生产环境 Nginx 反向代理与 Linux TCP 内核参数调优指南

upstream backend_service {
    server 10.10.2.11:8080 max_fails=3 fail_timeout=10s;
    server 10.10.2.12:8080 max_fails=3 fail_timeout=10s;

    # 每个 Worker 进程缓存的最大空闲长连接数
    keepalive 256;
    # 单个长连接最大复用请求次数
    keepalive_requests 10000;
    # 空闲长连接保持时长（需略小于后端服务的 idleTimeout，避免后端主动断连引发 502）
    keepalive_timeout 55s;
}

server {
    listen 80 reuseport backlog=16384;
    server_name api.example.com;

    location / {
        proxy_pass http://backend_service;
        # 必须显式指定 HTTP/1.1 并清空 Connection 头，否则默认发送 Connection: close
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_connect_timeout 2s;
        proxy_read_timeout 10s;
        proxy_send_timeout 5s;
    }
}

# 查看全连接队列溢出次数
netstat -s | grep -E "listen|SYNs"
# 输出示例：
# 1428 times the listen queue of a socket overflowed
# 1428 SYNs to LISTEN sockets dropped

# 查看具体监听端口的 Recv-Q（当前待 accept 队列长度）与 Send-Q（最大队列上限）
ss -lnt

# 放大监听套接字全连接队列与半连接队列上限
net.core.somaxconn = 32768
net.ipv4.tcp_max_syn_backlog = 32768
net.core.netdev_max_backlog = 32768

# 扩大本地临时端口可用范围
net.ipv4.ip_local_port_range = 10240 65535

# 允许将处于 TIME_WAIT 状态的 socket 安全复用于新的出向连接（仅对客户端/代理出向连接生效）
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_tw_buckets = 262144

# 缩短 FIN_WAIT_2 超时时间
net.ipv4.tcp_fin_timeout = 15

# 开启 SYN Cookies 防范突发 SYN Flood 占满半连接队列
net.ipv4.tcp_syncookies = 1