Kernel tunables#
You will end up with a kernel parameter set in the router's configuration, so it is applied at every start, appears in the configuration history, and can be undone like any other change. System → Settings tab → Kernel parameters edits the list.
Before you start#
- The Operator role, and a licence: kernel parameters are part of the router's configuration.
The current value. Change nothing you have not read first. The panel lists what the configuration sets, not what the kernel is running with; the running value is read at a shell on the router:
bashsysctl <name>- Whether the router already sets it. Some parameters are written by the router's own configuration, and a value here loses to it — see the two it owns that you will reach for.
Step 1 — Set it#
Kernel parameters → Add parameter. With none set, the panel says "No kernel parameters" and "The kernel runs with the router’s defaults."
| Field | Takes |
|---|---|
| Parameter | The dotted name exactly as sysctl -a prints it, such as net.ipv4.tcp_syncookies. Anything else is refused with "Enter a parameter name, such as net.ipv4.tcp_syncookies."; a parameter already in the list with "… is already set." |
| Value | The value, such as 1. It cannot be left empty. |
Add parameter adds "Set kernel parameter net.ipv4.tcp_syncookies to 1" to the pending changes. To change a value later, click the parameter.
Step 2 — Apply, then confirm the kernel agrees#
Apply it from the bar at the bottom of the page with Apply changes. The router checks that the parameter exists: if it refuses the name or the value, applying fails and the bar says why.
Then, at a shell on the router:
sysctl <name>The configuration says what should be; sysctl says what is. If they disagree after the
change was applied, the router's own configuration owns that parameter and has written its
value over yours.
Two the router owns#
The two connection-tracking parameters people reach for first are not tunables in this list. The router writes them itself, from its connection-tracking settings, into its own file, and applies that file at boot and whenever a change to connection tracking, the firewall, NAT, NAT66 or WAN load balancing is applied. A value in Kernel parameters holds until the next of those — which on a router managed from its web interface is soon — and at boot the firewall's pass runs after this list's.
| Parameter | Set it with | What it is for |
|---|---|---|
net.netfilter.nf_conntrack_acct | Per-flow accounting: Turn accounting on on the Sessions page | Per-flow byte counters. Without them the Sessions page has flows with no byte counts, and says so. |
net.netfilter.nf_conntrack_max | The connection table size, which the web interface does not edit in this release | The connection table's size. Diagnostics → Health says whether it is too small, which is the page that tells you whether this is your problem. |
Measured on a lab router on 2026-09-17: a kernel parameter setting
net.netfilter.nf_conntrack_acct to 1 took the kernel to 1; one unrelated firewall change
took it back to 0 with the parameter still in the list; and per-flow accounting took it to
1 and held it there through the next firewall change. Per-flow accounting is not
flow export, which sends flow records to a collector and leaves
this parameter alone.
The connection table size is set at the router's console
(Working from the console):
set system conntrack table-size <entries>, followed by commit and save.
The ones people actually touch on a router#
None of these is a recommendation. Each is listed with the symptom that leads to it.
| Parameter | Symptom that leads you here |
|---|---|
net.ipv4.tcp_congestion_control | A long, high-bandwidth path where the default is not the right choice. |
net.core.default_qdisc | Interacts with CAKE shaping; the QoS page shows the qdisc the kernel actually installed beside the policy that asked for it, which is where a disagreement shows up. |
Check it worked#
The Kernel parameters table shows what the configuration sets. What the kernel is
running with is sysctl <name> at a shell on the router.
And check that the symptom you set it for actually moved.
Undoing it#
Click the parameter, choose Delete parameter — "Remove kernel parameter …" — and apply.
Removing it stops the value being applied at boot; it does not restore the running value. Restart the router, or set the kernel value back at a shell.
In Advanced mode#
With Advanced mode on (Account → Preferences), Review changes lists these changes as the
router's commands, under system sysctl parameter. The two parameters the router owns come
from system conntrack flow-accounting and system conntrack table-size.