[tor-relays] Re: sysctl tweaks for tiny relays

[forest via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2026-11-03 08:31, Toralf Förster via tor-relays wrote:
> Hhm, at my Debian I didn't saw improvements using another memory
> allocator, the number of socket is the biggest problem here.

That's interesting. Are you sure the memory allocator was actually in
use? It cuts memory use substantially.

The bare minimum sysctls needed to completely fix the issue are:

  net.ipv4.ip_local_port_range = 10000 64999
  net.ipv4.tcp_max_syn_backlog = 4096
  net.ipv4.tcp_max_tw_buckets = 2048
  net.ipv4.tcp_max_orphans = 16384
  net.netfilter.nf_conntrack_buckets = 32768
  net.netfilter.nf_conntrack_max = 131072

That completely eliminates any network resource issues even on my 1 GiB
RAM, 1 vCPU relays that push nearly 200 Mbps.

On 2026-11-03 18:50, boldsuck via tor-relays wrote:
> net.ipv6.conf.all.accept_ra=0

It's better not to block all RA and instead just block RA that is used
to configure new IPv6 addresses, otherwise you might block MTU changes.
This is what I use (and note that the wildcard lets you avoid specifying
"all" and "default" separately, but it only works in the config file):

  net.ipv6.conf.*.autoconf = 0
  net.ipv6.conf.*.accept_ra_pinfo = 0

Regards,
forest
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCauphQwAKCRAw+TRLM+X4
xhhcAPsHELD1M2XJy6urWP0Lan/gKyJ9hVhWOb50szoWWQtB5gD/YXsUS7encS47
Jdpl8TJmDYnK6D9zc5Tw18Cj7mmHXQk=
=gY1+
-----END PGP SIGNATURE-----
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx