]>
Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | # |
2 | # Network configuration | |
3 | # | |
4 | ||
d5950b43 | 5 | menu "Networking" |
1da177e4 LT |
6 | |
7 | config NET | |
8 | bool "Networking support" | |
9 | ---help--- | |
10 | Unless you really know what you are doing, you should say Y here. | |
11 | The reason is that some programs need kernel networking support even | |
12 | when running on a stand-alone machine that isn't connected to any | |
d5950b43 SR |
13 | other computer. |
14 | ||
15 | If you are upgrading from an older kernel, you | |
1da177e4 LT |
16 | should consider updating your networking tools too because changes |
17 | in the kernel and the tools often go hand in hand. The tools are | |
18 | contained in the package net-tools, the location and version number | |
19 | of which are given in <file:Documentation/Changes>. | |
20 | ||
21 | For a general introduction to Linux networking, it is highly | |
22 | recommended to read the NET-HOWTO, available from | |
23 | <http://www.tldp.org/docs.html#howto>. | |
24 | ||
6a2e9b73 SR |
25 | # Make sure that all config symbols are dependent on NET |
26 | if NET | |
1da177e4 | 27 | |
6a2e9b73 | 28 | menu "Networking options" |
1da177e4 | 29 | |
0dec456d SH |
30 | config NETDEBUG |
31 | bool "Network packet debugging" | |
32 | help | |
33 | You can say Y here if you want to get additional messages useful in | |
34 | debugging bad packets, but can overwhelm logs under denial of service | |
35 | attacks. | |
36 | ||
6a2e9b73 SR |
37 | source "net/packet/Kconfig" |
38 | source "net/unix/Kconfig" | |
39 | source "net/xfrm/Kconfig" | |
2356f4cb | 40 | source "net/iucv/Kconfig" |
1da177e4 LT |
41 | |
42 | config INET | |
43 | bool "TCP/IP networking" | |
44 | ---help--- | |
45 | These are the protocols used on the Internet and on most local | |
46 | Ethernets. It is highly recommended to say Y here (this will enlarge | |
47 | your kernel by about 144 KB), since some programs (e.g. the X window | |
48 | system) use TCP/IP even if your machine is not connected to any | |
49 | other computer. You will get the so-called loopback device which | |
50 | allows you to ping yourself (great fun, that!). | |
51 | ||
52 | For an excellent introduction to Linux networking, please read the | |
53 | Linux Networking HOWTO, available from | |
54 | <http://www.tldp.org/docs.html#howto>. | |
55 | ||
56 | If you say Y here and also to "/proc file system support" and | |
57 | "Sysctl support" below, you can change various aspects of the | |
58 | behavior of the TCP/IP code by writing to the (virtual) files in | |
59 | /proc/sys/net/ipv4/*; the options are explained in the file | |
60 | <file:Documentation/networking/ip-sysctl.txt>. | |
61 | ||
62 | Short answer: say Y. | |
63 | ||
6a2e9b73 | 64 | if INET |
1da177e4 | 65 | source "net/ipv4/Kconfig" |
1da177e4 | 66 | source "net/ipv6/Kconfig" |
38c94377 | 67 | source "net/netlabel/Kconfig" |
1da177e4 | 68 | |
6a2e9b73 SR |
69 | endif # if INET |
70 | ||
984bc16c JM |
71 | config NETWORK_SECMARK |
72 | bool "Security Marking" | |
73 | help | |
74 | This enables security marking of network packets, similar | |
75 | to nfmark, but designated for security purposes. | |
76 | If you are unsure how to answer this question, answer N. | |
77 | ||
1da177e4 | 78 | menuconfig NETFILTER |
ef91fd52 | 79 | bool "Network packet filtering framework (Netfilter)" |
1da177e4 LT |
80 | ---help--- |
81 | Netfilter is a framework for filtering and mangling network packets | |
82 | that pass through your Linux box. | |
83 | ||
84 | The most common use of packet filtering is to run your Linux box as | |
85 | a firewall protecting a local network from the Internet. The type of | |
86 | firewall provided by this kernel support is called a "packet | |
87 | filter", which means that it can reject individual network packets | |
88 | based on type, source, destination etc. The other kind of firewall, | |
89 | a "proxy-based" one, is more secure but more intrusive and more | |
90 | bothersome to set up; it inspects the network traffic much more | |
91 | closely, modifies it and has knowledge about the higher level | |
92 | protocols, which a packet filter lacks. Moreover, proxy-based | |
93 | firewalls often require changes to the programs running on the local | |
94 | clients. Proxy-based firewalls don't need support by the kernel, but | |
95 | they are often combined with a packet filter, which only works if | |
96 | you say Y here. | |
97 | ||
98 | You should also say Y here if you intend to use your Linux box as | |
99 | the gateway to the Internet for a local network of machines without | |
100 | globally valid IP addresses. This is called "masquerading": if one | |
101 | of the computers on your local network wants to send something to | |
102 | the outside, your box can "masquerade" as that computer, i.e. it | |
103 | forwards the traffic to the intended outside destination, but | |
104 | modifies the packets to make it look like they came from the | |
105 | firewall box itself. It works both ways: if the outside host | |
106 | replies, the Linux box will silently forward the traffic to the | |
107 | correct local computer. This way, the computers on your local net | |
108 | are completely invisible to the outside world, even though they can | |
109 | reach the outside and can receive replies. It is even possible to | |
110 | run globally visible servers from within a masqueraded local network | |
111 | using a mechanism called portforwarding. Masquerading is also often | |
112 | called NAT (Network Address Translation). | |
113 | ||
114 | Another use of Netfilter is in transparent proxying: if a machine on | |
115 | the local network tries to connect to an outside host, your Linux | |
116 | box can transparently forward the traffic to a local server, | |
117 | typically a caching proxy server. | |
118 | ||
119 | Yet another use of Netfilter is building a bridging firewall. Using | |
120 | a bridge with Network packet filtering enabled makes iptables "see" | |
121 | the bridged traffic. For filtering on the lower network and Ethernet | |
122 | protocols over the bridge, use ebtables (under bridge netfilter | |
123 | configuration). | |
124 | ||
125 | Various modules exist for netfilter which replace the previous | |
126 | masquerading (ipmasqadm), packet filtering (ipchains), transparent | |
127 | proxying, and portforwarding mechanisms. Please see | |
128 | <file:Documentation/Changes> under "iptables" for the location of | |
129 | these packages. | |
130 | ||
131 | Make sure to say N to "Fast switching" below if you intend to say Y | |
132 | here, as Fast switching currently bypasses netfilter. | |
133 | ||
134 | Chances are that you should say Y here if you compile a kernel which | |
135 | will run as a router and N for regular hosts. If unsure, say N. | |
136 | ||
137 | if NETFILTER | |
138 | ||
139 | config NETFILTER_DEBUG | |
140 | bool "Network packet filtering debugging" | |
141 | depends on NETFILTER | |
142 | help | |
143 | You can say Y here if you want to get additional messages useful in | |
144 | debugging the netfilter code. | |
145 | ||
146 | config BRIDGE_NETFILTER | |
147 | bool "Bridged IP/ARP packets filtering" | |
148 | depends on BRIDGE && NETFILTER && INET | |
149 | default y | |
150 | ---help--- | |
151 | Enabling this option will let arptables resp. iptables see bridged | |
152 | ARP resp. IP traffic. If you want a bridging firewall, you probably | |
153 | want this option enabled. | |
154 | Enabling or disabling this option doesn't enable or disable | |
155 | ebtables. | |
156 | ||
157 | If unsure, say N. | |
158 | ||
9eb0eec7 | 159 | source "net/netfilter/Kconfig" |
1da177e4 LT |
160 | source "net/ipv4/netfilter/Kconfig" |
161 | source "net/ipv6/netfilter/Kconfig" | |
162 | source "net/decnet/netfilter/Kconfig" | |
163 | source "net/bridge/netfilter/Kconfig" | |
164 | ||
165 | endif | |
166 | ||
7c657876 | 167 | source "net/dccp/Kconfig" |
1da177e4 | 168 | source "net/sctp/Kconfig" |
1e63e681 | 169 | source "net/tipc/Kconfig" |
6a2e9b73 SR |
170 | source "net/atm/Kconfig" |
171 | source "net/bridge/Kconfig" | |
172 | source "net/8021q/Kconfig" | |
1da177e4 | 173 | source "net/decnet/Kconfig" |
1da177e4 | 174 | source "net/llc/Kconfig" |
1da177e4 | 175 | source "net/ipx/Kconfig" |
1da177e4 | 176 | source "drivers/net/appletalk/Kconfig" |
6a2e9b73 SR |
177 | source "net/x25/Kconfig" |
178 | source "net/lapb/Kconfig" | |
6a2e9b73 SR |
179 | source "net/econet/Kconfig" |
180 | source "net/wanrouter/Kconfig" | |
1da177e4 LT |
181 | source "net/sched/Kconfig" |
182 | ||
1da177e4 LT |
183 | menu "Network testing" |
184 | ||
185 | config NET_PKTGEN | |
186 | tristate "Packet Generator (USE WITH CAUTION)" | |
187 | depends on PROC_FS | |
188 | ---help--- | |
189 | This module will inject preconfigured packets, at a configurable | |
190 | rate, out of a given interface. It is used for network interface | |
191 | stress testing and performance analysis. If you don't understand | |
192 | what was just said, you don't need it: say N. | |
193 | ||
194 | Documentation on how to use the packet generator can be found | |
195 | at <file:Documentation/networking/pktgen.txt>. | |
196 | ||
197 | To compile this code as a module, choose M here: the | |
198 | module will be called pktgen. | |
199 | ||
a42e9d6c SH |
200 | config NET_TCPPROBE |
201 | tristate "TCP connection probing" | |
202 | depends on INET && EXPERIMENTAL && PROC_FS && KPROBES | |
203 | ---help--- | |
204 | This module allows for capturing the changes to TCP connection | |
9dadaa19 | 205 | state in response to incoming packets. It is used for debugging |
a42e9d6c SH |
206 | TCP congestion avoidance modules. If you don't understand |
207 | what was just said, you don't need it: say N. | |
208 | ||
82fe7c92 | 209 | Documentation on how to use TCP connection probing can be found |
a42e9d6c SH |
210 | at http://linux-net.osdl.org/index.php/TcpProbe |
211 | ||
212 | To compile this code as a module, choose M here: the | |
213 | module will be called tcp_probe. | |
214 | ||
1da177e4 LT |
215 | endmenu |
216 | ||
217 | endmenu | |
218 | ||
1da177e4 | 219 | source "net/ax25/Kconfig" |
1da177e4 | 220 | source "net/irda/Kconfig" |
1da177e4 | 221 | source "net/bluetooth/Kconfig" |
b453872c JG |
222 | source "net/ieee80211/Kconfig" |
223 | ||
d86b5e0e AB |
224 | config WIRELESS_EXT |
225 | bool | |
226 | ||
14c0b97d TG |
227 | config FIB_RULES |
228 | bool | |
229 | ||
6a2e9b73 | 230 | endif # if NET |
d5950b43 | 231 | endmenu # Networking |
1da177e4 | 232 |