net.ipv4.ip_forward=1

# Ubuntu ships /usr/lib/sysctl.d/55-ipv6-privacy.conf with use_tempaddr=2
# (prefer rotating privacy addresses) system-wide. That default fought the
# WAN uplinks' need for one stable IPv6 source address per interface (hbc,
# DNS, van-failover all key off it) — a long-lived flow using a source
# address that later got deprecated mid-flight looked like random upstream
# packet loss and cost a day of packet-capture debugging (2026-07-12/13)
# before the cause turned out to be this file loading before ours. 99- beats
# 55- lexically so this wins the second `sysctl --system` re-reads it.
net.ipv6.conf.all.use_tempaddr=0
net.ipv6.conf.default.use_tempaddr=0