Tune Linux Kernel Parameters on VPS with sysctl

June 2026 · 8 min read

By default, Linux kernel parameters are designed for desktop systems, not high-traffic server VPS. To maximize network throughput, support more concurrent connections, and reduce port exhaustion caused by TIME_WAIT states, you need to tune these parameters. This guide covers the most commonly used kernel parameters with explanations of what each one does and why you should adjust it.

⚠️ Backup before tuning: Incorrect kernel settings can break network connectivity. It's recommended to back up your current settings and apply changes one at a time rather than all at once.

View Current Kernel Parameters

# View all parameters
sysctl -a

# View only network-related parameters
sysctl -a | grep net.core

# View a single parameter
sysctl net.ipv4.tcp_max_syn_backlog

Network Optimization (For Web Servers)

sudo nano /etc/sysctl.d/99-vps-tuning.conf

# TCP Buffer Size
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.ipv4.tcp_rmem = 4096 87380 67108864
net.ipv4.tcp_wmem = 4096 65536 67108864

# Connection Queue
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.core.netdev_max_backlog = 65535

# TCP TIME_WAIT (reduce port exhaustion)
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_tw_reuse = 1
net.ipv4.ip_local_port_range = 10240 65000

# TCP Keepalive
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_keepalive_probes = 5

# Disable IPv6 (if not needed)
net.ipv6.conf.all.disable_ipv6 = 1

File Descriptor Limits

# Increase system-wide file descriptor limit
echo "fs.file-max = 2097152" | sudo tee -a /etc/sysctl.d/99-vps-tuning.conf

# Increase per-process ulimit
sudo nano /etc/security/limits.conf
# Add:
*    soft    nofile    1048576
*    hard    nofile    1048576
root soft    nofile    1048576
root hard    nofile    1048576

Memory Management

# Reduce swappiness (avoid excessive swapping on SSD)
vm.swappiness = 10

# Dirty page ratio (buffer write behavior)
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5

# Disable aggressive OOM killer
vm.overcommit_memory = 1

Apply Changes

# Apply immediately without reboot
sudo sysctl -p /etc/sysctl.d/99-vps-tuning.conf

# Apply all files in sysctl.d
sudo sysctl --system

# Verify changes were applied
sysctl net.core.somaxconn

Tip: Use sysctl -w net.core.somaxconn=65535 to test a value immediately without rebooting. Once you've verified it works, add it to the .conf file to make it persistent across reboots.

Verify Kernel Tuning is Working Correctly

# Verify applied settings
sysctl net.core.somaxconn
sysctl net.ipv4.tcp_fin_timeout

# Check file descriptor limits
ulimit -n
cat /proc/sys/fs/file-max

# View network statistics
ss -s
netstat -s | grep -E "overflow|fail|drop"

Tip: Use ss -s to view TCP connection summary showing the number of ESTABLISHED, TIME-WAIT, and CLOSE-WAIT connections. If you see a high number of TIME-WAIT connections, you should adjust tcp_fin_timeout and tcp_tw_reuse.

Common Issues & Troubleshooting

Error: "NMAP cannot set parameters" after sysctl -p

Some VPS providers prevent kernel parameter changes in containers (OpenVZ). You can check your virtualization type:

systemd-detect-virt
# If output shows "openvz", some parameters will fail but won't affect others

Network stops working after sysctl changes

Immediately rollback the parameter you just changed:

# Rollback a single parameter
sudo sysctl -w net.ipv4.tcp_tw_reuse=0

# Or reboot to reset everything (conf file will re-apply on next boot)
# If the conf file has errors, fix it before rebooting

ulimit not increasing even after editing limits.conf

You must log out and back in, or ensure the PAM module is configured:

# Check if pam_limits is enabled
grep pam_limits /etc/pam.d/common-session
# Should show:
session required pam_limits.so

Service still shows "Too many open files" after increasing ulimit

Services running under systemd have their own LimitNOFILE setting:

sudo nano /etc/systemd/system/nginx.service.d/override.conf
[Service]
LimitNOFILE=1048576
sudo systemctl daemon-reload && sudo systemctl restart nginx

Frequently Asked Questions

Do sysctl parameters reset after reboot?

Values set with sysctl -w directly will reset after reboot. To make them persistent, add them to files in /etc/sysctl.d/, which are applied automatically on every boot.

How does BBR TCP Congestion Control relate to sysctl?

BBR is a TCP congestion control algorithm developed by Google. It's enabled through sysctl settings like net.core.default_qdisc=fq and net.ipv4.tcp_congestion_control=bbr. See the TCP BBR article for more details.

What are the best sysctl values for all VPS?

There's no universal "best" value—it depends on your workload. Settings for a web server handling many short connections differ from a database server with fewer, longer-lived connections. Always benchmark before and after tuning to measure the impact.