Kernel tunables#

You will end up with a kernel parameter set in the configuration tree, so it is applied at every boot, appears in a diff, and can be rolled back like anything else. VyOS exposes these as system sysctl parameter; System → Settings has a small editor for the list.

Before you start#

The operator role and a licence, or console access.
The current value. Change nothing you have not read first:
bash
```
sysctl net.netfilter.nf_conntrack_max
```

Step 1 — Set it#

In the UI: System → Settings → Kernel parameters. Name and value, then Add.

As commands:

set system sysctl parameter net.netfilter.nf_conntrack_max value 262144

The name is the dotted sysctl name exactly as sysctl -a prints it, and the value goes under a value leaf.

Step 2 — Commit, then confirm the kernel agrees#

bash

sysctl net.netfilter.nf_conntrack_max
# net.netfilter.nf_conntrack_max = 262144

The configuration says what should be; sysctl says what is. If they disagree, the parameter name is wrong or the kernel refused the value, and the commit will usually have said so.

The ones people actually touch on a router#

Each of these has a reason to exist and a symptom that leads you to it. None is a recommendation; they are the ones worth knowing where to look for.

Parameter	Symptom that leads you here
`net.netfilter.nf_conntrack_max`	The connection table filling up. Diagnostics → Health shows per-CPU connection-tracking pressure, which is the page that tells you whether this is your problem.
`net.netfilter.nf_conntrack_acct`	Conntrack byte counters missing. They require this to be enabled; without it the Sessions page has no byte counts to show.
`net.ipv4.tcp_congestion_control`	A long fat path where the default is not the right choice.
`net.core.default_qdisc`	Interacts with CAKE shaping; the QoS page shows the qdisc the kernel actually installed beside the policy the configuration declares, which is where a disagreement shows up.

Check it worked#

bash

# What the configuration says
show configuration commands | match sysctl

# What the kernel says
sysctl net.netfilter.nf_conntrack_max

And check the symptom you set it for actually moved. A tunable you cannot measure is a tunable you should not have set.

Undoing it#

delete system sysctl parameter net.netfilter.nf_conntrack_max

Commit, then reboot or set the kernel value back by hand — removing the configuration stops it being applied at boot, it does not restore the running value.