diff --git a/group_vars/vps/sysctl.yml b/group_vars/vps/sysctl.yml
index 1ffb606..88aea33 100644
--- a/group_vars/vps/sysctl.yml
+++ b/group_vars/vps/sysctl.yml
@@ -15,6 +15,7 @@ sysctl_params:
   - { key: net.ipv4.tcp_window_scaling,        value: "1" }
   - { key: net.core.default_qdisc,             value: "fq" }
   - { key: net.ipv4.tcp_congestion_control,    value: "bbr" }
+  - { key: net.ipv4.tcp_no_metrics_save,       value: "0" }
   - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" }
   - { key: net.ipv4.tcp_fastopen,              value: "3" }
   - { key: net.core.netdev_max_backlog,        value: "16384" }
diff --git a/roles/sysctl/defaults/main.yml b/roles/sysctl/defaults/main.yml
index faa4bf4..ac69319 100644
--- a/roles/sysctl/defaults/main.yml
+++ b/roles/sysctl/defaults/main.yml
@@ -1,5 +1,5 @@
 ---
-# Default-Sysctl-Werte fuer Streaming-VMs.
+# Default-Sysctl-Werte fuer Streaming-VMs und den WireGuard-Medienpfad.
 # Pro Host/Gruppe ueberschreibbar via group_vars/host_vars (z.B. group_vars/vps).
 sysctl_params:
   - { key: net.core.rmem_default,              value: "262144" }
@@ -9,7 +9,9 @@ sysctl_params:
   - { key: net.ipv4.tcp_rmem,                  value: "4096 87380 67108864" }
   - { key: net.ipv4.tcp_wmem,                  value: "4096 65536 67108864" }
   - { key: net.ipv4.tcp_window_scaling,        value: "1" }
+  - { key: net.core.default_qdisc,             value: "fq" }
   - { key: net.ipv4.tcp_congestion_control,    value: "bbr" }
+  - { key: net.ipv4.tcp_no_metrics_save,       value: "0" }
   - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" }
   - { key: net.ipv4.tcp_fastopen,              value: "3" }
   - { key: net.core.netdev_max_backlog,        value: "16384" }
diff --git a/roles/sysctl/tasks/main.yml b/roles/sysctl/tasks/main.yml
index 3563613..60a17d6 100644
--- a/roles/sysctl/tasks/main.yml
+++ b/roles/sysctl/tasks/main.yml
@@ -10,7 +10,31 @@
     dest: /etc/modules-load.d/bbr.conf
     mode: "0644"
 
-- name: Sysctl Parameter setzen
+- name: Legacy-Sysctl-Dateien pruefen
+  ansible.builtin.stat:
+    path: "{{ item }}"
+  loop:
+    - /etc/sysctl.conf
+    - /etc/sysctl.d/99-streaming.conf
+  register: legacy_sysctl_files
+
+- name: Verwaltete Werte aus Legacy sysctl.conf entfernen
+  ansible.builtin.lineinfile:
+    path: /etc/sysctl.conf
+    regexp: "^[ \\t]*{{ item.key | regex_escape }}[ \\t]*="
+    state: absent
+  loop: "{{ sysctl_params }}"
+  when: legacy_sysctl_files.results[0].stat.exists
+
+- name: Verwaltete Werte aus Legacy 99-streaming.conf entfernen
+  ansible.builtin.lineinfile:
+    path: /etc/sysctl.d/99-streaming.conf
+    regexp: "^[ \\t]*{{ item.key | regex_escape }}[ \\t]*="
+    state: absent
+  loop: "{{ sysctl_params }}"
+  when: legacy_sysctl_files.results[1].stat.exists
+
+- name: Sysctl Parameter kanonisch setzen
   ansible.posix.sysctl:
     name: "{{ item.key }}"
     value: "{{ item.value }}"
diff --git a/roles/sysctl_proxmox/tasks/main.yml b/roles/sysctl_proxmox/tasks/main.yml
index 70bf05a..6b9bbf8 100644
--- a/roles/sysctl_proxmox/tasks/main.yml
+++ b/roles/sysctl_proxmox/tasks/main.yml
@@ -42,14 +42,7 @@
     - { key: fs.file-max,                        value: "9999999" }
     - { key: fs.inotify.max_user_watches,        value: "524288" }
     - { key: fs.inotify.max_user_instances,       value: "512" }
-    - { key: net.ipv4.ip_forward,                value: "1" }
-    - { key: net.ipv6.conf.all.forwarding,       value: "1" }
     - { key: net.bridge.bridge-nf-call-iptables, value: "0" }
     - { key: net.bridge.bridge-nf-call-ip6tables, value: "0" }
     - { key: vm.dirty_expire_centisecs,          value: "3000" }
     - { key: vm.dirty_writeback_centisecs,       value: "500" }
-    - { key: net.ipv4.tcp_mtu_probing,           value: "1" }
-    - { key: net.core.rmem_max,                  value: "67108864" }
-    - { key: net.core.wmem_max,                  value: "67108864" }
-    - { key: net.ipv4.tcp_rmem,                  value: "4096 87380 67108864" }
-    - { key: net.ipv4.tcp_wmem,                  value: "4096 65536 67108864" }
diff --git a/sysctl-proxmox.yaml b/sysctl-proxmox.yaml
index 3f9ad2d..ff391b8 100644
--- a/sysctl-proxmox.yaml
+++ b/sysctl-proxmox.yaml
@@ -3,4 +3,5 @@
   hosts: proxmox
   become: yes
   roles:
+    - sysctl
     - sysctl_proxmox
diff --git a/tests/test_sysctl_role.py b/tests/test_sysctl_role.py
new file mode 100644
index 0000000..3be0742
--- /dev/null
+++ b/tests/test_sysctl_role.py
@@ -0,0 +1,34 @@
+from pathlib import Path
+import unittest
+
+ROOT = Path(__file__).parents[1]
+
+
+class SysctlRoleContract(unittest.TestCase):
+    def test_canonical_streaming_profile_keeps_64mib_and_bbr_fq(self):
+        text = (ROOT / "roles/sysctl/defaults/main.yml").read_text()
+        self.assertIn("net.core.rmem_max", text)
+        self.assertIn('value: "67108864"', text)
+        self.assertIn("net.core.default_qdisc", text)
+        self.assertIn("net.ipv4.tcp_congestion_control", text)
+        self.assertIn("net.ipv4.tcp_no_metrics_save", text)
+
+    def test_role_removes_managed_keys_from_legacy_sources(self):
+        text = (ROOT / "roles/sysctl/tasks/main.yml").read_text()
+        self.assertIn("/etc/sysctl.conf", text)
+        self.assertIn("/etc/sysctl.d/99-streaming.conf", text)
+        self.assertIn("state: absent", text)
+        self.assertIn("regex_escape", text)
+
+    def test_proxmox_tuning_runs_canonical_network_role_first(self):
+        play = (ROOT / "sysctl-proxmox.yaml").read_text()
+        self.assertLess(play.index("- sysctl\n"), play.index("- sysctl_proxmox"))
+
+    def test_proxmox_role_does_not_duplicate_canonical_network_keys(self):
+        text = (ROOT / "roles/sysctl_proxmox/tasks/main.yml").read_text()
+        for key in ("net.core.rmem_max", "net.core.wmem_max", "net.ipv4.tcp_rmem", "net.ipv4.tcp_wmem", "net.ipv4.tcp_mtu_probing"):
+            self.assertNotIn(key, text)
+
+
+if __name__ == "__main__":
+    unittest.main()