# Kernel Configuration

### Tom Eastep

Copyright © 2001-2006 Thomas M. Eastep

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation License”.

2006-06-15

### Note

For information regarding configuring and building GNU/Linux kernels, see http://www.kernelnewbies.org.

## Network Options Configuration

Here's a screen shot of my Network Options Configuration:

While not all of the options that I've selected are required, they should be sufficient for most applications. Here's an excerpt from the corresponding .config file (Note: If you are running a kernel older than 2.4.17, be sure to select CONFIG_NETLINK and CONFIG_RTNETLINK):

>     #
>      # Networking options
>      #
>      CONFIG_PACKET=y
>      # CONFIG_PACKET_MMAP is not set
>      # CONFIG_NETLINK_DEV is not set
>      CONFIG_NETFILTER=y
>      # CONFIG_NETFILTER_DEBUG is not set
>      CONFIG_FILTER=y
>      CONFIG_UNIX=y
>      CONFIG_INET=y
>      CONFIG_IP_MULTICAST=y
>      CONFIG_IP_ADVANCED_ROUTER=y
>      CONFIG_IP_MULTIPLE_TABLES=y
>      CONFIG_IP_ROUTE_FWMARK=y
>      CONFIG_IP_ROUTE_NAT=y
>      CONFIG_IP_ROUTE_MULTIPATH=y
>      CONFIG_IP_ROUTE_TOS=y
>      CONFIG_IP_ROUTE_VERBOSE=y
>      # CONFIG_IP_ROUTE_LARGE_TABLES is not set
>      # CONFIG_IP_PNP is not set
>      CONFIG_NET_IPIP=y
>      CONFIG_NET_IPGRE=y
>      # CONFIG_NET_IPGRE_BROADCAST is not set
>      # CONFIG_IP_MROUTE is not set
>      # CONFIG_ARPD is not set
>      CONFIG_INET_ECN=y
>      CONFIG_SYN_COOKIES=y

## Netfilter Configuration

Here's a screen shot of my Netfilter configuration:

Note that I have built everything I need as modules. You can also build everything into your kernel but if you want to be able to deal with FTP running on a non-standard port then you must modularize FTP Protocol support.

Here's the corresponding part of my .config file:

>     #
>     #   IP: Netfilter Configuration
>     #
>     CONFIG_IP_NF_CONNTRACK=m
>     CONFIG_IP_NF_FTP=m
>     CONFIG_IP_NF_AMANDA=m
>     CONFIG_IP_NF_TFTP=m
>     # CONFIG_IP_NF_IRC is not set
>     # CONFIG_IP_NF_QUEUE is not set
>     CONFIG_IP_NF_IPTABLES=m
>     CONFIG_IP_NF_MATCH_LIMIT=m
>     CONFIG_IP_NF_MATCH_MAC=m
>     CONFIG_IP_NF_MATCH_PKTTYPE=m
>     CONFIG_IP_NF_MATCH_MARK=m
>     CONFIG_IP_NF_MATCH_MULTIPORT=m
>     CONFIG_IP_NF_MATCH_TOS=m
>     CONFIG_IP_NF_MATCH_ECN=m
>     CONFIG_IP_NF_MATCH_DSCP=m
>     CONFIG_IP_NF_MATCH_AH_ESP=m
>     CONFIG_IP_NF_MATCH_LENGTH=m
>     # CONFIG_IP_NF_MATCH_TTL is not set
>     CONFIG_IP_NF_MATCH_TCPMSS=m
>     CONFIG_IP_NF_MATCH_HELPER=m
>     CONFIG_IP_NF_MATCH_STATE=m
>     CONFIG_IP_NF_MATCH_CONNTRACK=m
>     CONFIG_IP_NF_MATCH_UNCLEAN=m
>     # CONFIG_IP_NF_MATCH_OWNER is not set
>     CONFIG_IP_NF_FILTER=m
>     CONFIG_IP_NF_TARGET_REJECT=m
>     # CONFIG_IP_NF_TARGET_MIRROR is not set
>     CONFIG_IP_NF_NAT=m
>     CONFIG_IP_NF_NAT_NEEDED=y
>     CONFIG_IP_NF_TARGET_MASQUERADE=m
>     CONFIG_IP_NF_TARGET_REDIRECT=m
>     CONFIG_IP_NF_NAT_AMANDA=m
>     CONFIG_IP_NF_NAT_LOCAL=y
>     # CONFIG_IP_NF_NAT_SNMP_BASIC is not set
>     CONFIG_IP_NF_NAT_FTP=m
>     CONFIG_IP_NF_NAT_TFTP=m
>     CONFIG_IP_NF_MANGLE=m
>     CONFIG_IP_NF_TARGET_TOS=m
>     CONFIG_IP_NF_TARGET_ECN=m
>     CONFIG_IP_NF_TARGET_DSCP=m
>     CONFIG_IP_NF_TARGET_MARK=m
>     CONFIG_IP_NF_TARGET_LOG=m
>     CONFIG_IP_NF_TARGET_ULOG=m
>     CONFIG_IP_NF_TARGET_TCPMSS=m
>     CONFIG_IP_NF_ARPTABLES=m
>     CONFIG_IP_NF_ARPFILTER=m
>     # CONFIG_IP_NF_COMPAT_IPCHAINS is not set
>     # CONFIG_IP_NF_COMPAT_IPFWADM is not set

## Kernel 2.6 Netfilter Options

Here's a screenshot of my modularized 2.6 Kernel config (Navigation: Device Drivers → Networking Support → Networking Options → Network Packet Filtering (replaces ipchains) → IP: Netfilter configuration):

Here is the corresponding part of the .config file:

>     CONFIG_IP_NF_CONNTRACK=m
>     CONFIG_IP_NF_FTP=m
>     CONFIG_IP_NF_IRC=m
>     CONFIG_IP_NF_TFTP=m
>     CONFIG_IP_NF_AMANDA=m
>     CONFIG_IP_NF_QUEUE=m
>     CONFIG_IP_NF_IPTABLES=m
>     CONFIG_IP_NF_MATCH_LIMIT=m
>     CONFIG_IP_NF_MATCH_IPRANGE=m
>     CONFIG_IP_NF_MATCH_MAC=m
>     CONFIG_IP_NF_MATCH_PKTTYPE=m
>     CONFIG_IP_NF_MATCH_MARK=m
>     CONFIG_IP_NF_MATCH_MULTIPORT=m
>     CONFIG_IP_NF_MATCH_TOS=m
>     CONFIG_IP_NF_MATCH_RECENT=m
>     CONFIG_IP_NF_MATCH_ECN=m
>     CONFIG_IP_NF_MATCH_DSCP=m
>     CONFIG_IP_NF_MATCH_AH_ESP=m
>     CONFIG_IP_NF_MATCH_LENGTH=m
>     CONFIG_IP_NF_MATCH_TTL=m
>     CONFIG_IP_NF_MATCH_TCPMSS=m
>     CONFIG_IP_NF_MATCH_HELPER=m
>     CONFIG_IP_NF_MATCH_STATE=m
>     CONFIG_IP_NF_MATCH_CONNTRACK=m
>     CONFIG_IP_NF_MATCH_OWNER=m
>     CONFIG_IP_NF_MATCH_PHYSDEV=m
>     CONFIG_IP_NF_FILTER=m
>     CONFIG_IP_NF_TARGET_REJECT=m
>     CONFIG_IP_NF_NAT=m
>     CONFIG_IP_NF_NAT_NEEDED=y
>     CONFIG_IP_NF_TARGET_MASQUERADE=m
>     CONFIG_IP_NF_TARGET_REDIRECT=m
>     CONFIG_IP_NF_TARGET_NETMAP=m
>     CONFIG_IP_NF_TARGET_SAME=m
>     CONFIG_IP_NF_NAT_LOCAL=y
>     CONFIG_IP_NF_NAT_SNMP_BASIC=m
>     CONFIG_IP_NF_NAT_IRC=m
>     CONFIG_IP_NF_NAT_FTP=m
>     CONFIG_IP_NF_NAT_TFTP=m
>     CONFIG_IP_NF_NAT_AMANDA=m
>     CONFIG_IP_NF_MANGLE=m
>     CONFIG_IP_NF_TARGET_TOS=m
>     CONFIG_IP_NF_TARGET_ECN=m
>     CONFIG_IP_NF_TARGET_DSCP=m
>     CONFIG_IP_NF_TARGET_MARK=m
>     CONFIG_IP_NF_TARGET_CLASSIFY=m
>     CONFIG_IP_NF_TARGET_LOG=m
>     CONFIG_IP_NF_TARGET_ULOG=m
>     CONFIG_IP_NF_TARGET_TCPMSS=m
>     # CONFIG_IP_NF_ARPTABLES is not set
>     # CONFIG_IP_NF_COMPAT_IPCHAINS is not set
>     # CONFIG_IP_NF_COMPAT_IPFWADM is not set
>     # CONFIG_IP_NF_RAW is not set
>     CONFIG_IP_NF_MATCH_ADDRTYPE=m
>     # CONFIG_IP_NF_MATCH_REALM is not set
>     CONFIG_IP6_NF_QUEUE=m
>     CONFIG_IP6_NF_IPTABLES=m
>     CONFIG_IP6_NF_MATCH_LIMIT=m
>     CONFIG_IP6_NF_MATCH_MAC=m
>     CONFIG_IP6_NF_MATCH_RT=m
>     CONFIG_IP6_NF_MATCH_OPTS=m
>     CONFIG_IP6_NF_MATCH_FRAG=m
>     CONFIG_IP6_NF_MATCH_HL=m
>     CONFIG_IP6_NF_MATCH_MULTIPORT=m
>     CONFIG_IP6_NF_MATCH_OWNER=m
>     CONFIG_IP6_NF_MATCH_MARK=m
>     CONFIG_IP6_NF_MATCH_IPV6HEADER=m
>     CONFIG_IP6_NF_MATCH_AHESP=m
>     CONFIG_IP6_NF_MATCH_LENGTH=m
>     CONFIG_IP6_NF_MATCH_EUI64=m
>     CONFIG_IP6_NF_FILTER=m
>     CONFIG_IP6_NF_TARGET_LOG=m
>     CONFIG_IP6_NF_MANGLE=m
>     CONFIG_IP6_NF_TARGET_MARK=m
>     # CONFIG_IP6_NF_RAW is not set
>     CONFIG_DECNET_NF_GRABULATOR=m
>     CONFIG_BRIDGE_NF_EBTABLES=m

## Kernel 2.6.16 and Later Netfilter Options

Here's a screenshot of my modularized 2.6.16 Kernel config (Navigation: Networking → Networking Options → Network Packet Filtering (replaces ipchains) → Core Netfilter configuration):

Note that is is particularly important to select "Netfilter Xtables support (required for ip_tables).

Here's a screenshot of the IP Netfilter config (Navigation: Networking → Networking Options → Network Packet Filtering (replaces ipchains) → IP: Netfilter configuration):

Here is the corresponding part of the .config file:

>     #
>     # Core Netfilter Configuration
>     #
>     CONFIG_NETFILTER_NETLINK=m
>     CONFIG_NETFILTER_NETLINK_QUEUE=m
>     CONFIG_NETFILTER_NETLINK_LOG=m
>     CONFIG_NETFILTER_XTABLES=m
>     CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
>     CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
>     CONFIG_NETFILTER_XT_TARGET_MARK=m
>     CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
>     CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
>     CONFIG_NETFILTER_XT_MATCH_COMMENT=m
>     CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
>     CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
>     CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
>     CONFIG_NETFILTER_XT_MATCH_DCCP=m
>     CONFIG_NETFILTER_XT_MATCH_HELPER=m
>     CONFIG_NETFILTER_XT_MATCH_LENGTH=m
>     CONFIG_NETFILTER_XT_MATCH_LIMIT=m
>     CONFIG_NETFILTER_XT_MATCH_MAC=m
>     CONFIG_NETFILTER_XT_MATCH_MARK=m
>     CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
>     CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
>     CONFIG_NETFILTER_XT_MATCH_REALM=m
>     CONFIG_NETFILTER_XT_MATCH_SCTP=m
>     CONFIG_NETFILTER_XT_MATCH_STATE=m
>     CONFIG_NETFILTER_XT_MATCH_STRING=m
>     CONFIG_NETFILTER_XT_MATCH_TCPMSS=m

>     #
>     # IP: Netfilter Configuration
>     #
>     CONFIG_IP_NF_CONNTRACK=m
>     CONFIG_IP_NF_CT_ACCT=y
>     CONFIG_IP_NF_CONNTRACK_MARK=y
>     CONFIG_IP_NF_FTP=m
>     CONFIG_IP_NF_IRC=m
>     CONFIG_IP_NF_TFTP=m
>     CONFIG_IP_NF_AMANDA=m
>     CONFIG_IP_NF_PPTP=m
>     CONFIG_IP_NF_QUEUE=m
>     CONFIG_IP_NF_IPTABLES=m
>     CONFIG_IP_NF_MATCH_IPRANGE=m
>     CONFIG_IP_NF_MATCH_MULTIPORT=m
>     CONFIG_IP_NF_MATCH_TOS=m
>     CONFIG_IP_NF_MATCH_RECENT=m
>     CONFIG_IP_NF_MATCH_ECN=m
>     CONFIG_IP_NF_MATCH_DSCP=m
>     CONFIG_IP_NF_MATCH_AH_ESP=m
>     CONFIG_IP_NF_MATCH_TTL=m
>     CONFIG_IP_NF_MATCH_OWNER=m
>     CONFIG_IP_NF_MATCH_ADDRTYPE=m
>     CONFIG_IP_NF_MATCH_HASHLIMIT=m
>     CONFIG_IP_NF_MATCH_POLICY=m
>     CONFIG_IP_NF_FILTER=m
>     CONFIG_IP_NF_TARGET_REJECT=m
>     CONFIG_IP_NF_TARGET_LOG=m
>     CONFIG_IP_NF_TARGET_ULOG=m
>     CONFIG_IP_NF_TARGET_TCPMSS=m
>     CONFIG_IP_NF_NAT=m
>     CONFIG_IP_NF_NAT_NEEDED=y
>     CONFIG_IP_NF_TARGET_MASQUERADE=m
>     CONFIG_IP_NF_TARGET_REDIRECT=m
>     CONFIG_IP_NF_TARGET_NETMAP=m
>     CONFIG_IP_NF_TARGET_SAME=m
>     CONFIG_IP_NF_NAT_IRC=m
>     CONFIG_IP_NF_NAT_FTP=m
>     CONFIG_IP_NF_NAT_TFTP=m
>     CONFIG_IP_NF_NAT_AMANDA=m
>     CONFIG_IP_NF_NAT_PPTP=m
>     CONFIG_IP_NF_MANGLE=m
>     CONFIG_IP_NF_TARGET_TOS=m
>     CONFIG_IP_NF_TARGET_ECN=m
>     CONFIG_IP_NF_TARGET_DSCP=m
>     CONFIG_IP_NF_TARGET_TTL=m
>     CONFIG_IP_NF_RAW=m
>     CONFIG_IP_NF_ARPTABLES=m
>     CONFIG_IP_NF_ARPFILTER=m
>     CONFIG_IP_NF_ARP_MANGLE=m