Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | # |
| 2 | # Network configuration |
| 3 | # |
| 4 | |
Sam Ravnborg | d5950b4 | 2005-07-11 21:03:49 -0700 | [diff] [blame] | 5 | menu "Networking" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 6 | |
| 7 | config NET |
| 8 | bool "Networking support" |
| 9 | ---help--- |
| 10 | Unless you really know what you are doing, you should say Y here. |
| 11 | The reason is that some programs need kernel networking support even |
| 12 | when running on a stand-alone machine that isn't connected to any |
Sam Ravnborg | d5950b4 | 2005-07-11 21:03:49 -0700 | [diff] [blame] | 13 | other computer. |
| 14 | |
| 15 | If you are upgrading from an older kernel, you |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 16 | should consider updating your networking tools too because changes |
| 17 | in the kernel and the tools often go hand in hand. The tools are |
| 18 | contained in the package net-tools, the location and version number |
| 19 | of which are given in <file:Documentation/Changes>. |
| 20 | |
| 21 | For a general introduction to Linux networking, it is highly |
| 22 | recommended to read the NET-HOWTO, available from |
| 23 | <http://www.tldp.org/docs.html#howto>. |
| 24 | |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 25 | # Make sure that all config symbols are dependent on NET |
| 26 | if NET |
| 27 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 28 | menu "Networking options" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 29 | |
Eric W. Biederman | 9dd776b | 2007-09-26 22:04:26 -0700 | [diff] [blame] | 30 | config NET_NS |
| 31 | bool "Network namespace support" |
| 32 | default n |
| 33 | depends on EXPERIMENTAL && !SYSFS |
| 34 | help |
| 35 | Allow user space to create what appear to be multiple instances |
| 36 | of the network stack. |
| 37 | |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 38 | source "net/packet/Kconfig" |
| 39 | source "net/unix/Kconfig" |
| 40 | source "net/xfrm/Kconfig" |
Martin Schwidefsky | 2356f4c | 2007-02-08 13:37:42 -0800 | [diff] [blame] | 41 | source "net/iucv/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 42 | |
| 43 | config INET |
| 44 | bool "TCP/IP networking" |
| 45 | ---help--- |
| 46 | These are the protocols used on the Internet and on most local |
| 47 | Ethernets. It is highly recommended to say Y here (this will enlarge |
| 48 | your kernel by about 144 KB), since some programs (e.g. the X window |
| 49 | system) use TCP/IP even if your machine is not connected to any |
| 50 | other computer. You will get the so-called loopback device which |
| 51 | allows you to ping yourself (great fun, that!). |
| 52 | |
| 53 | For an excellent introduction to Linux networking, please read the |
| 54 | Linux Networking HOWTO, available from |
| 55 | <http://www.tldp.org/docs.html#howto>. |
| 56 | |
| 57 | If you say Y here and also to "/proc file system support" and |
| 58 | "Sysctl support" below, you can change various aspects of the |
| 59 | behavior of the TCP/IP code by writing to the (virtual) files in |
| 60 | /proc/sys/net/ipv4/*; the options are explained in the file |
| 61 | <file:Documentation/networking/ip-sysctl.txt>. |
| 62 | |
| 63 | Short answer: say Y. |
| 64 | |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 65 | if INET |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 66 | source "net/ipv4/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 67 | source "net/ipv6/Kconfig" |
Paul Moore | 38c9437 | 2006-11-05 16:44:06 -0800 | [diff] [blame] | 68 | source "net/netlabel/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 69 | |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 70 | endif # if INET |
| 71 | |
James Morris | 984bc16 | 2006-06-09 00:29:17 -0700 | [diff] [blame] | 72 | config NETWORK_SECMARK |
| 73 | bool "Security Marking" |
| 74 | help |
| 75 | This enables security marking of network packets, similar |
| 76 | to nfmark, but designated for security purposes. |
| 77 | If you are unsure how to answer this question, answer N. |
| 78 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 79 | menuconfig NETFILTER |
Pablo Neira Ayuso | ef91fd5 | 2006-11-29 02:35:43 +0100 | [diff] [blame] | 80 | bool "Network packet filtering framework (Netfilter)" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 81 | ---help--- |
| 82 | Netfilter is a framework for filtering and mangling network packets |
| 83 | that pass through your Linux box. |
| 84 | |
| 85 | The most common use of packet filtering is to run your Linux box as |
| 86 | a firewall protecting a local network from the Internet. The type of |
| 87 | firewall provided by this kernel support is called a "packet |
| 88 | filter", which means that it can reject individual network packets |
| 89 | based on type, source, destination etc. The other kind of firewall, |
| 90 | a "proxy-based" one, is more secure but more intrusive and more |
| 91 | bothersome to set up; it inspects the network traffic much more |
| 92 | closely, modifies it and has knowledge about the higher level |
| 93 | protocols, which a packet filter lacks. Moreover, proxy-based |
| 94 | firewalls often require changes to the programs running on the local |
| 95 | clients. Proxy-based firewalls don't need support by the kernel, but |
| 96 | they are often combined with a packet filter, which only works if |
| 97 | you say Y here. |
| 98 | |
| 99 | You should also say Y here if you intend to use your Linux box as |
| 100 | the gateway to the Internet for a local network of machines without |
| 101 | globally valid IP addresses. This is called "masquerading": if one |
| 102 | of the computers on your local network wants to send something to |
| 103 | the outside, your box can "masquerade" as that computer, i.e. it |
| 104 | forwards the traffic to the intended outside destination, but |
| 105 | modifies the packets to make it look like they came from the |
| 106 | firewall box itself. It works both ways: if the outside host |
| 107 | replies, the Linux box will silently forward the traffic to the |
| 108 | correct local computer. This way, the computers on your local net |
| 109 | are completely invisible to the outside world, even though they can |
| 110 | reach the outside and can receive replies. It is even possible to |
| 111 | run globally visible servers from within a masqueraded local network |
| 112 | using a mechanism called portforwarding. Masquerading is also often |
| 113 | called NAT (Network Address Translation). |
| 114 | |
| 115 | Another use of Netfilter is in transparent proxying: if a machine on |
| 116 | the local network tries to connect to an outside host, your Linux |
| 117 | box can transparently forward the traffic to a local server, |
| 118 | typically a caching proxy server. |
| 119 | |
| 120 | Yet another use of Netfilter is building a bridging firewall. Using |
| 121 | a bridge with Network packet filtering enabled makes iptables "see" |
| 122 | the bridged traffic. For filtering on the lower network and Ethernet |
| 123 | protocols over the bridge, use ebtables (under bridge netfilter |
| 124 | configuration). |
| 125 | |
| 126 | Various modules exist for netfilter which replace the previous |
| 127 | masquerading (ipmasqadm), packet filtering (ipchains), transparent |
| 128 | proxying, and portforwarding mechanisms. Please see |
| 129 | <file:Documentation/Changes> under "iptables" for the location of |
| 130 | these packages. |
| 131 | |
| 132 | Make sure to say N to "Fast switching" below if you intend to say Y |
| 133 | here, as Fast switching currently bypasses netfilter. |
| 134 | |
| 135 | Chances are that you should say Y here if you compile a kernel which |
| 136 | will run as a router and N for regular hosts. If unsure, say N. |
| 137 | |
| 138 | if NETFILTER |
| 139 | |
| 140 | config NETFILTER_DEBUG |
| 141 | bool "Network packet filtering debugging" |
| 142 | depends on NETFILTER |
| 143 | help |
| 144 | You can say Y here if you want to get additional messages useful in |
| 145 | debugging the netfilter code. |
| 146 | |
Patrick McHardy | 33b8e77 | 2007-12-17 22:47:05 -0800 | [diff] [blame^] | 147 | config NETFILTER_ADVANCED |
| 148 | bool "Advanced netfilter configuration" |
| 149 | depends on NETFILTER |
| 150 | default y |
| 151 | help |
| 152 | If you say Y here you can select between all the netfilter modules. |
| 153 | If you say N the more ununsual ones will not be shown and the |
| 154 | basic ones needed by most people will default to 'M'. |
| 155 | |
| 156 | If unsure, say Y. |
| 157 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 158 | config BRIDGE_NETFILTER |
| 159 | bool "Bridged IP/ARP packets filtering" |
| 160 | depends on BRIDGE && NETFILTER && INET |
Patrick McHardy | 33b8e77 | 2007-12-17 22:47:05 -0800 | [diff] [blame^] | 161 | depends on NETFILTER_ADVANCED |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 162 | default y |
| 163 | ---help--- |
| 164 | Enabling this option will let arptables resp. iptables see bridged |
| 165 | ARP resp. IP traffic. If you want a bridging firewall, you probably |
| 166 | want this option enabled. |
| 167 | Enabling or disabling this option doesn't enable or disable |
| 168 | ebtables. |
| 169 | |
| 170 | If unsure, say N. |
| 171 | |
Harald Welte | 9eb0eec | 2005-09-17 00:41:21 -0700 | [diff] [blame] | 172 | source "net/netfilter/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 173 | source "net/ipv4/netfilter/Kconfig" |
| 174 | source "net/ipv6/netfilter/Kconfig" |
| 175 | source "net/decnet/netfilter/Kconfig" |
| 176 | source "net/bridge/netfilter/Kconfig" |
| 177 | |
| 178 | endif |
| 179 | |
Arnaldo Carvalho de Melo | 7c65787 | 2005-08-09 20:14:34 -0700 | [diff] [blame] | 180 | source "net/dccp/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 181 | source "net/sctp/Kconfig" |
Per Liden | 1e63e68 | 2006-01-16 16:39:13 +0100 | [diff] [blame] | 182 | source "net/tipc/Kconfig" |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 183 | source "net/atm/Kconfig" |
| 184 | source "net/bridge/Kconfig" |
| 185 | source "net/8021q/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 186 | source "net/decnet/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 187 | source "net/llc/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 188 | source "net/ipx/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 189 | source "drivers/net/appletalk/Kconfig" |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 190 | source "net/x25/Kconfig" |
| 191 | source "net/lapb/Kconfig" |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 192 | source "net/econet/Kconfig" |
| 193 | source "net/wanrouter/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 194 | source "net/sched/Kconfig" |
| 195 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 196 | menu "Network testing" |
| 197 | |
| 198 | config NET_PKTGEN |
| 199 | tristate "Packet Generator (USE WITH CAUTION)" |
| 200 | depends on PROC_FS |
| 201 | ---help--- |
| 202 | This module will inject preconfigured packets, at a configurable |
| 203 | rate, out of a given interface. It is used for network interface |
| 204 | stress testing and performance analysis. If you don't understand |
| 205 | what was just said, you don't need it: say N. |
| 206 | |
| 207 | Documentation on how to use the packet generator can be found |
| 208 | at <file:Documentation/networking/pktgen.txt>. |
| 209 | |
| 210 | To compile this code as a module, choose M here: the |
| 211 | module will be called pktgen. |
| 212 | |
Stephen Hemminger | a42e9d6 | 2006-06-05 17:30:32 -0700 | [diff] [blame] | 213 | config NET_TCPPROBE |
| 214 | tristate "TCP connection probing" |
| 215 | depends on INET && EXPERIMENTAL && PROC_FS && KPROBES |
| 216 | ---help--- |
| 217 | This module allows for capturing the changes to TCP connection |
Dave Jones | 9dadaa19 | 2006-06-08 23:42:09 -0700 | [diff] [blame] | 218 | state in response to incoming packets. It is used for debugging |
Stephen Hemminger | a42e9d6 | 2006-06-05 17:30:32 -0700 | [diff] [blame] | 219 | TCP congestion avoidance modules. If you don't understand |
| 220 | what was just said, you don't need it: say N. |
| 221 | |
Grant Grundler | 82fe7c9 | 2006-09-25 23:47:14 -0700 | [diff] [blame] | 222 | Documentation on how to use TCP connection probing can be found |
Stephen Hemminger | a42e9d6 | 2006-06-05 17:30:32 -0700 | [diff] [blame] | 223 | at http://linux-net.osdl.org/index.php/TcpProbe |
| 224 | |
| 225 | To compile this code as a module, choose M here: the |
| 226 | module will be called tcp_probe. |
| 227 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 228 | endmenu |
| 229 | |
| 230 | endmenu |
| 231 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 232 | source "net/ax25/Kconfig" |
Oliver Hartkopp | 0d66548 | 2007-11-16 15:52:17 -0800 | [diff] [blame] | 233 | source "net/can/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 234 | source "net/irda/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 235 | source "net/bluetooth/Kconfig" |
David Howells | 17926a7 | 2007-04-26 15:48:28 -0700 | [diff] [blame] | 236 | source "net/rxrpc/Kconfig" |
Adrian Bunk | d86b5e0 | 2006-01-21 00:46:55 +0100 | [diff] [blame] | 237 | |
Thomas Graf | 14c0b97 | 2006-08-04 03:38:38 -0700 | [diff] [blame] | 238 | config FIB_RULES |
| 239 | bool |
| 240 | |
Johannes Berg | 2a5e1c0 | 2007-04-23 12:19:12 -0700 | [diff] [blame] | 241 | menu "Wireless" |
Martin Schwidefsky | f54bfc0 | 2007-05-10 15:46:01 +0200 | [diff] [blame] | 242 | depends on !S390 |
Johannes Berg | 2a5e1c0 | 2007-04-23 12:19:12 -0700 | [diff] [blame] | 243 | |
| 244 | source "net/wireless/Kconfig" |
Jiri Benc | f0706e8 | 2007-05-05 11:45:53 -0700 | [diff] [blame] | 245 | source "net/mac80211/Kconfig" |
Johannes Berg | 2a5e1c0 | 2007-04-23 12:19:12 -0700 | [diff] [blame] | 246 | source "net/ieee80211/Kconfig" |
| 247 | |
| 248 | endmenu |
| 249 | |
Ivo van Doorn | cf4328c | 2007-05-07 00:34:20 -0700 | [diff] [blame] | 250 | source "net/rfkill/Kconfig" |
Latchesar Ionkov | bd238fb | 2007-07-10 17:57:28 -0500 | [diff] [blame] | 251 | source "net/9p/Kconfig" |
Ivo van Doorn | cf4328c | 2007-05-07 00:34:20 -0700 | [diff] [blame] | 252 | |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 253 | endif # if NET |
Sam Ravnborg | d5950b4 | 2005-07-11 21:03:49 -0700 | [diff] [blame] | 254 | endmenu # Networking |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 255 | |