I made good experiences by tweaking sysctl values at tiny relays (1 GB RAM, 1 vCPU) and do wonder about your opion/experiences: $ ssh i30 cat /etc/sysctl.d/21firewall.conf # maintained by Ansible net.ipv4.tcp_fin_timeout = 10 net.ipv4.tcp_keepalive_time = 120 net.ipv4.tcp_max_syn_backlog = 8192 net.ipv4.tcp_mem = 2000 4000 8000 net.ipv4.tcp_synack_retries = 2 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_tw_reuse = 1 net.ipv6.ip_nonlocal_bind = 1 net.netfilter.nf_conntrack_tcp_timeout_close_wait = 10 net.netfilter.nf_conntrack_tcp_timeout_established = 600 net.netfilter.nf_conntrack_tcp_timeout_time_wait = 10 net.core.netdev_max_backlog = 131072 net.core.somaxconn = 16384 net.ipv4.tcp_max_syn_backlog = 131072 net.ipv4.tcp_notsent_lowat = 131072 net.netfilter.nf_conntrack_buckets = 131072 net.netfilter.nf_conntrack_max = 131072 -- Toralf