global.conf 1.9 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667
  1. #
  2. # Sysctls for all FFHO machines (Salt managed)
  3. #
  4. #
  5. # After kernel oops wait 1 sec, than reset system
  6. kernel.panic_on_oops = 1
  7. kernel.panic = 1
  8. #
  9. # If non-zero, the message will be sent with the primary address of
  10. # the interface that received the packet that caused the icmp error.
  11. # This is the behaviour network many administrators will expect from
  12. # a router. And it can make debugging complicated network layouts
  13. # much easier.
  14. #
  15. # Note that if no primary address exists for the interface selected,
  16. # then the primary address of the first non-loopback interface that
  17. # has one will be used regardless of this setting.
  18. net.ipv4.icmp_errors_use_inbound_ifaddr = 1
  19. #
  20. # Enables child sockets to inherit the L3 master device index.
  21. # Enabling this option allows a "global" listen socket to work
  22. # across L3 master domains (e.g., VRFs) with connected sockets
  23. # derived from the listen socket to be bound to the L3 domain in
  24. # which the packets originated. Only valid when the kernel was
  25. # compiled with CONFIG_NET_L3_MASTER_DEV.
  26. net.ipv4.tcp_l3mdev_accept = 1
  27. #
  28. # Increase ARP garbage collector thresholds
  29. net.ipv4.neigh.default.gc_thresh1 = 4096
  30. net.ipv4.neigh.default.gc_thresh2 = 8192
  31. net.ipv4.neigh.default.gc_thresh3 = 16384
  32. net.ipv6.neigh.default.gc_thresh1 = 4096
  33. net.ipv6.neigh.default.gc_thresh2 = 8192
  34. net.ipv6.neigh.default.gc_thresh3 = 16384
  35. #
  36. # Increase conntrack table size (default 32k)
  37. net.netfilter.nf_conntrack_max = 16777216
  38. #
  39. # "Be conservative in what you do,
  40. # be liberal in what you accept from others."
  41. # If it's non-zero, we mark only out of window RST segments as INVALID.
  42. # -- net/netfilter/nf_conntrack_proto_tcp.c
  43. #
  44. net.ipv4.netfilter.ip_conntrack_tcp_be_liberal = 1
  45. #
  46. # Don't filter packet passing a bridge and not being routed on this host.
  47. net.bridge.bridge-nf-call-iptables = 0
  48. net.bridge.bridge-nf-call-ip6tables = 0
  49. net.bridge.bridge-nf-call-arptables = 0
  50. #
  51. # Prevent swapping
  52. vm.swappiness = 1