echo "net.core.rmem_default = 8388608" >> /etc/sysctl.conf
echo "net.core.rmem_max = 16777216" >> /etc/sysctl.conf
echo "net.core.somaxconn = 32768" >> /etc/sysctl.conf
echo "net.core.wmem_default = 8388608" >> /etc/sysctl.conf
echo "net.core.wmem_max = 16777216" >> /etc/sysctl.conf
echo "net.ipv4.ip_local_port_range = 5000 65000" >> /etc/sysctl.conf
echo "net.ipv4.tcp_fin_timeout = 30" >> /etc/sysctl.conf
echo "net.ipv4.tcp_keepalive_time = 300" >> /etc/sysctl.conf
echo "net.ipv4.tcp_max_orphans = 3276800" >> /etc/sysctl.conf
echo "net.ipv4.tcp_max_syn_backlog = 65536" >> /etc/sysctl.conf
echo "net.ipv4.tcp_max_tw_buckets = 5000" >> /etc/sysctl.conf
echo "net.ipv4.tcp_mem = 94500000 915000000 927000000" >> /etc/sysctl.conf
echo "net.ipv4.tcp_syn_retries = 2" >> /etc/sysctl.conf
echo "net.ipv4.tcp_synack_retries = 2" >> /etc/sysctl.conf
echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
echo "net.ipv4.tcp_timestamps = 0" >> /etc/sysctl.conf
echo "net.ipv4.tcp_tw_recycle = 1" >> /etc/sysctl.conf
echo "net.ipv4.tcp_tw_reuse = 1" >> /etc/sysctl.conf
/sbin/sysctl -p
# modify core ulimt
echo -e "*tsofttnofilet65535" >> /etc/security/limits.conf
echo -e "*thardtnofilet65535" >> /etc/security/limits.conf
echo -e "*tsofttnofilet65535" >> /etc/security/limits.d/90-nproc.conf
echo -e "*thardtnofilet65535" >> /etc/security/limits.d/90-nproc.conf
# ntpd
cat > /etc/sysconfig/clock < /etc/sysconfig/iptables <<EOF
*filter
#############################################
# disabled (INPUT,FORWARD,OUTPUT)
:INPUT DROP
:FORWARD DROP
:OUTPUT DROP
# enabled lo
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A FORWARD -o lo -j ACCEPT
# enabled em2
# Be careful of the network adapter name
-A INPUT -i em2 -j ACCEPT
-A OUTPUT -o em2 -j ACCEPT
-A FORWARD -o em2 -j ACCEPT
# enabled ping
-A INPUT -p icmp -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
# enabled ntp
-A INPUT -p udp -m udp --dport 123 -j ACCEPT
-A OUTPUT -p udp -m udp --sport 123 -j ACCEPT
# dns
-A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
#############################################
#############################################
# team ssh
# all
-A INPUT -p tcp -m tcp --dport 3389 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 3389 -j ACCEPT
# suzhouqiao
-A INPUT -s 118.145.x.xx -p tcp -m tcp --dport 3389 -j ACCEPT
-A OUTPUT -d 118.145.x.xx -p tcp -m tcp --sport 3389 -j ACCEPT
