## Linux 2.4/2.6 kernel settings

All of these parameters are controlled either with sysctl command line tool or via /proc file system. See file ip-sysctl.txt for description of these parameters, and more. The file can be found online for example here

- http://iptables-tutorial.frozentux.net/other/ip-sysctl.txt
- http://tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.kernel.obscure.html

IPv6 related kernel settings are documented here:

- http://tldp.org/HOWTO/Linux+IPv6-HOWTO/chapter-kernel-settings.html

## Tab Options

### IPv4 Packet Forwarding

Enable IPv4 forwarding between all interfaces

### IPv6 Packet Forwarding

Enable IPv6 forwarding between all interfaces

### Kernel anti-spoofing protection

/proc/sys/net/ipv4/conf/all/rp_filter

- 1 - do source validation by reversed path, as specified in RFC1812 Recommended option for single homed hosts and stub network routers. Could cause troubles for complicated (not loop free) networks running a slow unreliable protocol (sort of RIP), or using static routes.
- 0 - No source validation.

### Ignore broadcast pings

/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

If set to true, then the kernel will ignore ICMP echo requests sent to broadcast/multicast addresses.

### Accept source route

Accept packets with SRR option.

### Accept ICMP redirects

Accept ICMP Redirects.

### Ignore bogus ICMP errors

/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

Some routers violate RFC 1122 by sending bogus responses to broadcast frames. Such violations are normally logged via a kernel warning. If this is set to TRUE, the kernel will not give such warnings, which will avoid log file clutter.

### Allow dynamic addresses

/proc/sys/net/ipv4/ip_dynaddr

If set, enables support for dynamic addresses.

### Log martians

Log and drop "Martian" packets. A "Martian" packet is one for which the host does not have a route back to the source IP address (it apparently dropped in from Mars).

## Tab TCP

### TCP FIN timeout

/proc/sys/net/ipv4/tcp_fin_timeout

Time to hold socket in state FIN-WAIT-2, if it was closed by our side. Peer can be broken and never close its side, or even died unexpectedly. Default value is 60sec. Usual value used in 2.2 was 180 seconds, you may restore it, but remember that if your machine is even underloaded WEB server, you risk to overflow memory with kilotons of dead sockets, FIN-WAIT-2 sockets are less dangerous than FIN-WAIT-1, because they eat maximum 1.5K of memory, but they tend to live longer.

### TCP keepalive time

/proc/sys/net/ipv4/tcp_keepalive_intvl

How often TCP sends out keepalive messages when keepalive is enabled. Default: 2hours.

### TCP window scaling

/proc/sys/net/ipv4/tcp_window_scaling

Enable window scaling as defined in RFC1323.

### TCP sack

/proc/sys/net/ipv4/tcp_sack

Enable select acknowledgments (SACKS).

### TCP fack

/proc/sys/net/ipv4/tcp_fack

Enable FACK congestion avoidance and fast retransmission. The value is not used, if tcp_sack is not enabled.

### TCP ECN

/proc/sys/net/ipv4/tcp_ecn

Enable Explicit Congestion Notification in TCP.

### TCP SYN cookies

/proc/sys/net/ipv4/tcp_syncookies

Only valid when the kernel was compiled with CONFIG_SYNCOOKIES Send out syncookies when the syn backlog queue of a socket overflows. This is to prevent against the common 'syn flood attack' Default: FALSE

Note, that syncookies is fallback facility. It MUST NOT be used to help highly loaded servers to stand against legal connection rate. If you see synflood warnings in your logs, but investigation shows that they occur because of overload with legal connections, you should tune another parameters until this warning disappear. See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow.

syncookies seriously violate TCP protocol, do not allow to use TCP extensions, can result in serious degradation of some services (e.g. SMTP relaying), visible not by you, but your clients and relays, contacting you. While you see synflood warnings in logs not being really flooded, your server is seriously misconfigured.

### TCP timestamps

/proc/sys/net/ipv4/tcp_timestamps

Enable timestamps as defined in RFC1323.

## Tab Path

In this tab you can set path to the system command line tools used by generated iptables script. Use these if tools you expect to use are located in non-standard directories (such as "/usr/local/bin", "/use/local/sbin" etc.) Leave these blank if tools you expect to use are in standard system directories.

## Tab conntrack

In this tab you can adjust parameters of the conntrack module to tune its performance. This is useful for firewalls passing a lot of traffic but probably is not necessary in most cases. See http://www.wallfire.org/misc/netfilter_conntrack_perf.txt for the detailed explanation.

You can adjust the following parameters:

- CONNTRACK_MAX is the maximum number of "sessions" (connection tracking entries) that can be handled simultaneously by netfilter in kernel memory.
- The hash table contains HASHSIZE linked lists. When the limit is reached (the total number of conntrack entries being stored has reached CONNTRACK_MAX), each list will contain ideally (in the optimal case) about CONNTRACK_MAX/HASHSIZE entries. The hash table occupies a fixed amount of non-swappable kernel memory, whether you have any connections or not. But the maximum number of conntrack entries determines how many conntrack entries can be stored (globally into the linked lists), i.e. how much kernel memory they will be able to occupy at most.
- "Disable TCP window tracking": this is needed if you run conntrackd daemon in state synchronization mode for a firewall cluster and have kernel < 2.6.22. See http://conntrack-tools.netfilter.org/manual.html for more details.