Setting Linux kernel parameters with sysctl: runtime changes versus /etc/sysctl.d

Goal

Change a kernel parameter both immediately and persistently, and know which of several configuration files actually took effect.

Prerequisites

Root access; the parameter name in /proc/sys/ notation (dots), e.g. net.ipv4.ip_forward.

Steps

1. Read the current value: sysctl net.ipv4.ip_forward (equivalently cat /proc/sys/net/ipv4/ip_forward).
2. Change it immediately, without persistence: sysctl -w net.ipv4.ip_forward=1. This is lost on reboot.
3. For a durable change, create a drop-in file rather than editing a shared file directly: /etc/sysctl.d/99-ip-forward.conf containing net.ipv4.ip_forward = 1.
4. Know the load order: files from /etc/sysctl.d/, /run/sysctl.d/ and /usr/lib/sysctl.d/ are merged and applied sorted by file name, regardless of directory; a file in /etc/ replaces a file of the same name in /run/ or /usr/lib/. When two files set the same key, the one applied later (higher in the sort order) wins, so a 99- prefix places a setting after distribution defaults such as 50-default.conf. With procps sysctl --system, /etc/sysctl.conf is read after the drop-in directories.
5. Apply every configured file at once, as at boot: sysctl --system. It prints each file it reads in the order applied, which doubles as a way to see what would win.
6. Verify the persisted value survived a reboot, or simulate it by re-running sysctl --system and re-reading the value: sysctl net.ipv4.ip_forward.

Expected result

sysctl --system lists the new drop-in file among those applied, and sysctl net.ipv4.ip_forward returns the intended value both immediately and after a reboot.

Limits and test basis

Based on sysctl.d(5) and sysctl(8). To undo, delete the drop-in file and either reboot or manually restore the previous value with sysctl -w; sysctl --system does not remove settings that were already applied and then dropped from a file, since the kernel does not reset parameters back to their compiled-in defaults automatically. Some parameters (particularly under net.ipv4.conf.* for already-configured interfaces) may need the interface to be recreated to fully take effect.