Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | # |
| 2 | # Network configuration |
| 3 | # |
| 4 | |
Sam Ravnborg | d5950b4 | 2005-07-11 21:03:49 -0700 | [diff] [blame] | 5 | menu "Networking" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 6 | |
| 7 | config NET |
| 8 | bool "Networking support" |
| 9 | ---help--- |
| 10 | Unless you really know what you are doing, you should say Y here. |
| 11 | The reason is that some programs need kernel networking support even |
| 12 | when running on a stand-alone machine that isn't connected to any |
Sam Ravnborg | d5950b4 | 2005-07-11 21:03:49 -0700 | [diff] [blame] | 13 | other computer. |
| 14 | |
| 15 | If you are upgrading from an older kernel, you |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 16 | should consider updating your networking tools too because changes |
| 17 | in the kernel and the tools often go hand in hand. The tools are |
| 18 | contained in the package net-tools, the location and version number |
| 19 | of which are given in <file:Documentation/Changes>. |
| 20 | |
| 21 | For a general introduction to Linux networking, it is highly |
| 22 | recommended to read the NET-HOWTO, available from |
| 23 | <http://www.tldp.org/docs.html#howto>. |
| 24 | |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 25 | # Make sure that all config symbols are dependent on NET |
| 26 | if NET |
| 27 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 28 | menu "Networking options" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 29 | |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 30 | source "net/packet/Kconfig" |
| 31 | source "net/unix/Kconfig" |
| 32 | source "net/xfrm/Kconfig" |
Martin Schwidefsky | 2356f4c | 2007-02-08 13:37:42 -0800 | [diff] [blame] | 33 | source "net/iucv/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 34 | |
| 35 | config INET |
| 36 | bool "TCP/IP networking" |
| 37 | ---help--- |
| 38 | These are the protocols used on the Internet and on most local |
| 39 | Ethernets. It is highly recommended to say Y here (this will enlarge |
| 40 | your kernel by about 144 KB), since some programs (e.g. the X window |
| 41 | system) use TCP/IP even if your machine is not connected to any |
| 42 | other computer. You will get the so-called loopback device which |
| 43 | allows you to ping yourself (great fun, that!). |
| 44 | |
| 45 | For an excellent introduction to Linux networking, please read the |
| 46 | Linux Networking HOWTO, available from |
| 47 | <http://www.tldp.org/docs.html#howto>. |
| 48 | |
| 49 | If you say Y here and also to "/proc file system support" and |
| 50 | "Sysctl support" below, you can change various aspects of the |
| 51 | behavior of the TCP/IP code by writing to the (virtual) files in |
| 52 | /proc/sys/net/ipv4/*; the options are explained in the file |
| 53 | <file:Documentation/networking/ip-sysctl.txt>. |
| 54 | |
| 55 | Short answer: say Y. |
| 56 | |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 57 | if INET |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 58 | source "net/ipv4/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 59 | source "net/ipv6/Kconfig" |
Paul Moore | 38c9437 | 2006-11-05 16:44:06 -0800 | [diff] [blame] | 60 | source "net/netlabel/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 61 | |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 62 | endif # if INET |
| 63 | |
James Morris | 984bc16 | 2006-06-09 00:29:17 -0700 | [diff] [blame] | 64 | config NETWORK_SECMARK |
| 65 | bool "Security Marking" |
| 66 | help |
| 67 | This enables security marking of network packets, similar |
| 68 | to nfmark, but designated for security purposes. |
| 69 | If you are unsure how to answer this question, answer N. |
| 70 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 71 | menuconfig NETFILTER |
Pablo Neira Ayuso | ef91fd5 | 2006-11-29 02:35:43 +0100 | [diff] [blame] | 72 | bool "Network packet filtering framework (Netfilter)" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 73 | ---help--- |
| 74 | Netfilter is a framework for filtering and mangling network packets |
| 75 | that pass through your Linux box. |
| 76 | |
| 77 | The most common use of packet filtering is to run your Linux box as |
| 78 | a firewall protecting a local network from the Internet. The type of |
| 79 | firewall provided by this kernel support is called a "packet |
| 80 | filter", which means that it can reject individual network packets |
| 81 | based on type, source, destination etc. The other kind of firewall, |
| 82 | a "proxy-based" one, is more secure but more intrusive and more |
| 83 | bothersome to set up; it inspects the network traffic much more |
| 84 | closely, modifies it and has knowledge about the higher level |
| 85 | protocols, which a packet filter lacks. Moreover, proxy-based |
| 86 | firewalls often require changes to the programs running on the local |
| 87 | clients. Proxy-based firewalls don't need support by the kernel, but |
| 88 | they are often combined with a packet filter, which only works if |
| 89 | you say Y here. |
| 90 | |
| 91 | You should also say Y here if you intend to use your Linux box as |
| 92 | the gateway to the Internet for a local network of machines without |
| 93 | globally valid IP addresses. This is called "masquerading": if one |
| 94 | of the computers on your local network wants to send something to |
| 95 | the outside, your box can "masquerade" as that computer, i.e. it |
| 96 | forwards the traffic to the intended outside destination, but |
| 97 | modifies the packets to make it look like they came from the |
| 98 | firewall box itself. It works both ways: if the outside host |
| 99 | replies, the Linux box will silently forward the traffic to the |
| 100 | correct local computer. This way, the computers on your local net |
| 101 | are completely invisible to the outside world, even though they can |
| 102 | reach the outside and can receive replies. It is even possible to |
| 103 | run globally visible servers from within a masqueraded local network |
| 104 | using a mechanism called portforwarding. Masquerading is also often |
| 105 | called NAT (Network Address Translation). |
| 106 | |
| 107 | Another use of Netfilter is in transparent proxying: if a machine on |
| 108 | the local network tries to connect to an outside host, your Linux |
| 109 | box can transparently forward the traffic to a local server, |
| 110 | typically a caching proxy server. |
| 111 | |
| 112 | Yet another use of Netfilter is building a bridging firewall. Using |
| 113 | a bridge with Network packet filtering enabled makes iptables "see" |
| 114 | the bridged traffic. For filtering on the lower network and Ethernet |
| 115 | protocols over the bridge, use ebtables (under bridge netfilter |
| 116 | configuration). |
| 117 | |
| 118 | Various modules exist for netfilter which replace the previous |
| 119 | masquerading (ipmasqadm), packet filtering (ipchains), transparent |
| 120 | proxying, and portforwarding mechanisms. Please see |
| 121 | <file:Documentation/Changes> under "iptables" for the location of |
| 122 | these packages. |
| 123 | |
| 124 | Make sure to say N to "Fast switching" below if you intend to say Y |
| 125 | here, as Fast switching currently bypasses netfilter. |
| 126 | |
| 127 | Chances are that you should say Y here if you compile a kernel which |
| 128 | will run as a router and N for regular hosts. If unsure, say N. |
| 129 | |
| 130 | if NETFILTER |
| 131 | |
| 132 | config NETFILTER_DEBUG |
| 133 | bool "Network packet filtering debugging" |
| 134 | depends on NETFILTER |
| 135 | help |
| 136 | You can say Y here if you want to get additional messages useful in |
| 137 | debugging the netfilter code. |
| 138 | |
| 139 | config BRIDGE_NETFILTER |
| 140 | bool "Bridged IP/ARP packets filtering" |
| 141 | depends on BRIDGE && NETFILTER && INET |
| 142 | default y |
| 143 | ---help--- |
| 144 | Enabling this option will let arptables resp. iptables see bridged |
| 145 | ARP resp. IP traffic. If you want a bridging firewall, you probably |
| 146 | want this option enabled. |
| 147 | Enabling or disabling this option doesn't enable or disable |
| 148 | ebtables. |
| 149 | |
| 150 | If unsure, say N. |
| 151 | |
Harald Welte | 9eb0eec | 2005-09-17 00:41:21 -0700 | [diff] [blame] | 152 | source "net/netfilter/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 153 | source "net/ipv4/netfilter/Kconfig" |
| 154 | source "net/ipv6/netfilter/Kconfig" |
| 155 | source "net/decnet/netfilter/Kconfig" |
| 156 | source "net/bridge/netfilter/Kconfig" |
| 157 | |
| 158 | endif |
| 159 | |
Arnaldo Carvalho de Melo | 7c65787 | 2005-08-09 20:14:34 -0700 | [diff] [blame] | 160 | source "net/dccp/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 161 | source "net/sctp/Kconfig" |
Per Liden | 1e63e68 | 2006-01-16 16:39:13 +0100 | [diff] [blame] | 162 | source "net/tipc/Kconfig" |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 163 | source "net/atm/Kconfig" |
| 164 | source "net/bridge/Kconfig" |
| 165 | source "net/8021q/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 166 | source "net/decnet/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 167 | source "net/llc/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 168 | source "net/ipx/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 169 | source "drivers/net/appletalk/Kconfig" |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 170 | source "net/x25/Kconfig" |
| 171 | source "net/lapb/Kconfig" |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 172 | source "net/econet/Kconfig" |
| 173 | source "net/wanrouter/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 174 | source "net/sched/Kconfig" |
| 175 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 176 | menu "Network testing" |
| 177 | |
| 178 | config NET_PKTGEN |
| 179 | tristate "Packet Generator (USE WITH CAUTION)" |
| 180 | depends on PROC_FS |
| 181 | ---help--- |
| 182 | This module will inject preconfigured packets, at a configurable |
| 183 | rate, out of a given interface. It is used for network interface |
| 184 | stress testing and performance analysis. If you don't understand |
| 185 | what was just said, you don't need it: say N. |
| 186 | |
| 187 | Documentation on how to use the packet generator can be found |
| 188 | at <file:Documentation/networking/pktgen.txt>. |
| 189 | |
| 190 | To compile this code as a module, choose M here: the |
| 191 | module will be called pktgen. |
| 192 | |
Stephen Hemminger | a42e9d6 | 2006-06-05 17:30:32 -0700 | [diff] [blame] | 193 | config NET_TCPPROBE |
| 194 | tristate "TCP connection probing" |
| 195 | depends on INET && EXPERIMENTAL && PROC_FS && KPROBES |
| 196 | ---help--- |
| 197 | This module allows for capturing the changes to TCP connection |
Dave Jones | 9dadaa19 | 2006-06-08 23:42:09 -0700 | [diff] [blame] | 198 | state in response to incoming packets. It is used for debugging |
Stephen Hemminger | a42e9d6 | 2006-06-05 17:30:32 -0700 | [diff] [blame] | 199 | TCP congestion avoidance modules. If you don't understand |
| 200 | what was just said, you don't need it: say N. |
| 201 | |
Grant Grundler | 82fe7c9 | 2006-09-25 23:47:14 -0700 | [diff] [blame] | 202 | Documentation on how to use TCP connection probing can be found |
Stephen Hemminger | a42e9d6 | 2006-06-05 17:30:32 -0700 | [diff] [blame] | 203 | at http://linux-net.osdl.org/index.php/TcpProbe |
| 204 | |
| 205 | To compile this code as a module, choose M here: the |
| 206 | module will be called tcp_probe. |
| 207 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 208 | endmenu |
| 209 | |
| 210 | endmenu |
| 211 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 212 | source "net/ax25/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 213 | source "net/irda/Kconfig" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 214 | source "net/bluetooth/Kconfig" |
David Howells | 17926a7 | 2007-04-26 15:48:28 -0700 | [diff] [blame] | 215 | source "net/rxrpc/Kconfig" |
Adrian Bunk | d86b5e0 | 2006-01-21 00:46:55 +0100 | [diff] [blame] | 216 | |
Thomas Graf | 14c0b97 | 2006-08-04 03:38:38 -0700 | [diff] [blame] | 217 | config FIB_RULES |
| 218 | bool |
| 219 | |
Johannes Berg | 2a5e1c0 | 2007-04-23 12:19:12 -0700 | [diff] [blame] | 220 | menu "Wireless" |
| 221 | |
| 222 | source "net/wireless/Kconfig" |
Jiri Benc | f0706e8 | 2007-05-05 11:45:53 -0700 | [diff] [blame] | 223 | source "net/mac80211/Kconfig" |
Johannes Berg | 2a5e1c0 | 2007-04-23 12:19:12 -0700 | [diff] [blame] | 224 | source "net/ieee80211/Kconfig" |
| 225 | |
| 226 | endmenu |
| 227 | |
Ivo van Doorn | cf4328c | 2007-05-07 00:34:20 -0700 | [diff] [blame] | 228 | source "net/rfkill/Kconfig" |
| 229 | |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 230 | endif # if NET |
Sam Ravnborg | d5950b4 | 2005-07-11 21:03:49 -0700 | [diff] [blame] | 231 | endmenu # Networking |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 232 | |