# --------( Sysctl Tuning - Recommended Parameters )--------

# Turn off IP forwarding by default
# (this will be enabled if you require masquerading)

if [ -e /proc/sys/net/ipv4/ip_forward ]; then
  echo 0 > /proc/sys/net/ipv4/ip_forward
fi

# Do not log 'odd' IP addresses (excludes 0.0.0.0 & 255.255.255.255)

if [ -e /proc/sys/net/ipv4/conf/all/log_martians ]; then
  echo 0 > /proc/sys/net/ipv4/conf/all/log_martians
fi


# --------( Sysctl Tuning - TCP Parameters )--------

# Turn off TCP Timestamping in kernel
if [ -e /proc/sys/net/ipv4/tcp_timestamps ]; then
  echo 0 > /proc/sys/net/ipv4/tcp_timestamps
fi

# Set TCP Re-Ordering value in kernel to '5'
if [ -e /proc/sys/net/ipv4/tcp_reordering ]; then
  echo 5 > /proc/sys/net/ipv4/tcp_reordering
fi

# Turn off TCP ACK in kernel
if [ -e /proc/sys/net/ipv4/tcp_sack ]; then
  echo 0 > /proc/sys/net/ipv4/tcp_sack
fi

#Turn off TCP Window Scaling in kernel
if [ -e /proc/sys/net/ipv4/tcp_window_scaling ]; then
  echo 0 > /proc/sys/net/ipv4/tcp_window_scaling
fi

#Set Keepalive timeout to 1800 seconds
if [ -e /proc/sys/net/ipv4/tcp_keepalive_time ]; then
  echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time
fi

#Set FIN timeout to 30 seconds
if [ -e /proc/sys/net/ipv4/tcp_fin_timeout ]; then
  echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
fi

# Set TCP retry count to 3
if [ -e /proc/sys/net/ipv4/tcp_retries1 ]; then
  echo 3 > /proc/sys/net/ipv4/tcp_retries1
fi

#Turn off ECN notification in kernel
if [ -e /proc/sys/net/ipv4/tcp_ecn ]; then
  echo 0 > /proc/sys/net/ipv4/tcp_ecn
fi


# --------( Sysctl Tuning - SYN Parameters )--------

# Turn on SYN cookies protection in kernel
if [ -e /proc/sys/net/ipv4/tcp_syncookies ]; then
  echo 1 > /proc/sys/net/ipv4/tcp_syncookies
fi

# Set SYN ACK retry attempts to '3'
if [ -e /proc/sys/net/ipv4/tcp_synack_retries ]; then
  echo 3 > /proc/sys/net/ipv4/tcp_synack_retries
fi

# Set SYN backlog buffer to '64'
if [ -e /proc/sys/net/ipv4/tcp_max_syn_backlog ]; then
  echo 64 > /proc/sys/net/ipv4/tcp_max_syn_backlog
fi

# Set SYN retry attempts to '6'
if [ -e /proc/sys/net/ipv4/tcp_syn_retries ]; then
  echo 6 > /proc/sys/net/ipv4/tcp_syn_retries
fi


# --------( Sysctl Tuning - Routing / Redirection Parameters )--------

# Turn on source address verification in kernel
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
  for f in /proc/sys/net/ipv4/conf/*/rp_filter
  do
   echo 1 > $f
  done
fi

# Turn off source routes in kernel
if [ -e /proc/sys/net/ipv4/conf/all/accept_source_route ]; then
  for f in /proc/sys/net/ipv4/conf/*/accept_source_route
  do
   echo 0 > $f
  done
fi

# Do not respond to 'redirected' packets
if [ -e /proc/sys/net/ipv4/secure_redirects ]; then
  echo 0 > /proc/sys/net/ipv4/secure_redirects
fi

# Do not reply to 'redirected' packets if requested
if [ -e /proc/sys/net/ipv4/send_redirects ]; then
  echo 0 > /proc/sys/net/ipv4/send_redirects
fi

# Do not reply to 'proxyarp' packets
if [ -e /proc/sys/net/ipv4/proxy_arp ]; then
  echo 0 > /proc/sys/net/ipv4/proxy_arp
fi

# Set FIB model to be RFC1812 Compliant
# (certain policy based routers may break with this - if you find
#  that you can't access certain hosts on your network - please set
#  this option to '0' - which is the default)

if [ -e /proc/sys/net/ipv4/ip_fib_model ]; then
  echo 2 > /proc/sys/net/ipv4/ip_fib_model
fi


# --------( Sysctl Tuning - ICMP/IGMP Parameters )--------

# ICMP Dead Error Messages protection
if [ -e /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ]; then
  echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
fi

# ICMP Broadcasting protection
if [ -e /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ]; then
  echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
fi

# IGMP Membership 'overflow' protection
# (if you are planning on running your box as a router - you should either
#  set this option to a number greater than 5, or disable this protection
#  altogether by commenting out this option)

if [ -e /proc/sys/net/ipv4/igmp_max_memberships ]; then
  echo 1 > /proc/sys/net/ipv4/igmp_max_memberships
fi


# --------( Sysctl Tuning - Miscellanous Parameters )--------

# Set TTL to '64' hops
# (If you are running a masqueraded network, or use policy-based
#  routing - you may want to increase this value depending on the load
#  on your link.)

if [ -e /proc/sys/net/ipv4/conf/all/ip_default_ttl ]; then
  for f in /proc/sys/net/ipv4/conf/*/ip_default_ttl
  do
   echo 64 > $f
  done
fi

# Always defragment incoming packets
# (Some cable modems [ Optus @home ] will suffer intermittent connection
#  droputs with this setting. If you experience problems, set this to '0')

if [ -e /proc/sys/net/ipv4/ip_always_defrag ]; then
  echo 1 > /proc/sys/net/ipv4/ip_always_defrag
fi

# Keep packet fragments in memory for 8 seconds
# (Note - this option has no affect if you turn packet defragmentation
#  (above) off!)

if [ -e /proc/sys/net/ipv4/ipfrag_time ]; then
  echo 8 > /proc/sys/net/ipv4/ipfrag_time
fi

# Do not reply to Address Mask Notification Warnings
# (If you are using your machine as a DMZ router or a PPP dialin server
#  that relies on proxy_arp requests to provide addresses to it's clients
#  you may wish to disable this option by setting the value to '1'

if [ -e /proc/sys/net/ipv4/ip_addrmask_agent ]; then
  echo 0 > /proc/sys/net/ipv4/ip_addrmask_agent
fi

if [ "$EXT_PPP" = "on" ]; then
	# Turn on dynamic TCP/IP address hacking
	# (Some broken PPPoE clients require this option to be enabled)
	if [ -e /proc/sys/net/ipv4/ip_dynaddr ]; then
		echo 1 > /proc/sys/net/ipv4/ip_dynaddr
	fi
else
	if [ -e /proc/sys/net/ipv4/ip_dynaddr ]; then
		echo 0 > /proc/sys/net/ipv4/ip_dynaddr
	fi
fi
# --------( Sysctl Tuning - IPTables Specific Parameters )--------

# Doubling current limit for ip_conntrack
if [ -e /proc/sys/net/ipv4/ip_conntrack_max ]; then
  echo 16384 > /proc/sys/net/ipv4/ip_conntrack_max
fi

