linux内核,网络参数优化 sysctl.conf
程序员文章站
2022-06-04 10:45:33
...
配置文件/etc/sysctl.conf
#禁用ip包转发
net.ipv4.ip_forward = 0
net.ipv4.conf.all.forwarding = 0
#对直接连接的网络进行反向路径过滤
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
#不允许接受含有源路由信息的ip包
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
#打开TCP SYN cookies保护,一定程度预防SYN攻击
net.ipv4.tcp_syncookies = 1
#SYN队列的长度,适当增大该值,有助于抵挡SYN攻击
net.ipv4.tcp_max_syn_backlog = 3072
#SYN的重试次数,适当降低该值,有助于防范SYN攻击
net.ipv4.tcp_synack_retries = 3
net.ipv4.tcp_syn_retries = 3
#关闭Linux kernel的路由重定向功能
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
#不允许ip重定向信息
net.ipv4.conf.all.accept_redirects = 0
#取消安全重定向
net.ipv4.conf.all.secure_redirects = 0
#预防ICMP探测
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
#进程快速回收,避免系统中存在大量TIME_WAIT进程
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30
#端口重用,一般不开启
net.ipv4.tcp_tw_reuse = 0
#临时端口范围
net.ipv4.ip_local_port_range = 1024 65535
sysctl -p 使其立即生效