[tor-relays] Re: sysctl tweaks for tiny relays

[forest via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hello.

On 2026-11-02 19:51, Toralf Förster via tor-relays wrote:
> I made good experiences by tweaking sysctl values at tiny relays (1 GB
> RAM, 1 vCPU) and do wonder about your opion/experiences:

Some of those tweaks don't make sense to me:

> net.ipv4.tcp_keepalive_time = 120

Why so aggressive? You could get away with 10x that interval.

> net.ipv4.tcp_synack_retries = 2

Why give up so quickly? This might cause connections to congested relays
to fail. Is the goal just to reduce the number of open sockets?

> net.ipv6.ip_nonlocal_bind = 1

This seems like a mistake. Tor does not make use of arbitrary source
addresses. Unless you're running Unbound with a routed IPv6 netblock and
want it to randomize source addresses, there's no reason to enable this.

Here is what I use:

  net.ipv4.tcp_ecn = 1
  net.ipv4.tcp_fin_timeout = 10
  net.ipv4.tcp_keepalive_time = 1200
  net.ipv4.tcp_tw_reuse = 1
  net.ipv4.ip_local_port_range = 10000 64999
  net.ipv4.tcp_max_syn_backlog = 4096
  net.ipv4.tcp_max_tw_buckets = 2048
  net.ipv4.tcp_max_orphans = 32768
  net.netfilter.nf_conntrack_tcp_timeout_established = 43200
  net.netfilter.nf_conntrack_buckets = 32768
  net.netfilter.nf_conntrack_max = 131072

Increasing the local port range and max conntrack entries helps a lot.
Beware that some low-end VPS providers with cheap outsourced anti-DDoS
shields occasionally block outgoing connections with source ports that
are lower than the Linux default of 32768.

ECN also helps, but it might be worthwhile to just use kernel 7.x which
has AccECN by default which is better than traditional ECN.

I've also played with bpftune to dynamically adjust TCP memory-related
sysctls which has helped slightly, but there's not enough variation over
time for it to really shine. Also, you can't enable lockdown when eBPF
is enabled. I'm sure someone could write some Tor-specific modules for
bpftune that could noticeably improve relay performance, though.

But by far, what helps the most is setting Tor to use a memory allocator
that is more resistant to memory fragmentation. 1AEO has found mimalloc2
is the best, but Debian only has mimalloc3 which is actually worse. I
use jemalloc2 on all of my relays which substantially reduces memory use
and eliminates thrashing.

Regards,
forest
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCaulJtAAKCRAw+TRLM+X4
xt+VAP4q+jPZWhlxEigTz10udYxsiZcVqw3ur+7jf0y1fowXpwD/d/Iyf6eXxh/s
9sgyfmvF6r0ywqBJTuos6jjXmeCQVQk=
=ETXV
-----END PGP SIGNATURE-----
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx