1# 2# Network configuration 3# 4 5menuconfig NET 6 bool "Networking support" 7 select NLATTR 8 ---help--- 9 Unless you really know what you are doing, you should say Y here. 10 The reason is that some programs need kernel networking support even 11 when running on a stand-alone machine that isn't connected to any 12 other computer. 13 14 If you are upgrading from an older kernel, you 15 should consider updating your networking tools too because changes 16 in the kernel and the tools often go hand in hand. The tools are 17 contained in the package net-tools, the location and version number 18 of which are given in <file:Documentation/Changes>. 19 20 For a general introduction to Linux networking, it is highly 21 recommended to read the NET-HOWTO, available from 22 <http://www.tldp.org/docs.html#howto>. 23 24if NET 25 26menu "Networking options" 27 28config COMPAT_NET_DEV_OPS 29 def_bool y 30 31source "net/packet/Kconfig" 32source "net/unix/Kconfig" 33source "net/xfrm/Kconfig" 34source "net/iucv/Kconfig" 35 36config INET 37 bool "TCP/IP networking" 38 ---help--- 39 These are the protocols used on the Internet and on most local 40 Ethernets. It is highly recommended to say Y here (this will enlarge 41 your kernel by about 400 KB), since some programs (e.g. the X window 42 system) use TCP/IP even if your machine is not connected to any 43 other computer. You will get the so-called loopback device which 44 allows you to ping yourself (great fun, that!). 45 46 For an excellent introduction to Linux networking, please read the 47 Linux Networking HOWTO, available from 48 <http://www.tldp.org/docs.html#howto>. 49 50 If you say Y here and also to "/proc file system support" and 51 "Sysctl support" below, you can change various aspects of the 52 behavior of the TCP/IP code by writing to the (virtual) files in 53 /proc/sys/net/ipv4/*; the options are explained in the file 54 <file:Documentation/networking/ip-sysctl.txt>. 55 56 Short answer: say Y. 57 58if INET 59source "net/ipv4/Kconfig" 60source "net/ipv6/Kconfig" 61source "net/netlabel/Kconfig" 62 63endif # if INET 64 65config NETWORK_SECMARK 66 bool "Security Marking" 67 help 68 This enables security marking of network packets, similar 69 to nfmark, but designated for security purposes. 70 If you are unsure how to answer this question, answer N. 71 72menuconfig NETFILTER 73 bool "Network packet filtering framework (Netfilter)" 74 ---help--- 75 Netfilter is a framework for filtering and mangling network packets 76 that pass through your Linux box. 77 78 The most common use of packet filtering is to run your Linux box as 79 a firewall protecting a local network from the Internet. The type of 80 firewall provided by this kernel support is called a "packet 81 filter", which means that it can reject individual network packets 82 based on type, source, destination etc. The other kind of firewall, 83 a "proxy-based" one, is more secure but more intrusive and more 84 bothersome to set up; it inspects the network traffic much more 85 closely, modifies it and has knowledge about the higher level 86 protocols, which a packet filter lacks. Moreover, proxy-based 87 firewalls often require changes to the programs running on the local 88 clients. Proxy-based firewalls don't need support by the kernel, but 89 they are often combined with a packet filter, which only works if 90 you say Y here. 91 92 You should also say Y here if you intend to use your Linux box as 93 the gateway to the Internet for a local network of machines without 94 globally valid IP addresses. This is called "masquerading": if one 95 of the computers on your local network wants to send something to 96 the outside, your box can "masquerade" as that computer, i.e. it 97 forwards the traffic to the intended outside destination, but 98 modifies the packets to make it look like they came from the 99 firewall box itself. It works both ways: if the outside host 100 replies, the Linux box will silently forward the traffic to the 101 correct local computer. This way, the computers on your local net 102 are completely invisible to the outside world, even though they can 103 reach the outside and can receive replies. It is even possible to 104 run globally visible servers from within a masqueraded local network 105 using a mechanism called portforwarding. Masquerading is also often 106 called NAT (Network Address Translation). 107 108 Another use of Netfilter is in transparent proxying: if a machine on 109 the local network tries to connect to an outside host, your Linux 110 box can transparently forward the traffic to a local server, 111 typically a caching proxy server. 112 113 Yet another use of Netfilter is building a bridging firewall. Using 114 a bridge with Network packet filtering enabled makes iptables "see" 115 the bridged traffic. For filtering on the lower network and Ethernet 116 protocols over the bridge, use ebtables (under bridge netfilter 117 configuration). 118 119 Various modules exist for netfilter which replace the previous 120 masquerading (ipmasqadm), packet filtering (ipchains), transparent 121 proxying, and portforwarding mechanisms. Please see 122 <file:Documentation/Changes> under "iptables" for the location of 123 these packages. 124 125 Make sure to say N to "Fast switching" below if you intend to say Y 126 here, as Fast switching currently bypasses netfilter. 127 128 Chances are that you should say Y here if you compile a kernel which 129 will run as a router and N for regular hosts. If unsure, say N. 130 131if NETFILTER 132 133config NETFILTER_DEBUG 134 bool "Network packet filtering debugging" 135 depends on NETFILTER 136 help 137 You can say Y here if you want to get additional messages useful in 138 debugging the netfilter code. 139 140config NETFILTER_ADVANCED 141 bool "Advanced netfilter configuration" 142 depends on NETFILTER 143 default y 144 help 145 If you say Y here you can select between all the netfilter modules. 146 If you say N the more ununsual ones will not be shown and the 147 basic ones needed by most people will default to 'M'. 148 149 If unsure, say Y. 150 151config BRIDGE_NETFILTER 152 bool "Bridged IP/ARP packets filtering" 153 depends on BRIDGE && NETFILTER && INET 154 depends on NETFILTER_ADVANCED 155 default y 156 ---help--- 157 Enabling this option will let arptables resp. iptables see bridged 158 ARP resp. IP traffic. If you want a bridging firewall, you probably 159 want this option enabled. 160 Enabling or disabling this option doesn't enable or disable 161 ebtables. 162 163 If unsure, say N. 164 165source "net/netfilter/Kconfig" 166source "net/ipv4/netfilter/Kconfig" 167source "net/ipv6/netfilter/Kconfig" 168source "net/decnet/netfilter/Kconfig" 169source "net/bridge/netfilter/Kconfig" 170 171endif 172 173source "net/dccp/Kconfig" 174source "net/sctp/Kconfig" 175source "net/tipc/Kconfig" 176source "net/atm/Kconfig" 177source "net/802/Kconfig" 178source "net/bridge/Kconfig" 179source "net/dsa/Kconfig" 180source "net/8021q/Kconfig" 181source "net/decnet/Kconfig" 182source "net/llc/Kconfig" 183source "net/ipx/Kconfig" 184source "drivers/net/appletalk/Kconfig" 185source "net/x25/Kconfig" 186source "net/lapb/Kconfig" 187source "net/econet/Kconfig" 188source "net/wanrouter/Kconfig" 189source "net/sched/Kconfig" 190source "net/dcb/Kconfig" 191 192menu "Network testing" 193 194config NET_PKTGEN 195 tristate "Packet Generator (USE WITH CAUTION)" 196 depends on PROC_FS 197 ---help--- 198 This module will inject preconfigured packets, at a configurable 199 rate, out of a given interface. It is used for network interface 200 stress testing and performance analysis. If you don't understand 201 what was just said, you don't need it: say N. 202 203 Documentation on how to use the packet generator can be found 204 at <file:Documentation/networking/pktgen.txt>. 205 206 To compile this code as a module, choose M here: the 207 module will be called pktgen. 208 209config NET_TCPPROBE 210 tristate "TCP connection probing" 211 depends on INET && EXPERIMENTAL && PROC_FS && KPROBES 212 ---help--- 213 This module allows for capturing the changes to TCP connection 214 state in response to incoming packets. It is used for debugging 215 TCP congestion avoidance modules. If you don't understand 216 what was just said, you don't need it: say N. 217 218 Documentation on how to use TCP connection probing can be found 219 at http://linux-net.osdl.org/index.php/TcpProbe 220 221 To compile this code as a module, choose M here: the 222 module will be called tcp_probe. 223 224endmenu 225 226endmenu 227 228source "net/ax25/Kconfig" 229source "net/can/Kconfig" 230source "net/irda/Kconfig" 231source "net/bluetooth/Kconfig" 232source "net/rxrpc/Kconfig" 233source "net/phonet/Kconfig" 234 235config FIB_RULES 236 bool 237 238menuconfig WIRELESS 239 bool "Wireless" 240 depends on !S390 241 default y 242 243if WIRELESS 244 245source "net/wireless/Kconfig" 246source "net/mac80211/Kconfig" 247 248endif # WIRELESS 249 250source "net/wimax/Kconfig" 251 252source "net/rfkill/Kconfig" 253source "net/9p/Kconfig" 254 255endif # if NET 256