#----------------------------------------------------------------------------
## sysctl.conf pour EOLE
#----------------------------------------------------------------------------


# activer l'antispoofing pour interface 1 (%%nom_carte_eth0)
%for %%interface in %%nom_carte_eth0
net.ipv4.conf.%%{interface}.rp_filter = 1
%end for
net.ipv4.conf.%%{nom_zone_eth0}.rp_filter = 1
%if %%nombre_interfaces >= "2"
%if %%activer_antispoofing == 'oui'
# activer l'antispoofing pour toutes les interfaces
net.ipv4.conf.all.rp_filter = 1
%end if
%end if
# packet forwarding
%set %%ipv4_routing = 0
%if %%mode_conteneur_actif == 'oui' or %%activer_routage_ipv4 == 'oui'
  %set %%ipv4_routing = 1
%end if
net.ipv4.ip_forward = %%ipv4_routing
# Enable the magic-sysrq key
kernel.sysrq = 1
# Disable tcp_timestamp
net.ipv4.tcp_timestamps = 0
# eviter les attaques SYN
#net.ipv4.tcp_syncookies = 1
#interdire l'ICMP redirection
net.ipv4.conf.all.accept_redirects = 0
#désactiver source routing
net.ipv4.conf.all.accept_source_route = 0
# Désactiver la notification de congestion (Prble http avec certain serveur)
net.ipv4.tcp_ecn = 0
%if %%activer_log_martian == 'oui'
# log martian sources activé
net.ipv4.conf.all.log_martians = 1
%else
# log martian sources désactivé
net.ipv4.conf.all.log_martians = 0
%end if
# random ip IDs
#kernel.grsecurity.rand_ip_ids = 1
# random tcp src port
#kernel.grsecurity.rand_tcp_src_ports = 1
# random pids
#kernel.grsecurity.rand_pids = 1
# altere ping
#kernel.grsecurity.altered_pings = 1
kernel.hostname = %%nom_machine
kernel.domainname = %%nom_domaine_local
#neighbour table overflow stop culling limit
net.ipv4.neigh.default.gc_thresh1 = %%ipv4_neigh_default_gc_thresh1
#neighbour table overflow soft limit
net.ipv4.neigh.default.gc_thresh2 = %%ipv4_neigh_default_gc_thresh2
#neighbour table overflow hard limit
net.ipv4.neigh.default.gc_thresh3 = %%ipv4_neigh_default_gc_thresh3
#ip_no_pmtu_disc : desactive le path mtu discovery le bit DF n'est pas positionne à 1
%if %%ip_no_pmtu_disc == "oui"
net.ipv4.ip_no_pmtu_disc = 1
%else
net.ipv4.ip_no_pmtu_disc = 0
%end if
# for smb (#5256)
%if %%is_defined('fs_inotify_max_user_instances')
fs.inotify.max_user_instances = %%fs_inotify_max_user_instances
%end if
%if %%is_defined('fs_inotify_max_user_watches')
fs.inotify.max_user_watches = %%fs_inotify_max_user_watches
%end if
%if %%is_defined('fs_inotify_max_queued_events')
fs.inotify.max_queued_events = %%fs_inotify_max_queued_events
%end if
# utilisation de la swap par rapport à la mémoire vive (#10569)
vm.swappiness = %%vm_swappiness

# Support IPV6
%set %%ipv6_routing = 0
%if %%activer_ipv6 == 'oui'
  %if %%getVar('activer_routage_ipv6', 'non') == 'oui'
    %set %%ipv6_routing = 1
  %end if
net.ipv6.conf.all.disable_ipv6=0
net.ipv6.conf.default.disable_ipv6=0
net.ipv6.conf.lo.disable_ipv6=0
%else
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1
%end if

# Routage IPv6
net.ipv6.conf.all.forwarding=%%ipv6_routing
