp_filter value 1
set system sysctl parameter net.ipv4.conf.default.rp_filter value 1
set system sysctl parameter net.ipv4.tcp_syncookies value 1
set system sysctl parameter net.ipv4.conf.all.log_martians value 1

# Kernel hardening
set system sysctl parameter kernel.randomize_va_space value 2
set system sysctl parameter kernel.dmesg_restrict value 1
set system sysctl parameter kernel.kptr_restrict value 2

commit
save
```

### 10. Versioning and compatibility

**Account for the kernel version:**

```bash
# Check the kernel version
uname -r

# Some parameters are available only in newer versions
# For example, tcp_bbr appeared in Linux 4.9+

# Check parameter availability
ls /proc/sys/net/ipv4/tcp_congestion_control

# Check available congestion control algorithms
sysctl net.ipv4.tcp_available_congestion_control
```

## Useful resources and documentation

### Official documentation

- [VyOS Documentation - Sysctl](https://docs.vyos.io/en/latest/configuration/system/sysctl.html)
- [Linux Kernel Documentation - sysctl](https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt)
- [Red Hat - Tuning Network Performance](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/performance_tuning_guide/sect-red_hat_enterprise_linux-performance_tuning_guide-networking-configuration_tools)

### TCP/IP Tuning Guides

- [Linux TCP Tuning Guide](https://fasterdata.es.net/host-tuning/linux/)
- [BBR Congestion Control](https://queue.acm.org/detail.cfm?id=3022184)
- [High Performance Browser Networking](https://hpbn.co/)

### Security Hardening

- [CIS Benchmark for Linux](https://www.cisecurity.org/benchmark/distribution_independent_linux)
- [NIST Security Configuration Checklist](https://www.nist.gov/programs-projects/security-configuration-checklists-program)
- [Linux Kernel Security Subsystem](https://www.kernel.org/doc/html/latest/admin-guide/security.html)

### Cloud-specific

- [Yandex Cloud Network Performance](https://cloud.yandex.ru/docs/compute/concepts/performance-levels)
- [VK Cloud Networking](https://mcs.mail.ru/docs/networks)

## Conclusion

Proper tuning of kernel parameters through sysctl is a critically important part of optimizing VyOS for specific use cases. Key takeaways:

### Key principles:

1. **Understand the parameters**: Do not change parameters without understanding their impact
2. **Testing**: Always test changes before saving to production
3. **Monitoring**: Track the effect of changes through metrics
4. **Documentation**: Record the reasons for and results of changes
5. **Incrementality**: Make changes in stages, not all at once

### Priorities by scenario:

**Edge Router (DMZ):**
- Security above all (rp_filter, syn_cookies, no redirects)
- Moderate performance
- Logging of suspicious activity

**High-Performance Core Router:**
- Maximum throughput (large buffers, BBR, optimized queues)
- Moderate security
- Minimal latency

**VPN Gateway:**
- PMTU discovery for tunnels
- Loose rp_filter for asymmetric routing
- Optimized congestion control for encrypted traffic

**NAT Gateway:**
- Maximum conntrack entries
- Fast connection reuse
- Large file descriptor limits

### Recommendations for cloud platforms:

**Yandex Cloud:**
- Use BBR for optimal performance
- Account for the burst nature of cloud networking
- Configure large buffers for high-speed links

**VK Cloud:**
- Prioritize security hardening for DMZ routers
- Optimize conntrack for NAT workloads
- Balance performance and security

Follow best practices, test changes, and adapt the configuration to your specific requirements to achieve optimal performance and security for VyOS in your infrastructure.