TCP Fast Open (TFO) is one of the simplest latency optimizations you can enable on a VPS. A single kernel parameter and an Nginx directive can eliminate one full round trip from every repeat TCP connection \u2014 reducing page load times by 40\u201350 ms for users on a 50 ms RTT connection. This tutorial explains how TFO works, how to configure it on your server, and how to benchmark the results to confirm the improvement.<\/p>\n\n
A standard TCP connection requires a three-way handshake (SYN, SYN-ACK, ACK) before any application data can be sent. TFO modifies this by allowing the client to include data in the initial SYN packet \u2014 provided the client has a valid TFO cookie obtained from a previous connection. This collapses the handshake to zero extra round trips for repeat connections.<\/p>\n\n
The TFO cookie is a cryptographic token generated by the server and sent to the client during the first connection. The client stores the cookie and presents it in subsequent SYN packets. The server validates the cookie, and if valid, processes the data immediately without waiting for the ACK to complete the handshake. This is defined in RFC 7413 and has been part of the Linux kernel since version 3.7.<\/p>\n\n
The For a web server, set value 3 to enable both roles:<\/p>\n\n The server role (bit 2) is what allows incoming repeat connections to skip the handshake. The client role (bit 1) is useful if your VPS itself makes outbound connections \u2014 for example, to upstream APIs or external databases.<\/p>\n\n Nginx exposes TFO via the The queue size should be proportional to the number of concurrent connections your server handles. For a low-traffic VPS, 256 is sufficient. For busy servers, values up to 1024 are reasonable. The queue only stores TFO connections that arrive before the three-way handshake completes, so it does not need to match the full connection backlog.<\/p>\n\n Test the configuration and reload Nginx:<\/p>\n\n If you use Apache instead of Nginx, enable TFO through the Restart Apache: Do not trust the configuration alone \u2014 verify with kernel counters using the Generate test traffic and verify the counters increment:<\/p>\n\n Use curl’s timing output to measure the difference TFO makes on a per-connection basis. Run this benchmark from a client machine (not the server itself, since you want to measure real network latency):<\/p>\n\n The first request in each series will be similar (no cookie yet for the TFO run). Starting from the second request, the TFO series should show a measurable reduction in TFO reduces latency for new connections, but it does not affect throughput or congestion control. Pair it with BBR (Bottleneck Bandwidth and Round-trip propagation time) for a complete TCP optimization stack:<\/p>\n\n BBR does not rely on packet loss as a congestion signal, making it ideal for virtualized environments where packet loss may be artificially induced by the hypervisor. Combined with TFO, you get lower latency for new connections and better throughput for established ones.<\/p>\n\n TFO is not a silver bullet. It will not help in these scenarios:<\/p>\n\nnet.ipv4.tcp_fastopen<\/code> sysctl accepts a bitmask:<\/p>\n\n# Enable TFO for both client and server roles\necho \"net.ipv4.tcp_fastopen = 3\" | sudo tee \/etc\/sysctl.d\/99-tcp-fastopen.conf\nsudo sysctl --system\n\n# Verify\nsysctl net.ipv4.tcp_fastopen\n# Expected: net.ipv4.tcp_fastopen = 3<\/code><\/pre>\n\nStep 2: Configure TFO in Nginx<\/h2>\n\n
fastopen<\/code> parameter on the listen<\/code> directive. The numeric value is the pending-SYN queue size for TFO connections:<\/p>\n\nserver {\n listen 443 ssl http2 fastopen=256;\n listen 80 fastopen=256;\n server_name example.com;\n\n # ... rest of your Nginx configuration\n}<\/code><\/pre>\n\nsudo nginx -t\nsudo systemctl reload nginx<\/code><\/pre>\n\nStep 3: Configure TFO in Apache (Alternative)<\/h2>\n\n
AcceptFilter<\/code> directive:<\/p>\n\n# In \/etc\/apache2\/apache2.conf or a vhost file\nAcceptFilter https TCP_FASTOPEN\nAcceptFilter http TCP_FASTOPEN<\/code><\/pre>\n\nsudo systemctl restart apache2<\/code>.<\/p>\n\nStep 4: Verify TFO Is Working with Kernel Counters<\/h2>\n\n
nstat<\/code> tool:<\/p>\n\n# Watch TFO counters in real time\nwatch -n 2 'nstat -az | grep -i fastopen'<\/code><\/pre>\n\nCounter<\/th> Meaning<\/th> Expected Value<\/th><\/tr><\/thead> TCPFastOpenPassive<\/td> Inbound TFO connections accepted (server role)<\/td> Increases with traffic<\/td><\/tr> TCPFastOpenActive<\/td> Outbound TFO connections (client role)<\/td> Increases if client role is enabled<\/td><\/tr> TCPFastOpenFail<\/td> Cookie rejected or handshake failed<\/td> Should be near zero<\/td><\/tr> TCPFastOpenListenOverflow<\/td> TFO dropped because accept queue was full<\/td> Should be near zero; increase fastopen queue size if growing<\/td><\/tr><\/tbody><\/table><\/figure>\n\n # Reset counters\nnstat -rs\n\n# Generate TFO traffic from a client that supports it\ncurl --tcp-fastopen https:\/\/your-server.com\/\n\n# Check counters\nnstat -az | grep FastOpen<\/code><\/pre>\n\nStep 5: Benchmark the Latency Improvement<\/h2>\n\n
#!\/bin\/bash\n# tfo-benchmark.sh - Compare with and without TFO\nURL=\"https:\/\/your-server.com\/\"\n\necho \"=== Without TFO ===\"\nfor i in $(seq 1 10); do\n curl -s -o \/dev\/null -w \"Request $i: %{time_total}s\\n\" \"$URL\"\ndone\n\necho \"\"\necho \"=== With TFO ===\"\nfor i in $(seq 1 10); do\n curl --tcp-fastopen -s -o \/dev\/null -w \"Request $i: %{time_total}s\\n\" \"$URL\"\ndone<\/code><\/pre>\n\ntime_total<\/code>. On a VPS with 50 ms RTT to the client, expect a 40\u201350 ms reduction per request for repeat connections.<\/p>\n\nStep 6: Pair TFO with BBR for Maximum Effect<\/h2>\n\n
# Enable BBR congestion control\necho \"net.core.default_qdisc = fq\" | sudo tee \/etc\/sysctl.d\/99-bbr.conf\necho \"net.ipv4.tcp_congestion_control = bbr\" | sudo tee -a \/etc\/sysctl.d\/99-bbr.conf\nsudo sysctl --system\n\n# Verify\nsysctl net.ipv4.tcp_congestion_control\n# Expected: net.ipv4.tcp_congestion_control = bbr<\/code><\/pre>\n\nWhen TFO Does Not Help<\/h2>\n\n
Troubleshooting<\/h2>\n\n