欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页

linux内核,网络参数优化 sysctl.conf

程序员文章站 2022-06-04 10:45:33
...

配置文件/etc/sysctl.conf

#禁用ip包转发
net.ipv4.ip_forward = 0  
net.ipv4.conf.all.forwarding = 0

#对直接连接的网络进行反向路径过滤
net.ipv4.conf.all.rp_filter = 1  
net.ipv4.conf.default.rp_filter = 1

#不允许接受含有源路由信息的ip包
net.ipv4.conf.all.accept_source_route = 0  
net.ipv4.conf.default.accept_source_route = 0

#打开TCP SYN cookies保护,一定程度预防SYN攻击
net.ipv4.tcp_syncookies = 1

#SYN队列的长度,适当增大该值,有助于抵挡SYN攻击
net.ipv4.tcp_max_syn_backlog = 3072

#SYN的重试次数,适当降低该值,有助于防范SYN攻击
net.ipv4.tcp_synack_retries = 3  
net.ipv4.tcp_syn_retries = 3

#关闭Linux kernel的路由重定向功能
net.ipv4.conf.all.send_redirects = 0  
net.ipv4.conf.default.send_redirects = 0

#不允许ip重定向信息
net.ipv4.conf.all.accept_redirects = 0

#取消安全重定向
net.ipv4.conf.all.secure_redirects = 0

#预防ICMP探测
net.ipv4.icmp_echo_ignore_broadcasts = 1  
net.ipv4.icmp_ignore_bogus_error_responses = 1

#进程快速回收,避免系统中存在大量TIME_WAIT进程
net.ipv4.tcp_tw_recycle = 1  
net.ipv4.tcp_fin_timeout = 30

#端口重用,一般不开启
net.ipv4.tcp_tw_reuse = 0

#临时端口范围
net.ipv4.ip_local_port_range = 1024 65535  

sysctl -p 使其立即生效