02-kernel-optimize.sh

#!/usr/bin/env bash
# ============================================================================
# Phase 2: Kernel Optimization for High Latency & Throughput
# Enterprise WireGuard Deployment - Ubuntu 24.04 (Oracle Cloud Free Tier)
# ============================================================================
# This script:
#   - Enables TCP BBR congestion control
#   - Enables IPv4 and IPv6 packet forwarding
#   - Applies network performance tuning for intercontinental links
#   - Persists all settings via /etc/sysctl.d/
# ============================================================================

set -euo pipefail

# ── Colors ──────────────────────────────────────────────────────────────────
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m'

log()  { echo -e "${GREEN}[✓]${NC} $*"; }
warn() { echo -e "${YELLOW}[!]${NC} $*"; }
err()  { echo -e "${RED}[✗]${NC} $*" >&2; }
info() { echo -e "${CYAN}[i]${NC} $*"; }

# ── Preflight ───────────────────────────────────────────────────────────────
if [[ $EUID -ne 0 ]]; then
    err "This script must be run as root (or via sudo)."
    exit 1
fi

echo ""
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║     Phase 2: Kernel Optimization for High Throughput       ║"
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""

# ── Step 1: Enable BBR Module ──────────────────────────────────────────────
log "Loading TCP BBR kernel module..."
modprobe tcp_bbr 2>/dev/null || true

# Ensure BBR module loads at boot
if ! grep -q "tcp_bbr" /etc/modules-load.d/modules.conf 2>/dev/null; then
    echo "tcp_bbr" >> /etc/modules-load.d/modules.conf
fi
log "TCP BBR module loaded."

# ── Step 2: Create Sysctl Configuration ────────────────────────────────────
log "Writing kernel optimization parameters..."

SYSCTL_CONF="/etc/sysctl.d/99-wireguard-optimized.conf"

cat > "${SYSCTL_CONF}" <<'EOF'
# ============================================================================
# Kernel Network Optimization - Enterprise WireGuard Deployment
# Tuned for high-latency, intercontinental VPN routing
# ============================================================================

# ─── TCP BBR Congestion Control ─────────────────────────────────────────────
# BBR (Bottleneck Bandwidth and Round-trip propagation time) is Google's
# congestion control algorithm. It significantly outperforms CUBIC on
# high-latency links by modeling the network path rather than reacting
# to packet loss.
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# ─── IP Forwarding (Required for VPN Routing) ──────────────────────────────
# The server must act as a router, forwarding packets between the WireGuard
# tunnel interface (wg0) and the public interface (e.g., ens3/eth0).
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

# ─── TCP Performance Tuning ────────────────────────────────────────────────
# Increase socket buffer sizes for high-bandwidth, high-latency links.
# These values allow the kernel to buffer more data in transit, which is
# critical when RTT exceeds 100ms (intercontinental).

# Default and max socket receive buffer (16 MB max)
net.core.rmem_default = 1048576
net.core.rmem_max = 16777216

# Default and max socket send buffer (16 MB max)
net.core.wmem_default = 1048576
net.core.wmem_max = 16777216

# TCP memory tuning (min, pressure, max) in pages (4KB each)
# min=4MB, pressure=8MB, max=16MB per socket
net.ipv4.tcp_rmem = 4096 1048576 16777216
net.ipv4.tcp_wmem = 4096 1048576 16777216

# Increase the maximum number of queued connections
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535

# ─── TCP Hardening & Optimization ──────────────────────────────────────────
# Enable TCP SYN cookies (SYN flood protection)
net.ipv4.tcp_syncookies = 1

# Enable TCP window scaling (required for large windows on high-latency links)
net.ipv4.tcp_window_scaling = 1

# Enable TCP timestamps (improves RTT estimation and PAWS)
net.ipv4.tcp_timestamps = 1

# Enable Selective Acknowledgments (SACK) for better loss recovery
net.ipv4.tcp_sack = 1

# Reduce TCP FIN timeout (free sockets faster)
net.ipv4.tcp_fin_timeout = 15

# Reduce keepalive time (detect dead connections faster)
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_keepalive_probes = 5

# Enable TCP Fast Open (both client and server)
net.ipv4.tcp_fastopen = 3

# Maximum orphaned sockets
net.ipv4.tcp_max_orphans = 262144

# Maximum SYN backlog
net.ipv4.tcp_max_syn_backlog = 65535

# Reuse TIME_WAIT sockets for new connections when safe
net.ipv4.tcp_tw_reuse = 1

# ─── ICMP Hardening ────────────────────────────────────────────────────────
# Ignore ICMP broadcast requests (smurf attack protection)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Ignore bogus ICMP error responses
net.ipv4.icmp_ignore_bogus_error_responses = 1

# ─── Reverse Path Filtering ────────────────────────────────────────────────
# Loose mode (2) is required when routing VPN traffic; strict mode (1)
# would drop packets arriving on the "wrong" interface.
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 2

# ─── Disable Source Routing ─────────────────────────────────────────────────
# Prevent attackers from specifying the route packets should take.
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# ─── Disable ICMP Redirects ────────────────────────────────────────────────
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# ─── Connection Tracking (for NAT) ─────────────────────────────────────────
# Increase conntrack table size for handling many VPN clients
net.netfilter.nf_conntrack_max = 262144

# ─── UDP Optimization (WireGuard + Hysteria 2) ─────────────────────────────
# WireGuard runs over UDP — these buffers are critical for high-throughput
# tunneling on intercontinental links (Kenya → USA/Canada ~250ms RTT).
net.core.rmem_max = 26214400
net.core.wmem_max = 26214400
net.ipv4.udp_rmem_min = 8192
net.ipv4.udp_wmem_min = 8192
net.ipv4.udp_mem = 65536 131072 262144

# ─── Intercontinental Link Tuning ──────────────────────────────────────────
# For high-latency paths (>200ms RTT), increase max TCP window
# BDP = 100 Mbps × 0.25s = 3.125 MB — need buffers well above this
net.ipv4.tcp_rmem = 4096 1048576 26214400
net.ipv4.tcp_wmem = 4096 1048576 26214400

# Reduce conntrack timeouts to free entries faster under load
net.netfilter.nf_conntrack_tcp_timeout_established = 7200
net.netfilter.nf_conntrack_udp_timeout = 60
net.netfilter.nf_conntrack_udp_timeout_stream = 120

# Disable ECN (some middleboxes on intercontinental paths drop ECN packets)
net.ipv4.tcp_ecn = 0
EOF

# ── Step 3: Apply Sysctl Settings ──────────────────────────────────────────
log "Applying sysctl parameters..."
sysctl --system > /dev/null 2>&1
log "Sysctl parameters applied."

# ── Step 4: Verify Critical Settings ──────────────────────────────────────
echo ""
info "Verifying critical kernel parameters..."
echo ""

# Check BBR
CURRENT_CC=$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null)
if [[ "${CURRENT_CC}" == "bbr" ]]; then
    log "TCP Congestion Control: ${CURRENT_CC} ✓"
else
    err "TCP Congestion Control: ${CURRENT_CC} (expected: bbr)"
fi

# Check qdisc
CURRENT_QDISC=$(sysctl -n net.core.default_qdisc 2>/dev/null)
if [[ "${CURRENT_QDISC}" == "fq" ]]; then
    log "Queue Discipline:       ${CURRENT_QDISC} ✓"
else
    err "Queue Discipline:       ${CURRENT_QDISC} (expected: fq)"
fi

# Check IPv4 forwarding
IPV4_FWD=$(sysctl -n net.ipv4.ip_forward 2>/dev/null)
if [[ "${IPV4_FWD}" == "1" ]]; then
    log "IPv4 Forwarding:        enabled ✓"
else
    err "IPv4 Forwarding:        disabled"
fi

# Check IPv6 forwarding
IPV6_FWD=$(sysctl -n net.ipv6.conf.all.forwarding 2>/dev/null)
if [[ "${IPV6_FWD}" == "1" ]]; then
    log "IPv6 Forwarding:        enabled ✓"
else
    warn "IPv6 Forwarding:        disabled (may not be needed)"
fi

# List available congestion control algorithms
echo ""
info "Available CC algorithms: $(sysctl -n net.ipv4.tcp_available_congestion_control 2>/dev/null)"

# ── Summary ─────────────────────────────────────────────────────────────────
echo ""
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║          Phase 2 Complete: Kernel Optimized                ║"
echo "╠══════════════════════════════════════════════════════════════╣"
echo "║                                                            ║"
echo "║  TCP BBR:          ENABLED                                 ║"
echo "║  Queue Discipline: fq (Fair Queueing)                      ║"
echo "║  IPv4 Forwarding:  ENABLED                                 ║"
echo "║  IPv6 Forwarding:  ENABLED                                 ║"
echo "║  Buffer Sizes:     Optimized (16MB max)                    ║"
echo "║  Conntrack:        262144 entries                          ║"
echo "║  Security:         SYN cookies, no redirects, no src-route ║"
echo "║                                                            ║"
echo "║  Config: /etc/sysctl.d/99-wireguard-optimized.conf         ║"
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""