3 # Disables IPv4 packet forwarding
4 net.ipv4.ip_forward = 0
6 # Enables source route verification
7 net.ipv4.conf.all.rp_filter = 1
8 net.ipv4.conf.default.rp_filter = 1
10 # Accept ICMP redirect messages (suggested 1 for hosts and 0 for routers)
11 # net.ipv4.conf.all.accept_redirects = 1
13 # Accept source routed packages (suggested 0 for hosts and 1 for routers)
14 # net.ipv4.conf.all.accept_source_route = 1
16 # Log packets with source addresses with no known route to kernel log
17 # net.ipv4.conf.all.log_martians = 1
19 # Do multicast routing ? The kernel needs to be compiled with
20 # CONFIG_MROUTE and a multicast routing daemon is required.
21 # net.ipv4.conf.all.mc_forwarding = 1
23 # If you get message "Neighbour table overflow" try to play with this values.
24 # Needed in huge networks. These example values are sufficent in networks with
26 # net.ipv4.neigh.default.gc_thresh3 = 4096
27 # net.ipv4.neigh.default.gc_thresh2 = 2048
28 # net.ipv4.neigh.default.gc_thresh1 = 512
29 # net.ipv6.neigh.default.gc_thresh3 = 1024
30 # net.ipv6.neigh.default.gc_thresh2 = 512
31 # net.ipv6.neigh.default.gc_thresh1 = 128
34 # net.ipv4.conf.all.proxy_arp = 1
36 # Accept ICMP redirect messages only for gateways, listed in
37 # default gateway list ?
38 # net.ipv4.conf.all.secure_redirects = 1
40 # Send ICMP redirects to other hosts ?
41 # net.ipv4.conf.all.send_redirects = 1
43 # Ignore all ICMP echo requests ?
44 # net.ipv4.icmp_echo_ignore_all = 1
46 # Ignore ICMP echo requests to broadcast and multicast addresses ?
47 # net.ipv4.icmp_echo_ignore_broadcasts = 1
49 # Enable MTU discovery patch ? (KERNEL MUST SUPPORT THIS)
50 # MTU (maximal transfer unit) is the size of the chunks we send out
51 # over the net. "Path MTU Discovery" means that, instead of always
52 # sending very small chunks, we start out sending big ones and if we
53 # then discover that some host along the way likes its chunks smaller,
54 # we adjust to a smaller size.
55 # net.ipv4.ip_no_pmtu_disc = 1
57 # Enable debugging of IP masquerading ?
58 # net.ipv4.ip_masq_debug = 1
60 # Bug-to-bug compatibility with some broken printers. On retransmit
61 # try to send bigger packets to work around bugs in certain TCP
62 # stacks. Can be turned off by setting IPV4_RETRANS_COLLAPSE to ,,yes''.
63 # net.ipv4.tcp_retrans_collapse = 1
65 # Disable select acknowledgments after RFC2018 ?
66 # TCP may experience poor performance when multiple packets are lost
67 # from one window of data. With the limited information available
68 # from cumulative acknowledgments, a TCP sender can only learn about a
69 # single lost packet per round trip time. An aggressive sender could
70 # choose to retransmit packets early, but such retransmitted segments
71 # may have already been successfully received.
72 # net.ipv4.tcp_sack = 0
74 # Disable timestamps as defined in RFC1323 ?
75 # Timestamps are designed to provide compatible interworking with
76 # TCP's that do not implement the TCP Extensions for High Performance
77 # net.ipv4.tcp_timestamps = 0
79 # Enable the strict RFC793 interpretation of the TCP urgent pointer field.
80 # net.ipv4.tcp_stdurg = 1
82 # Enable tcp_syncookies
83 # net.ipv4.tcp_syncookies = 1
85 # Disable window scaling as defined in RFC1323 ?
86 # The window scale extension expands the definition of the TCP
87 # window to 32 bits and then uses a scale factor to carry this
88 # 32-bit value in the 16-bit Window field of the TCP header.
89 # net.ipv4.tcp_window_scaling = 0
91 # Enable dynamic socket address rewriting on interface address change.
92 # This is useful for dialup interface with changing IP addresses.
93 # sys.net.ipv4.ip_dynaddr = 7
95 # Range of ports used by TCP and UDP to choose the local
96 # port. Contains two numbers, the first number is the lowest port,
97 # the second number the highest local port. Default is "1024 4999".
98 # Should be changed to "32768 61000" for high-usage systems.
99 # net.ipv4.ip_local_port_range = 4096 61000
101 # Disables automatic defragmentation (needed for masquerading, LVS)
102 # Non existant on Linux 2.4
103 # net.ipv4.ip_always_defrag = 0
107 # Disables IPv6 packet forwarding
108 # net.ipv6.conf.all.forwarding = 0
110 # Do you want IPv6 address autoconfiguration? Kernel default is yes.
111 # net.ipv6.conf.all.autoconf = 0
112 # net.ipv6.conf.default.autoconf = 0
114 # Do you want kernel to add default route for IPv6 interfaces if
115 # there is no router on the link? Kernel default is yes.
116 # Kernel 2.4.0-test? or later (after ANK accepts my patch - baggins).
117 # net.ipv6.conf.all.autoconf_route = 0
121 # Adjust number of inodes and file handles available in the system.
122 # If you have a havily loaded system and kernel complains about
123 # file/inode limit reached in VFS, increase this 2x. The default
124 # value is 4096 (file) and 8192 (inode). The inode number should be
125 # always 2-3 times the file number. For most systems this should not
128 # fs.inode-max = 16384
130 # Sometimes (read: always) the Linux OOM killer doesnâ
\80\99t kill the offending
131 # process. Usually, this is because as the system is out of memory, it isnâ
\80\99t
132 # able to do the memory intensive task of scanning through all the processes.
134 #vm.oom_kill_allocating_task = 1
136 # Controls whether core dumps will append the PID to the core filename.
137 # Useful for debugging multi-threaded applications.
138 #kernel.core_uses_pid = 1
140 # System Request functionality of the kernel (SYNC)
141 # Use kernel.sysrq = 1 to allow all keys.
142 # See http://fedoraproject.org/wiki/QA/Sysrq for a list of values and keys.
145 # After how many seconds reboot system after kernel panic?
146 # 0 - never reboot system (suggested 60)
149 # 0 - Turn the process address space randomization off by default.
150 # 1 - Conservative address space randomization makes the addresses of
151 # mmap base and VDSO page randomized. This, among other things,
152 # implies that shared libraries will be loaded to random addresses.
153 # Also for PIE binaries, the location of code start is randomized.
154 # 2 - This includes all the features that Conservative randomization
155 # provides. In addition to that, also start of the brk area is randomized.
156 # There a few legacy applications out there (such as some ancient
157 # versions of libc.so.5 from 1996) that assume that brk area starts
158 # just after the end of the code+bss. These applications break when
159 # start of the brk area is randomized. There are however no known
160 # non-legacy applications that would be broken this way, so for most
161 # systems it is safe to choose Full randomization.
162 # kernel.randomize_va_space = 2
165 #dev.rtc.max-user-freq = 1024