11da177e4SLinus Torvalds# 21da177e4SLinus Torvalds# Network configuration 31da177e4SLinus Torvalds# 41da177e4SLinus Torvalds 5d5950b43SSam Ravnborgmenu "Networking" 61da177e4SLinus Torvalds 71da177e4SLinus Torvaldsconfig NET 81da177e4SLinus Torvalds bool "Networking support" 91da177e4SLinus Torvalds ---help--- 101da177e4SLinus Torvalds Unless you really know what you are doing, you should say Y here. 111da177e4SLinus Torvalds The reason is that some programs need kernel networking support even 121da177e4SLinus Torvalds when running on a stand-alone machine that isn't connected to any 13d5950b43SSam Ravnborg other computer. 14d5950b43SSam Ravnborg 15d5950b43SSam Ravnborg If you are upgrading from an older kernel, you 161da177e4SLinus Torvalds should consider updating your networking tools too because changes 171da177e4SLinus Torvalds in the kernel and the tools often go hand in hand. The tools are 181da177e4SLinus Torvalds contained in the package net-tools, the location and version number 191da177e4SLinus Torvalds of which are given in <file:Documentation/Changes>. 201da177e4SLinus Torvalds 211da177e4SLinus Torvalds For a general introduction to Linux networking, it is highly 221da177e4SLinus Torvalds recommended to read the NET-HOWTO, available from 231da177e4SLinus Torvalds <http://www.tldp.org/docs.html#howto>. 241da177e4SLinus Torvalds 256a2e9b73SSam Ravnborg# Make sure that all config symbols are dependent on NET 266a2e9b73SSam Ravnborgif NET 276a2e9b73SSam Ravnborg 281da177e4SLinus Torvaldsmenu "Networking options" 291da177e4SLinus Torvalds 300dec456dSStephen Hemmingerconfig NETDEBUG 310dec456dSStephen Hemminger bool "Network packet debugging" 320dec456dSStephen Hemminger help 330dec456dSStephen Hemminger You can say Y here if you want to get additional messages useful in 340dec456dSStephen Hemminger debugging bad packets, but can overwhelm logs under denial of service 350dec456dSStephen Hemminger attacks. 360dec456dSStephen Hemminger 376a2e9b73SSam Ravnborgsource "net/packet/Kconfig" 386a2e9b73SSam Ravnborgsource "net/unix/Kconfig" 396a2e9b73SSam Ravnborgsource "net/xfrm/Kconfig" 401da177e4SLinus Torvalds 411da177e4SLinus Torvaldsconfig INET 421da177e4SLinus Torvalds bool "TCP/IP networking" 431da177e4SLinus Torvalds ---help--- 441da177e4SLinus Torvalds These are the protocols used on the Internet and on most local 451da177e4SLinus Torvalds Ethernets. It is highly recommended to say Y here (this will enlarge 461da177e4SLinus Torvalds your kernel by about 144 KB), since some programs (e.g. the X window 471da177e4SLinus Torvalds system) use TCP/IP even if your machine is not connected to any 481da177e4SLinus Torvalds other computer. You will get the so-called loopback device which 491da177e4SLinus Torvalds allows you to ping yourself (great fun, that!). 501da177e4SLinus Torvalds 511da177e4SLinus Torvalds For an excellent introduction to Linux networking, please read the 521da177e4SLinus Torvalds Linux Networking HOWTO, available from 531da177e4SLinus Torvalds <http://www.tldp.org/docs.html#howto>. 541da177e4SLinus Torvalds 551da177e4SLinus Torvalds If you say Y here and also to "/proc file system support" and 561da177e4SLinus Torvalds "Sysctl support" below, you can change various aspects of the 571da177e4SLinus Torvalds behavior of the TCP/IP code by writing to the (virtual) files in 581da177e4SLinus Torvalds /proc/sys/net/ipv4/*; the options are explained in the file 591da177e4SLinus Torvalds <file:Documentation/networking/ip-sysctl.txt>. 601da177e4SLinus Torvalds 611da177e4SLinus Torvalds Short answer: say Y. 621da177e4SLinus Torvalds 636a2e9b73SSam Ravnborgif INET 641da177e4SLinus Torvaldssource "net/ipv4/Kconfig" 651da177e4SLinus Torvaldssource "net/ipv6/Kconfig" 6638c94377SPaul Mooresource "net/netlabel/Kconfig" 671da177e4SLinus Torvalds 686a2e9b73SSam Ravnborgendif # if INET 696a2e9b73SSam Ravnborg 70984bc16cSJames Morrisconfig NETWORK_SECMARK 71984bc16cSJames Morris bool "Security Marking" 72984bc16cSJames Morris help 73984bc16cSJames Morris This enables security marking of network packets, similar 74984bc16cSJames Morris to nfmark, but designated for security purposes. 75984bc16cSJames Morris If you are unsure how to answer this question, answer N. 76984bc16cSJames Morris 771da177e4SLinus Torvaldsmenuconfig NETFILTER 78*ef91fd52SPablo Neira Ayuso bool "Network packet filtering framework (Netfilter)" 791da177e4SLinus Torvalds ---help--- 801da177e4SLinus Torvalds Netfilter is a framework for filtering and mangling network packets 811da177e4SLinus Torvalds that pass through your Linux box. 821da177e4SLinus Torvalds 831da177e4SLinus Torvalds The most common use of packet filtering is to run your Linux box as 841da177e4SLinus Torvalds a firewall protecting a local network from the Internet. The type of 851da177e4SLinus Torvalds firewall provided by this kernel support is called a "packet 861da177e4SLinus Torvalds filter", which means that it can reject individual network packets 871da177e4SLinus Torvalds based on type, source, destination etc. The other kind of firewall, 881da177e4SLinus Torvalds a "proxy-based" one, is more secure but more intrusive and more 891da177e4SLinus Torvalds bothersome to set up; it inspects the network traffic much more 901da177e4SLinus Torvalds closely, modifies it and has knowledge about the higher level 911da177e4SLinus Torvalds protocols, which a packet filter lacks. Moreover, proxy-based 921da177e4SLinus Torvalds firewalls often require changes to the programs running on the local 931da177e4SLinus Torvalds clients. Proxy-based firewalls don't need support by the kernel, but 941da177e4SLinus Torvalds they are often combined with a packet filter, which only works if 951da177e4SLinus Torvalds you say Y here. 961da177e4SLinus Torvalds 971da177e4SLinus Torvalds You should also say Y here if you intend to use your Linux box as 981da177e4SLinus Torvalds the gateway to the Internet for a local network of machines without 991da177e4SLinus Torvalds globally valid IP addresses. This is called "masquerading": if one 1001da177e4SLinus Torvalds of the computers on your local network wants to send something to 1011da177e4SLinus Torvalds the outside, your box can "masquerade" as that computer, i.e. it 1021da177e4SLinus Torvalds forwards the traffic to the intended outside destination, but 1031da177e4SLinus Torvalds modifies the packets to make it look like they came from the 1041da177e4SLinus Torvalds firewall box itself. It works both ways: if the outside host 1051da177e4SLinus Torvalds replies, the Linux box will silently forward the traffic to the 1061da177e4SLinus Torvalds correct local computer. This way, the computers on your local net 1071da177e4SLinus Torvalds are completely invisible to the outside world, even though they can 1081da177e4SLinus Torvalds reach the outside and can receive replies. It is even possible to 1091da177e4SLinus Torvalds run globally visible servers from within a masqueraded local network 1101da177e4SLinus Torvalds using a mechanism called portforwarding. Masquerading is also often 1111da177e4SLinus Torvalds called NAT (Network Address Translation). 1121da177e4SLinus Torvalds 1131da177e4SLinus Torvalds Another use of Netfilter is in transparent proxying: if a machine on 1141da177e4SLinus Torvalds the local network tries to connect to an outside host, your Linux 1151da177e4SLinus Torvalds box can transparently forward the traffic to a local server, 1161da177e4SLinus Torvalds typically a caching proxy server. 1171da177e4SLinus Torvalds 1181da177e4SLinus Torvalds Yet another use of Netfilter is building a bridging firewall. Using 1191da177e4SLinus Torvalds a bridge with Network packet filtering enabled makes iptables "see" 1201da177e4SLinus Torvalds the bridged traffic. For filtering on the lower network and Ethernet 1211da177e4SLinus Torvalds protocols over the bridge, use ebtables (under bridge netfilter 1221da177e4SLinus Torvalds configuration). 1231da177e4SLinus Torvalds 1241da177e4SLinus Torvalds Various modules exist for netfilter which replace the previous 1251da177e4SLinus Torvalds masquerading (ipmasqadm), packet filtering (ipchains), transparent 1261da177e4SLinus Torvalds proxying, and portforwarding mechanisms. Please see 1271da177e4SLinus Torvalds <file:Documentation/Changes> under "iptables" for the location of 1281da177e4SLinus Torvalds these packages. 1291da177e4SLinus Torvalds 1301da177e4SLinus Torvalds Make sure to say N to "Fast switching" below if you intend to say Y 1311da177e4SLinus Torvalds here, as Fast switching currently bypasses netfilter. 1321da177e4SLinus Torvalds 1331da177e4SLinus Torvalds Chances are that you should say Y here if you compile a kernel which 1341da177e4SLinus Torvalds will run as a router and N for regular hosts. If unsure, say N. 1351da177e4SLinus Torvalds 1361da177e4SLinus Torvaldsif NETFILTER 1371da177e4SLinus Torvalds 1381da177e4SLinus Torvaldsconfig NETFILTER_DEBUG 1391da177e4SLinus Torvalds bool "Network packet filtering debugging" 1401da177e4SLinus Torvalds depends on NETFILTER 1411da177e4SLinus Torvalds help 1421da177e4SLinus Torvalds You can say Y here if you want to get additional messages useful in 1431da177e4SLinus Torvalds debugging the netfilter code. 1441da177e4SLinus Torvalds 1451da177e4SLinus Torvaldsconfig BRIDGE_NETFILTER 1461da177e4SLinus Torvalds bool "Bridged IP/ARP packets filtering" 1471da177e4SLinus Torvalds depends on BRIDGE && NETFILTER && INET 1481da177e4SLinus Torvalds default y 1491da177e4SLinus Torvalds ---help--- 1501da177e4SLinus Torvalds Enabling this option will let arptables resp. iptables see bridged 1511da177e4SLinus Torvalds ARP resp. IP traffic. If you want a bridging firewall, you probably 1521da177e4SLinus Torvalds want this option enabled. 1531da177e4SLinus Torvalds Enabling or disabling this option doesn't enable or disable 1541da177e4SLinus Torvalds ebtables. 1551da177e4SLinus Torvalds 1561da177e4SLinus Torvalds If unsure, say N. 1571da177e4SLinus Torvalds 1589eb0eec7SHarald Weltesource "net/netfilter/Kconfig" 1591da177e4SLinus Torvaldssource "net/ipv4/netfilter/Kconfig" 1601da177e4SLinus Torvaldssource "net/ipv6/netfilter/Kconfig" 1611da177e4SLinus Torvaldssource "net/decnet/netfilter/Kconfig" 1621da177e4SLinus Torvaldssource "net/bridge/netfilter/Kconfig" 1631da177e4SLinus Torvalds 1641da177e4SLinus Torvaldsendif 1651da177e4SLinus Torvalds 1667c657876SArnaldo Carvalho de Melosource "net/dccp/Kconfig" 1671da177e4SLinus Torvaldssource "net/sctp/Kconfig" 1681e63e681SPer Lidensource "net/tipc/Kconfig" 1696a2e9b73SSam Ravnborgsource "net/atm/Kconfig" 1706a2e9b73SSam Ravnborgsource "net/bridge/Kconfig" 1716a2e9b73SSam Ravnborgsource "net/8021q/Kconfig" 1721da177e4SLinus Torvaldssource "net/decnet/Kconfig" 1731da177e4SLinus Torvaldssource "net/llc/Kconfig" 1741da177e4SLinus Torvaldssource "net/ipx/Kconfig" 1751da177e4SLinus Torvaldssource "drivers/net/appletalk/Kconfig" 1766a2e9b73SSam Ravnborgsource "net/x25/Kconfig" 1776a2e9b73SSam Ravnborgsource "net/lapb/Kconfig" 1786a2e9b73SSam Ravnborgsource "net/econet/Kconfig" 1796a2e9b73SSam Ravnborgsource "net/wanrouter/Kconfig" 1801da177e4SLinus Torvaldssource "net/sched/Kconfig" 1811da177e4SLinus Torvalds 1821da177e4SLinus Torvaldsmenu "Network testing" 1831da177e4SLinus Torvalds 1841da177e4SLinus Torvaldsconfig NET_PKTGEN 1851da177e4SLinus Torvalds tristate "Packet Generator (USE WITH CAUTION)" 1861da177e4SLinus Torvalds depends on PROC_FS 1871da177e4SLinus Torvalds ---help--- 1881da177e4SLinus Torvalds This module will inject preconfigured packets, at a configurable 1891da177e4SLinus Torvalds rate, out of a given interface. It is used for network interface 1901da177e4SLinus Torvalds stress testing and performance analysis. If you don't understand 1911da177e4SLinus Torvalds what was just said, you don't need it: say N. 1921da177e4SLinus Torvalds 1931da177e4SLinus Torvalds Documentation on how to use the packet generator can be found 1941da177e4SLinus Torvalds at <file:Documentation/networking/pktgen.txt>. 1951da177e4SLinus Torvalds 1961da177e4SLinus Torvalds To compile this code as a module, choose M here: the 1971da177e4SLinus Torvalds module will be called pktgen. 1981da177e4SLinus Torvalds 199a42e9d6cSStephen Hemmingerconfig NET_TCPPROBE 200a42e9d6cSStephen Hemminger tristate "TCP connection probing" 201a42e9d6cSStephen Hemminger depends on INET && EXPERIMENTAL && PROC_FS && KPROBES 202a42e9d6cSStephen Hemminger ---help--- 203a42e9d6cSStephen Hemminger This module allows for capturing the changes to TCP connection 2049dadaa19SDave Jones state in response to incoming packets. It is used for debugging 205a42e9d6cSStephen Hemminger TCP congestion avoidance modules. If you don't understand 206a42e9d6cSStephen Hemminger what was just said, you don't need it: say N. 207a42e9d6cSStephen Hemminger 20882fe7c92SGrant Grundler Documentation on how to use TCP connection probing can be found 209a42e9d6cSStephen Hemminger at http://linux-net.osdl.org/index.php/TcpProbe 210a42e9d6cSStephen Hemminger 211a42e9d6cSStephen Hemminger To compile this code as a module, choose M here: the 212a42e9d6cSStephen Hemminger module will be called tcp_probe. 213a42e9d6cSStephen Hemminger 2141da177e4SLinus Torvaldsendmenu 2151da177e4SLinus Torvalds 2161da177e4SLinus Torvaldsendmenu 2171da177e4SLinus Torvalds 2181da177e4SLinus Torvaldssource "net/ax25/Kconfig" 2191da177e4SLinus Torvaldssource "net/irda/Kconfig" 2201da177e4SLinus Torvaldssource "net/bluetooth/Kconfig" 221b453872cSJeff Garziksource "net/ieee80211/Kconfig" 222b453872cSJeff Garzik 223d86b5e0eSAdrian Bunkconfig WIRELESS_EXT 224d86b5e0eSAdrian Bunk bool 225d86b5e0eSAdrian Bunk 22614c0b97dSThomas Grafconfig FIB_RULES 22714c0b97dSThomas Graf bool 22814c0b97dSThomas Graf 2296a2e9b73SSam Ravnborgendif # if NET 230d5950b43SSam Ravnborgendmenu # Networking 2311da177e4SLinus Torvalds 232