1# 2# IP netfilter configuration 3# 4 5menu "IP: Netfilter Configuration" 6 depends on INET && NETFILTER 7 8config NF_DEFRAG_IPV4 9 tristate 10 default n 11 12config NF_CONNTRACK_IPV4 13 tristate "IPv4 connection tracking support (required for NAT)" 14 depends on NF_CONNTRACK 15 default m if NETFILTER_ADVANCED=n 16 select NF_DEFRAG_IPV4 17 ---help--- 18 Connection tracking keeps a record of what packets have passed 19 through your machine, in order to figure out how they are related 20 into connections. 21 22 This is IPv4 support on Layer 3 independent connection tracking. 23 Layer 3 independent connection tracking is experimental scheme 24 which generalize ip_conntrack to support other layer 3 protocols. 25 26 To compile it as a module, choose M here. If unsure, say N. 27 28config NF_CONNTRACK_PROC_COMPAT 29 bool "proc/sysctl compatibility with old connection tracking" 30 depends on NF_CONNTRACK_PROCFS && NF_CONNTRACK_IPV4 31 default y 32 help 33 This option enables /proc and sysctl compatibility with the old 34 layer 3 dependent connection tracking. This is needed to keep 35 old programs that have not been adapted to the new names working. 36 37 If unsure, say Y. 38 39if NF_TABLES 40 41config NF_TABLES_IPV4 42 tristate "IPv4 nf_tables support" 43 help 44 This option enables the IPv4 support for nf_tables. 45 46if NF_TABLES_IPV4 47 48config NFT_CHAIN_ROUTE_IPV4 49 tristate "IPv4 nf_tables route chain support" 50 help 51 This option enables the "route" chain for IPv4 in nf_tables. This 52 chain type is used to force packet re-routing after mangling header 53 fields such as the source, destination, type of service and 54 the packet mark. 55 56config NFT_REJECT_IPV4 57 select NF_REJECT_IPV4 58 default NFT_REJECT 59 tristate 60 61config NFT_DUP_IPV4 62 tristate "IPv4 nf_tables packet duplication support" 63 depends on !NF_CONNTRACK || NF_CONNTRACK 64 select NF_DUP_IPV4 65 help 66 This module enables IPv4 packet duplication support for nf_tables. 67 68endif # NF_TABLES_IPV4 69 70config NF_TABLES_ARP 71 tristate "ARP nf_tables support" 72 help 73 This option enables the ARP support for nf_tables. 74 75endif # NF_TABLES 76 77config NF_DUP_IPV4 78 tristate "Netfilter IPv4 packet duplication to alternate destination" 79 depends on !NF_CONNTRACK || NF_CONNTRACK 80 help 81 This option enables the nf_dup_ipv4 core, which duplicates an IPv4 82 packet to be rerouted to another destination. 83 84config NF_LOG_ARP 85 tristate "ARP packet logging" 86 default m if NETFILTER_ADVANCED=n 87 select NF_LOG_COMMON 88 89config NF_LOG_IPV4 90 tristate "IPv4 packet logging" 91 default m if NETFILTER_ADVANCED=n 92 select NF_LOG_COMMON 93 94config NF_REJECT_IPV4 95 tristate "IPv4 packet rejection" 96 default m if NETFILTER_ADVANCED=n 97 98config NF_NAT_IPV4 99 tristate "IPv4 NAT" 100 depends on NF_CONNTRACK_IPV4 101 default m if NETFILTER_ADVANCED=n 102 select NF_NAT 103 help 104 The IPv4 NAT option allows masquerading, port forwarding and other 105 forms of full Network Address Port Translation. This can be 106 controlled by iptables or nft. 107 108if NF_NAT_IPV4 109 110config NFT_CHAIN_NAT_IPV4 111 depends on NF_TABLES_IPV4 112 tristate "IPv4 nf_tables nat chain support" 113 help 114 This option enables the "nat" chain for IPv4 in nf_tables. This 115 chain type is used to perform Network Address Translation (NAT) 116 packet transformations such as the source, destination address and 117 source and destination ports. 118 119config NF_NAT_MASQUERADE_IPV4 120 tristate "IPv4 masquerade support" 121 help 122 This is the kernel functionality to provide NAT in the masquerade 123 flavour (automatic source address selection). 124 125config NFT_MASQ_IPV4 126 tristate "IPv4 masquerading support for nf_tables" 127 depends on NF_TABLES_IPV4 128 depends on NFT_MASQ 129 select NF_NAT_MASQUERADE_IPV4 130 help 131 This is the expression that provides IPv4 masquerading support for 132 nf_tables. 133 134config NFT_REDIR_IPV4 135 tristate "IPv4 redirect support for nf_tables" 136 depends on NF_TABLES_IPV4 137 depends on NFT_REDIR 138 select NF_NAT_REDIRECT 139 help 140 This is the expression that provides IPv4 redirect support for 141 nf_tables. 142 143config NF_NAT_SNMP_BASIC 144 tristate "Basic SNMP-ALG support" 145 depends on NF_CONNTRACK_SNMP 146 depends on NETFILTER_ADVANCED 147 default NF_NAT && NF_CONNTRACK_SNMP 148 ---help--- 149 150 This module implements an Application Layer Gateway (ALG) for 151 SNMP payloads. In conjunction with NAT, it allows a network 152 management system to access multiple private networks with 153 conflicting addresses. It works by modifying IP addresses 154 inside SNMP payloads to match IP-layer NAT mapping. 155 156 This is the "basic" form of SNMP-ALG, as described in RFC 2962 157 158 To compile it as a module, choose M here. If unsure, say N. 159 160config NF_NAT_PROTO_GRE 161 tristate 162 depends on NF_CT_PROTO_GRE 163 164config NF_NAT_PPTP 165 tristate 166 depends on NF_CONNTRACK 167 default NF_CONNTRACK_PPTP 168 select NF_NAT_PROTO_GRE 169 170config NF_NAT_H323 171 tristate 172 depends on NF_CONNTRACK 173 default NF_CONNTRACK_H323 174 175endif # NF_NAT_IPV4 176 177config IP_NF_IPTABLES 178 tristate "IP tables support (required for filtering/masq/NAT)" 179 default m if NETFILTER_ADVANCED=n 180 select NETFILTER_XTABLES 181 help 182 iptables is a general, extensible packet identification framework. 183 The packet filtering and full NAT (masquerading, port forwarding, 184 etc) subsystems now use this: say `Y' or `M' here if you want to use 185 either of those. 186 187 To compile it as a module, choose M here. If unsure, say N. 188 189if IP_NF_IPTABLES 190 191# The matches. 192config IP_NF_MATCH_AH 193 tristate '"ah" match support' 194 depends on NETFILTER_ADVANCED 195 help 196 This match extension allows you to match a range of SPIs 197 inside AH header of IPSec packets. 198 199 To compile it as a module, choose M here. If unsure, say N. 200 201config IP_NF_MATCH_ECN 202 tristate '"ecn" match support' 203 depends on NETFILTER_ADVANCED 204 select NETFILTER_XT_MATCH_ECN 205 ---help--- 206 This is a backwards-compat option for the user's convenience 207 (e.g. when running oldconfig). It selects 208 CONFIG_NETFILTER_XT_MATCH_ECN. 209 210config IP_NF_MATCH_RPFILTER 211 tristate '"rpfilter" reverse path filter match support' 212 depends on NETFILTER_ADVANCED 213 depends on IP_NF_MANGLE || IP_NF_RAW 214 ---help--- 215 This option allows you to match packets whose replies would 216 go out via the interface the packet came in. 217 218 To compile it as a module, choose M here. If unsure, say N. 219 The module will be called ipt_rpfilter. 220 221config IP_NF_MATCH_TTL 222 tristate '"ttl" match support' 223 depends on NETFILTER_ADVANCED 224 select NETFILTER_XT_MATCH_HL 225 ---help--- 226 This is a backwards-compat option for the user's convenience 227 (e.g. when running oldconfig). It selects 228 CONFIG_NETFILTER_XT_MATCH_HL. 229 230# `filter', generic and specific targets 231config IP_NF_FILTER 232 tristate "Packet filtering" 233 default m if NETFILTER_ADVANCED=n 234 help 235 Packet filtering defines a table `filter', which has a series of 236 rules for simple packet filtering at local input, forwarding and 237 local output. See the man page for iptables(8). 238 239 To compile it as a module, choose M here. If unsure, say N. 240 241config IP_NF_TARGET_REJECT 242 tristate "REJECT target support" 243 depends on IP_NF_FILTER 244 select NF_REJECT_IPV4 245 default m if NETFILTER_ADVANCED=n 246 help 247 The REJECT target allows a filtering rule to specify that an ICMP 248 error should be issued in response to an incoming packet, rather 249 than silently being dropped. 250 251 To compile it as a module, choose M here. If unsure, say N. 252 253config IP_NF_TARGET_SYNPROXY 254 tristate "SYNPROXY target support" 255 depends on NF_CONNTRACK && NETFILTER_ADVANCED 256 select NETFILTER_SYNPROXY 257 select SYN_COOKIES 258 help 259 The SYNPROXY target allows you to intercept TCP connections and 260 establish them using syncookies before they are passed on to the 261 server. This allows to avoid conntrack and server resource usage 262 during SYN-flood attacks. 263 264 To compile it as a module, choose M here. If unsure, say N. 265 266# NAT + specific targets: nf_conntrack 267config IP_NF_NAT 268 tristate "iptables NAT support" 269 depends on NF_CONNTRACK_IPV4 270 default m if NETFILTER_ADVANCED=n 271 select NF_NAT 272 select NF_NAT_IPV4 273 select NETFILTER_XT_NAT 274 help 275 This enables the `nat' table in iptables. This allows masquerading, 276 port forwarding and other forms of full Network Address Port 277 Translation. 278 279 To compile it as a module, choose M here. If unsure, say N. 280 281if IP_NF_NAT 282 283config IP_NF_TARGET_MASQUERADE 284 tristate "MASQUERADE target support" 285 select NF_NAT_MASQUERADE_IPV4 286 default m if NETFILTER_ADVANCED=n 287 help 288 Masquerading is a special case of NAT: all outgoing connections are 289 changed to seem to come from a particular interface's address, and 290 if the interface goes down, those connections are lost. This is 291 only useful for dialup accounts with dynamic IP address (ie. your IP 292 address will be different on next dialup). 293 294 To compile it as a module, choose M here. If unsure, say N. 295 296config IP_NF_TARGET_NETMAP 297 tristate "NETMAP target support" 298 depends on NETFILTER_ADVANCED 299 select NETFILTER_XT_TARGET_NETMAP 300 ---help--- 301 This is a backwards-compat option for the user's convenience 302 (e.g. when running oldconfig). It selects 303 CONFIG_NETFILTER_XT_TARGET_NETMAP. 304 305config IP_NF_TARGET_REDIRECT 306 tristate "REDIRECT target support" 307 depends on NETFILTER_ADVANCED 308 select NETFILTER_XT_TARGET_REDIRECT 309 ---help--- 310 This is a backwards-compat option for the user's convenience 311 (e.g. when running oldconfig). It selects 312 CONFIG_NETFILTER_XT_TARGET_REDIRECT. 313 314endif # IP_NF_NAT 315 316# mangle + specific targets 317config IP_NF_MANGLE 318 tristate "Packet mangling" 319 default m if NETFILTER_ADVANCED=n 320 help 321 This option adds a `mangle' table to iptables: see the man page for 322 iptables(8). This table is used for various packet alterations 323 which can effect how the packet is routed. 324 325 To compile it as a module, choose M here. If unsure, say N. 326 327config IP_NF_TARGET_CLUSTERIP 328 tristate "CLUSTERIP target support" 329 depends on IP_NF_MANGLE 330 depends on NF_CONNTRACK_IPV4 331 depends on NETFILTER_ADVANCED 332 select NF_CONNTRACK_MARK 333 help 334 The CLUSTERIP target allows you to build load-balancing clusters of 335 network servers without having a dedicated load-balancing 336 router/server/switch. 337 338 To compile it as a module, choose M here. If unsure, say N. 339 340config IP_NF_TARGET_ECN 341 tristate "ECN target support" 342 depends on IP_NF_MANGLE 343 depends on NETFILTER_ADVANCED 344 ---help--- 345 This option adds a `ECN' target, which can be used in the iptables mangle 346 table. 347 348 You can use this target to remove the ECN bits from the IPv4 header of 349 an IP packet. This is particularly useful, if you need to work around 350 existing ECN blackholes on the internet, but don't want to disable 351 ECN support in general. 352 353 To compile it as a module, choose M here. If unsure, say N. 354 355config IP_NF_TARGET_TTL 356 tristate '"TTL" target support' 357 depends on NETFILTER_ADVANCED && IP_NF_MANGLE 358 select NETFILTER_XT_TARGET_HL 359 ---help--- 360 This is a backwards-compatible option for the user's convenience 361 (e.g. when running oldconfig). It selects 362 CONFIG_NETFILTER_XT_TARGET_HL. 363 364# raw + specific targets 365config IP_NF_RAW 366 tristate 'raw table support (required for NOTRACK/TRACE)' 367 help 368 This option adds a `raw' table to iptables. This table is the very 369 first in the netfilter framework and hooks in at the PREROUTING 370 and OUTPUT chains. 371 372 If you want to compile it as a module, say M here and read 373 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 374 375# security table for MAC policy 376config IP_NF_SECURITY 377 tristate "Security table" 378 depends on SECURITY 379 depends on NETFILTER_ADVANCED 380 help 381 This option adds a `security' table to iptables, for use 382 with Mandatory Access Control (MAC) policy. 383 384 If unsure, say N. 385 386endif # IP_NF_IPTABLES 387 388# ARP tables 389config IP_NF_ARPTABLES 390 tristate "ARP tables support" 391 select NETFILTER_XTABLES 392 depends on NETFILTER_ADVANCED 393 help 394 arptables is a general, extensible packet identification framework. 395 The ARP packet filtering and mangling (manipulation)subsystems 396 use this: say Y or M here if you want to use either of those. 397 398 To compile it as a module, choose M here. If unsure, say N. 399 400if IP_NF_ARPTABLES 401 402config IP_NF_ARPFILTER 403 tristate "ARP packet filtering" 404 help 405 ARP packet filtering defines a table `filter', which has a series of 406 rules for simple ARP packet filtering at local input and 407 local output. On a bridge, you can also specify filtering rules 408 for forwarded ARP packets. See the man page for arptables(8). 409 410 To compile it as a module, choose M here. If unsure, say N. 411 412config IP_NF_ARP_MANGLE 413 tristate "ARP payload mangling" 414 help 415 Allows altering the ARP packet payload: source and destination 416 hardware and network addresses. 417 418endif # IP_NF_ARPTABLES 419 420endmenu 421 422