mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-09 18:45:54 +02:00
1c0cfaa594
This seems to be a failed concept and causes issues with transferring large packets through an IPsec tunnel connection. This configures the kernel to still respond to PMTU ICMP discovery messages, but will not try this on its own. Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
45 lines
1.1 KiB
Plaintext
45 lines
1.1 KiB
Plaintext
net.ipv4.ip_forward = 1
|
|
net.ipv4.ip_dynaddr = 1
|
|
|
|
# Disable Path MTU Discovery
|
|
net.ipv4.ip_no_pmtu_disc = 1
|
|
|
|
net.ipv4.icmp_echo_ignore_broadcasts = 1
|
|
net.ipv4.icmp_ignore_bogus_error_responses = 1
|
|
net.ipv4.icmp_ratelimit = 1000
|
|
net.ipv4.icmp_ratemask = 6168
|
|
|
|
net.ipv4.tcp_syncookies = 1
|
|
net.ipv4.tcp_fin_timeout = 30
|
|
net.ipv4.tcp_syn_retries = 3
|
|
net.ipv4.tcp_synack_retries = 3
|
|
|
|
net.ipv4.conf.default.arp_filter = 1
|
|
net.ipv4.conf.default.rp_filter = 0
|
|
net.ipv4.conf.default.accept_redirects = 0
|
|
net.ipv4.conf.default.accept_source_route = 0
|
|
net.ipv4.conf.default.log_martians = 1
|
|
|
|
net.ipv4.conf.all.arp_filter = 1
|
|
net.ipv4.conf.all.rp_filter = 0
|
|
net.ipv4.conf.all.accept_redirects = 0
|
|
net.ipv4.conf.all.accept_source_route = 0
|
|
net.ipv4.conf.all.log_martians = 1
|
|
|
|
kernel.printk = 1 4 1 7
|
|
vm.swappiness=0
|
|
vm.mmap_min_addr = 4096
|
|
vm.min_free_kbytes = 8192
|
|
|
|
# Disable IPv6 by default.
|
|
net.ipv6.conf.all.disable_ipv6 = 1
|
|
net.ipv6.conf.default.disable_ipv6 = 1
|
|
|
|
# Enable netfilter accounting
|
|
net.netfilter.nf_conntrack_acct=1
|
|
|
|
# Disable netfilter on bridges.
|
|
net.bridge.bridge-nf-call-ip6tables = 0
|
|
net.bridge.bridge-nf-call-iptables = 0
|
|
net.bridge.bridge-nf-call-arptables = 0
|