diff --git a/config/default.nix b/config/default.nix
index 2d5c0a1f..5e191634 100644
--- a/config/default.nix
+++ b/config/default.nix
@@ -21,6 +21,9 @@
       # reset 60 seconds after a kernel panic
       "kernel.panic" = 60;
       "net.ipv4.tcp_congestion_control" = "bbr";
+      # enable tcp fastopen for outgoing and incoming connections
+      # used by haproxy and nginx
+      "net.ipv4.tcp_fastopen" = 3;
     };
     # recommend to turn off, only on by default for backwards compatibility
     zfs.forceImportRoot = false;