echo "net.ipv4.icmp_echo_ignore_all=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

sudo bash <<'SCRIPT'
[ "$(id -u)" -eq 0 ] || { echo "run as root"; exit 1; }

modprobe tcp_bbr 2>/dev/null
modprobe nf_conntrack 2>/dev/null
echo tcp_bbr > /etc/modules-load.d/bbr.conf
echo nf_conntrack > /etc/modules-load.d/conntrack.conf
echo "options nf_conntrack hashsize=262144" > /etc/modprobe.d/nf_conntrack.conf
echo 262144 > /sys/module/nf_conntrack/parameters/hashsize 2>/dev/null

sed -i "/# SNIPER SETTINGS/,/# END SNIPER/d" /etc/sysctl.conf

cat > /etc/sysctl.d/99-netshell.conf <<'EOF'
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
net.core.rmem_default = 262144
net.core.wmem_default = 262144
net.core.optmem_max = 65536
net.core.netdev_max_backlog = 65536
net.core.netdev_budget = 600
net.core.somaxconn = 65535
net.ipv4.tcp_rmem = 4096 131072 67108864
net.ipv4.tcp_wmem = 4096 65536 67108864
net.ipv4.udp_rmem_min = 16384
net.ipv4.udp_wmem_min = 16384
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.tcp_max_tw_buckets = 2000000
net.ipv4.tcp_max_orphans = 262144
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_syn_retries = 3
net.ipv4.tcp_synack_retries = 3
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.tcp_mtu_probing = 1
net.ipv4.tcp_notsent_lowat = 131072
net.ipv4.ip_local_port_range = 10240 65535
net.ipv4.ip_forward = 1
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_tcp_timeout_established = 7200
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 15
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 30
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 60
vm.swappiness = 10
vm.max_map_count = 524288
fs.file-max = 2097152
fs.nr_open = 2097152
EOF

sysctl --system >/dev/null

cat > /etc/security/limits.d/99-netshell.conf <<'EOF'
* soft nofile 1048576
* hard nofile 1048576
* soft nproc 65535
* hard nproc 65535
root soft nofile 1048576
root hard nofile 1048576
EOF

mkdir -p /etc/systemd/system.conf.d
cat > /etc/systemd/system.conf.d/99-netshell.conf <<'EOF'
[Manager]
DefaultLimitNOFILE=1048576
DefaultLimitNPROC=65535
EOF
systemctl daemon-reexec

IFACE=$(ip route show default | awk '{print $5; exit}')
[ -n "$IFACE" ] && tc qdisc replace dev "$IFACE" root fq 2>/dev/null

echo "cc:      $(sysctl -n net.ipv4.tcp_congestion_control)"
echo "qdisc:   $(sysctl -n net.core.default_qdisc)"
echo "conntrack max: $(sysctl -n net.netfilter.nf_conntrack_max 2>/dev/null)"
echo "done. reboot or restart your proxy services to apply new file limits."
SCRIPT