1# 2# IP netfilter configuration 3# 4 5menu "IP: Netfilter Configuration" 6 depends on INET && NETFILTER 7 8config NF_DEFRAG_IPV4 9 tristate 10 default n 11 12config NF_CONNTRACK_IPV4 13 tristate "IPv4 connection tracking support (required for NAT)" 14 depends on NF_CONNTRACK 15 default m if NETFILTER_ADVANCED=n 16 select NF_DEFRAG_IPV4 17 ---help--- 18 Connection tracking keeps a record of what packets have passed 19 through your machine, in order to figure out how they are related 20 into connections. 21 22 This is IPv4 support on Layer 3 independent connection tracking. 23 Layer 3 independent connection tracking is experimental scheme 24 which generalize ip_conntrack to support other layer 3 protocols. 25 26 To compile it as a module, choose M here. If unsure, say N. 27 28config NF_CONNTRACK_PROC_COMPAT 29 bool "proc/sysctl compatibility with old connection tracking" 30 depends on NF_CONNTRACK_PROCFS && NF_CONNTRACK_IPV4 31 default y 32 help 33 This option enables /proc and sysctl compatibility with the old 34 layer 3 dependent connection tracking. This is needed to keep 35 old programs that have not been adapted to the new names working. 36 37 If unsure, say Y. 38 39config NF_LOG_ARP 40 tristate "ARP packet logging" 41 default m if NETFILTER_ADVANCED=n 42 select NF_LOG_COMMON 43 44config NF_LOG_IPV4 45 tristate "IPv4 packet logging" 46 default m if NETFILTER_ADVANCED=n 47 select NF_LOG_COMMON 48 49config NF_TABLES_IPV4 50 depends on NF_TABLES 51 tristate "IPv4 nf_tables support" 52 help 53 This option enables the IPv4 support for nf_tables. 54 55config NFT_CHAIN_ROUTE_IPV4 56 depends on NF_TABLES_IPV4 57 tristate "IPv4 nf_tables route chain support" 58 help 59 This option enables the "route" chain for IPv4 in nf_tables. This 60 chain type is used to force packet re-routing after mangling header 61 fields such as the source, destination, type of service and 62 the packet mark. 63 64config NFT_REJECT_IPV4 65 depends on NF_TABLES_IPV4 66 default NFT_REJECT 67 tristate 68 69config NF_TABLES_ARP 70 depends on NF_TABLES 71 tristate "ARP nf_tables support" 72 help 73 This option enables the ARP support for nf_tables. 74 75config NF_NAT_IPV4 76 tristate "IPv4 NAT" 77 depends on NF_CONNTRACK_IPV4 78 default m if NETFILTER_ADVANCED=n 79 select NF_NAT 80 help 81 The IPv4 NAT option allows masquerading, port forwarding and other 82 forms of full Network Address Port Translation. This can be 83 controlled by iptables or nft. 84 85if NF_NAT_IPV4 86 87config NFT_CHAIN_NAT_IPV4 88 depends on NF_TABLES_IPV4 89 tristate "IPv4 nf_tables nat chain support" 90 help 91 This option enables the "nat" chain for IPv4 in nf_tables. This 92 chain type is used to perform Network Address Translation (NAT) 93 packet transformations such as the source, destination address and 94 source and destination ports. 95 96config NF_NAT_SNMP_BASIC 97 tristate "Basic SNMP-ALG support" 98 depends on NF_CONNTRACK_SNMP 99 depends on NETFILTER_ADVANCED 100 default NF_NAT && NF_CONNTRACK_SNMP 101 ---help--- 102 103 This module implements an Application Layer Gateway (ALG) for 104 SNMP payloads. In conjunction with NAT, it allows a network 105 management system to access multiple private networks with 106 conflicting addresses. It works by modifying IP addresses 107 inside SNMP payloads to match IP-layer NAT mapping. 108 109 This is the "basic" form of SNMP-ALG, as described in RFC 2962 110 111 To compile it as a module, choose M here. If unsure, say N. 112 113config NF_NAT_PROTO_GRE 114 tristate 115 depends on NF_CT_PROTO_GRE 116 117config NF_NAT_PPTP 118 tristate 119 depends on NF_CONNTRACK 120 default NF_CONNTRACK_PPTP 121 select NF_NAT_PROTO_GRE 122 123config NF_NAT_H323 124 tristate 125 depends on NF_CONNTRACK 126 default NF_CONNTRACK_H323 127 128endif # NF_NAT_IPV4 129 130config IP_NF_IPTABLES 131 tristate "IP tables support (required for filtering/masq/NAT)" 132 default m if NETFILTER_ADVANCED=n 133 select NETFILTER_XTABLES 134 help 135 iptables is a general, extensible packet identification framework. 136 The packet filtering and full NAT (masquerading, port forwarding, 137 etc) subsystems now use this: say `Y' or `M' here if you want to use 138 either of those. 139 140 To compile it as a module, choose M here. If unsure, say N. 141 142if IP_NF_IPTABLES 143 144# The matches. 145config IP_NF_MATCH_AH 146 tristate '"ah" match support' 147 depends on NETFILTER_ADVANCED 148 help 149 This match extension allows you to match a range of SPIs 150 inside AH header of IPSec packets. 151 152 To compile it as a module, choose M here. If unsure, say N. 153 154config IP_NF_MATCH_ECN 155 tristate '"ecn" match support' 156 depends on NETFILTER_ADVANCED 157 select NETFILTER_XT_MATCH_ECN 158 ---help--- 159 This is a backwards-compat option for the user's convenience 160 (e.g. when running oldconfig). It selects 161 CONFIG_NETFILTER_XT_MATCH_ECN. 162 163config IP_NF_MATCH_RPFILTER 164 tristate '"rpfilter" reverse path filter match support' 165 depends on NETFILTER_ADVANCED && (IP_NF_MANGLE || IP_NF_RAW) 166 ---help--- 167 This option allows you to match packets whose replies would 168 go out via the interface the packet came in. 169 170 To compile it as a module, choose M here. If unsure, say N. 171 The module will be called ipt_rpfilter. 172 173config IP_NF_MATCH_TTL 174 tristate '"ttl" match support' 175 depends on NETFILTER_ADVANCED 176 select NETFILTER_XT_MATCH_HL 177 ---help--- 178 This is a backwards-compat option for the user's convenience 179 (e.g. when running oldconfig). It selects 180 CONFIG_NETFILTER_XT_MATCH_HL. 181 182# `filter', generic and specific targets 183config IP_NF_FILTER 184 tristate "Packet filtering" 185 default m if NETFILTER_ADVANCED=n 186 help 187 Packet filtering defines a table `filter', which has a series of 188 rules for simple packet filtering at local input, forwarding and 189 local output. See the man page for iptables(8). 190 191 To compile it as a module, choose M here. If unsure, say N. 192 193config IP_NF_TARGET_REJECT 194 tristate "REJECT target support" 195 depends on IP_NF_FILTER 196 default m if NETFILTER_ADVANCED=n 197 help 198 The REJECT target allows a filtering rule to specify that an ICMP 199 error should be issued in response to an incoming packet, rather 200 than silently being dropped. 201 202 To compile it as a module, choose M here. If unsure, say N. 203 204config IP_NF_TARGET_SYNPROXY 205 tristate "SYNPROXY target support" 206 depends on NF_CONNTRACK && NETFILTER_ADVANCED 207 select NETFILTER_SYNPROXY 208 select SYN_COOKIES 209 help 210 The SYNPROXY target allows you to intercept TCP connections and 211 establish them using syncookies before they are passed on to the 212 server. This allows to avoid conntrack and server resource usage 213 during SYN-flood attacks. 214 215 To compile it as a module, choose M here. If unsure, say N. 216 217# NAT + specific targets: nf_conntrack 218config IP_NF_NAT 219 tristate "iptables NAT support" 220 depends on NF_CONNTRACK_IPV4 221 default m if NETFILTER_ADVANCED=n 222 select NF_NAT 223 select NF_NAT_IPV4 224 select NETFILTER_XT_NAT 225 help 226 This enables the `nat' table in iptables. This allows masquerading, 227 port forwarding and other forms of full Network Address Port 228 Translation. 229 230 To compile it as a module, choose M here. If unsure, say N. 231 232if IP_NF_NAT 233 234config NF_NAT_MASQUERADE_IPV4 235 tristate "IPv4 masquerade support" 236 help 237 This is the kernel functionality to provide NAT in the masquerade 238 flavour (automatic source address selection). 239 240config NFT_MASQ_IPV4 241 tristate "IPv4 masquerading support for nf_tables" 242 depends on NF_TABLES_IPV4 243 depends on NFT_MASQ 244 select NF_NAT_MASQUERADE_IPV4 245 246config IP_NF_TARGET_MASQUERADE 247 tristate "MASQUERADE target support" 248 select NF_NAT_MASQUERADE_IPV4 249 default m if NETFILTER_ADVANCED=n 250 help 251 Masquerading is a special case of NAT: all outgoing connections are 252 changed to seem to come from a particular interface's address, and 253 if the interface goes down, those connections are lost. This is 254 only useful for dialup accounts with dynamic IP address (ie. your IP 255 address will be different on next dialup). 256 257 To compile it as a module, choose M here. If unsure, say N. 258 259config IP_NF_TARGET_NETMAP 260 tristate "NETMAP target support" 261 depends on NETFILTER_ADVANCED 262 select NETFILTER_XT_TARGET_NETMAP 263 ---help--- 264 This is a backwards-compat option for the user's convenience 265 (e.g. when running oldconfig). It selects 266 CONFIG_NETFILTER_XT_TARGET_NETMAP. 267 268config IP_NF_TARGET_REDIRECT 269 tristate "REDIRECT target support" 270 depends on NETFILTER_ADVANCED 271 select NETFILTER_XT_TARGET_REDIRECT 272 ---help--- 273 This is a backwards-compat option for the user's convenience 274 (e.g. when running oldconfig). It selects 275 CONFIG_NETFILTER_XT_TARGET_REDIRECT. 276 277endif # IP_NF_NAT 278 279# mangle + specific targets 280config IP_NF_MANGLE 281 tristate "Packet mangling" 282 default m if NETFILTER_ADVANCED=n 283 help 284 This option adds a `mangle' table to iptables: see the man page for 285 iptables(8). This table is used for various packet alterations 286 which can effect how the packet is routed. 287 288 To compile it as a module, choose M here. If unsure, say N. 289 290config IP_NF_TARGET_CLUSTERIP 291 tristate "CLUSTERIP target support" 292 depends on IP_NF_MANGLE 293 depends on NF_CONNTRACK_IPV4 294 depends on NETFILTER_ADVANCED 295 select NF_CONNTRACK_MARK 296 help 297 The CLUSTERIP target allows you to build load-balancing clusters of 298 network servers without having a dedicated load-balancing 299 router/server/switch. 300 301 To compile it as a module, choose M here. If unsure, say N. 302 303config IP_NF_TARGET_ECN 304 tristate "ECN target support" 305 depends on IP_NF_MANGLE 306 depends on NETFILTER_ADVANCED 307 ---help--- 308 This option adds a `ECN' target, which can be used in the iptables mangle 309 table. 310 311 You can use this target to remove the ECN bits from the IPv4 header of 312 an IP packet. This is particularly useful, if you need to work around 313 existing ECN blackholes on the internet, but don't want to disable 314 ECN support in general. 315 316 To compile it as a module, choose M here. If unsure, say N. 317 318config IP_NF_TARGET_TTL 319 tristate '"TTL" target support' 320 depends on NETFILTER_ADVANCED && IP_NF_MANGLE 321 select NETFILTER_XT_TARGET_HL 322 ---help--- 323 This is a backwards-compatible option for the user's convenience 324 (e.g. when running oldconfig). It selects 325 CONFIG_NETFILTER_XT_TARGET_HL. 326 327# raw + specific targets 328config IP_NF_RAW 329 tristate 'raw table support (required for NOTRACK/TRACE)' 330 help 331 This option adds a `raw' table to iptables. This table is the very 332 first in the netfilter framework and hooks in at the PREROUTING 333 and OUTPUT chains. 334 335 If you want to compile it as a module, say M here and read 336 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 337 338# security table for MAC policy 339config IP_NF_SECURITY 340 tristate "Security table" 341 depends on SECURITY 342 depends on NETFILTER_ADVANCED 343 help 344 This option adds a `security' table to iptables, for use 345 with Mandatory Access Control (MAC) policy. 346 347 If unsure, say N. 348 349endif # IP_NF_IPTABLES 350 351# ARP tables 352config IP_NF_ARPTABLES 353 tristate "ARP tables support" 354 select NETFILTER_XTABLES 355 depends on NETFILTER_ADVANCED 356 help 357 arptables is a general, extensible packet identification framework. 358 The ARP packet filtering and mangling (manipulation)subsystems 359 use this: say Y or M here if you want to use either of those. 360 361 To compile it as a module, choose M here. If unsure, say N. 362 363if IP_NF_ARPTABLES 364 365config IP_NF_ARPFILTER 366 tristate "ARP packet filtering" 367 help 368 ARP packet filtering defines a table `filter', which has a series of 369 rules for simple ARP packet filtering at local input and 370 local output. On a bridge, you can also specify filtering rules 371 for forwarded ARP packets. See the man page for arptables(8). 372 373 To compile it as a module, choose M here. If unsure, say N. 374 375config IP_NF_ARP_MANGLE 376 tristate "ARP payload mangling" 377 help 378 Allows altering the ARP packet payload: source and destination 379 hardware and network addresses. 380 381endif # IP_NF_ARPTABLES 382 383endmenu 384 385