net.ipv4.ip_forward=1

# Ubuntu ships /usr/lib/sysctl.d/55-ipv6-privacy.conf with use_tempaddr=2
# (prefer rotating privacy addresses) system-wide. The WAN uplinks need one
# stable IPv6 source per interface: address churn at boot (this default plus
# the dracut networkd catch-all deploy.sh masks) poisoned upstream per-flow
# state for long-lived UDP flows created mid-churn — see the 2026-07-12/13
# "wan IPv6 overdue" investigation. 99- beats 55- lexically so this wins
# when `sysctl --system` runs.
net.ipv6.conf.all.use_tempaddr=0
net.ipv6.conf.default.use_tempaddr=0