1# 2# Network configuration 3# 4 5menuconfig NET 6 bool "Networking support" 7 select NLATTR 8 ---help--- 9 Unless you really know what you are doing, you should say Y here. 10 The reason is that some programs need kernel networking support even 11 when running on a stand-alone machine that isn't connected to any 12 other computer. 13 14 If you are upgrading from an older kernel, you 15 should consider updating your networking tools too because changes 16 in the kernel and the tools often go hand in hand. The tools are 17 contained in the package net-tools, the location and version number 18 of which are given in <file:Documentation/Changes>. 19 20 For a general introduction to Linux networking, it is highly 21 recommended to read the NET-HOWTO, available from 22 <http://www.tldp.org/docs.html#howto>. 23 24if NET 25 26menu "Networking options" 27 28source "net/packet/Kconfig" 29source "net/unix/Kconfig" 30source "net/xfrm/Kconfig" 31source "net/iucv/Kconfig" 32 33config INET 34 bool "TCP/IP networking" 35 ---help--- 36 These are the protocols used on the Internet and on most local 37 Ethernets. It is highly recommended to say Y here (this will enlarge 38 your kernel by about 400 KB), since some programs (e.g. the X window 39 system) use TCP/IP even if your machine is not connected to any 40 other computer. You will get the so-called loopback device which 41 allows you to ping yourself (great fun, that!). 42 43 For an excellent introduction to Linux networking, please read the 44 Linux Networking HOWTO, available from 45 <http://www.tldp.org/docs.html#howto>. 46 47 If you say Y here and also to "/proc file system support" and 48 "Sysctl support" below, you can change various aspects of the 49 behavior of the TCP/IP code by writing to the (virtual) files in 50 /proc/sys/net/ipv4/*; the options are explained in the file 51 <file:Documentation/networking/ip-sysctl.txt>. 52 53 Short answer: say Y. 54 55if INET 56source "net/ipv4/Kconfig" 57source "net/ipv6/Kconfig" 58source "net/netlabel/Kconfig" 59 60endif # if INET 61 62config NETWORK_SECMARK 63 bool "Security Marking" 64 help 65 This enables security marking of network packets, similar 66 to nfmark, but designated for security purposes. 67 If you are unsure how to answer this question, answer N. 68 69menuconfig NETFILTER 70 bool "Network packet filtering framework (Netfilter)" 71 ---help--- 72 Netfilter is a framework for filtering and mangling network packets 73 that pass through your Linux box. 74 75 The most common use of packet filtering is to run your Linux box as 76 a firewall protecting a local network from the Internet. The type of 77 firewall provided by this kernel support is called a "packet 78 filter", which means that it can reject individual network packets 79 based on type, source, destination etc. The other kind of firewall, 80 a "proxy-based" one, is more secure but more intrusive and more 81 bothersome to set up; it inspects the network traffic much more 82 closely, modifies it and has knowledge about the higher level 83 protocols, which a packet filter lacks. Moreover, proxy-based 84 firewalls often require changes to the programs running on the local 85 clients. Proxy-based firewalls don't need support by the kernel, but 86 they are often combined with a packet filter, which only works if 87 you say Y here. 88 89 You should also say Y here if you intend to use your Linux box as 90 the gateway to the Internet for a local network of machines without 91 globally valid IP addresses. This is called "masquerading": if one 92 of the computers on your local network wants to send something to 93 the outside, your box can "masquerade" as that computer, i.e. it 94 forwards the traffic to the intended outside destination, but 95 modifies the packets to make it look like they came from the 96 firewall box itself. It works both ways: if the outside host 97 replies, the Linux box will silently forward the traffic to the 98 correct local computer. This way, the computers on your local net 99 are completely invisible to the outside world, even though they can 100 reach the outside and can receive replies. It is even possible to 101 run globally visible servers from within a masqueraded local network 102 using a mechanism called portforwarding. Masquerading is also often 103 called NAT (Network Address Translation). 104 105 Another use of Netfilter is in transparent proxying: if a machine on 106 the local network tries to connect to an outside host, your Linux 107 box can transparently forward the traffic to a local server, 108 typically a caching proxy server. 109 110 Yet another use of Netfilter is building a bridging firewall. Using 111 a bridge with Network packet filtering enabled makes iptables "see" 112 the bridged traffic. For filtering on the lower network and Ethernet 113 protocols over the bridge, use ebtables (under bridge netfilter 114 configuration). 115 116 Various modules exist for netfilter which replace the previous 117 masquerading (ipmasqadm), packet filtering (ipchains), transparent 118 proxying, and portforwarding mechanisms. Please see 119 <file:Documentation/Changes> under "iptables" for the location of 120 these packages. 121 122if NETFILTER 123 124config NETFILTER_DEBUG 125 bool "Network packet filtering debugging" 126 depends on NETFILTER 127 help 128 You can say Y here if you want to get additional messages useful in 129 debugging the netfilter code. 130 131config NETFILTER_ADVANCED 132 bool "Advanced netfilter configuration" 133 depends on NETFILTER 134 default y 135 help 136 If you say Y here you can select between all the netfilter modules. 137 If you say N the more unusual ones will not be shown and the 138 basic ones needed by most people will default to 'M'. 139 140 If unsure, say Y. 141 142config BRIDGE_NETFILTER 143 bool "Bridged IP/ARP packets filtering" 144 depends on BRIDGE && NETFILTER && INET 145 depends on NETFILTER_ADVANCED 146 default y 147 ---help--- 148 Enabling this option will let arptables resp. iptables see bridged 149 ARP resp. IP traffic. If you want a bridging firewall, you probably 150 want this option enabled. 151 Enabling or disabling this option doesn't enable or disable 152 ebtables. 153 154 If unsure, say N. 155 156source "net/netfilter/Kconfig" 157source "net/ipv4/netfilter/Kconfig" 158source "net/ipv6/netfilter/Kconfig" 159source "net/decnet/netfilter/Kconfig" 160source "net/bridge/netfilter/Kconfig" 161 162endif 163 164source "net/dccp/Kconfig" 165source "net/sctp/Kconfig" 166source "net/rds/Kconfig" 167source "net/tipc/Kconfig" 168source "net/atm/Kconfig" 169source "net/802/Kconfig" 170source "net/bridge/Kconfig" 171source "net/dsa/Kconfig" 172source "net/8021q/Kconfig" 173source "net/decnet/Kconfig" 174source "net/llc/Kconfig" 175source "net/ipx/Kconfig" 176source "drivers/net/appletalk/Kconfig" 177source "net/x25/Kconfig" 178source "net/lapb/Kconfig" 179source "net/econet/Kconfig" 180source "net/wanrouter/Kconfig" 181source "net/phonet/Kconfig" 182source "net/sched/Kconfig" 183source "net/dcb/Kconfig" 184 185menu "Network testing" 186 187config NET_PKTGEN 188 tristate "Packet Generator (USE WITH CAUTION)" 189 depends on PROC_FS 190 ---help--- 191 This module will inject preconfigured packets, at a configurable 192 rate, out of a given interface. It is used for network interface 193 stress testing and performance analysis. If you don't understand 194 what was just said, you don't need it: say N. 195 196 Documentation on how to use the packet generator can be found 197 at <file:Documentation/networking/pktgen.txt>. 198 199 To compile this code as a module, choose M here: the 200 module will be called pktgen. 201 202config NET_TCPPROBE 203 tristate "TCP connection probing" 204 depends on INET && EXPERIMENTAL && PROC_FS && KPROBES 205 ---help--- 206 This module allows for capturing the changes to TCP connection 207 state in response to incoming packets. It is used for debugging 208 TCP congestion avoidance modules. If you don't understand 209 what was just said, you don't need it: say N. 210 211 Documentation on how to use TCP connection probing can be found 212 at http://linux-net.osdl.org/index.php/TcpProbe 213 214 To compile this code as a module, choose M here: the 215 module will be called tcp_probe. 216 217config NET_DROP_MONITOR 218 boolean "Network packet drop alerting service" 219 depends on INET && EXPERIMENTAL && TRACEPOINTS 220 ---help--- 221 This feature provides an alerting service to userspace in the 222 event that packets are discarded in the network stack. Alerts 223 are broadcast via netlink socket to any listening user space 224 process. If you don't need network drop alerts, or if you are ok 225 just checking the various proc files and other utilities for 226 drop statistics, say N here. 227 228endmenu 229 230endmenu 231 232source "net/ax25/Kconfig" 233source "net/can/Kconfig" 234source "net/irda/Kconfig" 235source "net/bluetooth/Kconfig" 236source "net/rxrpc/Kconfig" 237 238config FIB_RULES 239 bool 240 241menuconfig WIRELESS 242 bool "Wireless" 243 depends on !S390 244 default y 245 246if WIRELESS 247 248source "net/wireless/Kconfig" 249source "net/mac80211/Kconfig" 250 251endif # WIRELESS 252 253source "net/wimax/Kconfig" 254 255source "net/rfkill/Kconfig" 256source "net/9p/Kconfig" 257 258endif # if NET 259