1# 2# IP netfilter configuration 3# 4 5menu "IP: Netfilter Configuration" 6 depends on INET && NETFILTER 7 8config NF_DEFRAG_IPV4 9 tristate 10 default n 11 12config NF_CONNTRACK_IPV4 13 tristate "IPv4 connection tracking support (required for NAT)" 14 depends on NF_CONNTRACK 15 default m if NETFILTER_ADVANCED=n 16 select NF_DEFRAG_IPV4 17 ---help--- 18 Connection tracking keeps a record of what packets have passed 19 through your machine, in order to figure out how they are related 20 into connections. 21 22 This is IPv4 support on Layer 3 independent connection tracking. 23 Layer 3 independent connection tracking is experimental scheme 24 which generalize ip_conntrack to support other layer 3 protocols. 25 26 To compile it as a module, choose M here. If unsure, say N. 27 28config NF_CONNTRACK_PROC_COMPAT 29 bool "proc/sysctl compatibility with old connection tracking" 30 depends on NF_CONNTRACK_PROCFS && NF_CONNTRACK_IPV4 31 default y 32 help 33 This option enables /proc and sysctl compatibility with the old 34 layer 3 dependent connection tracking. This is needed to keep 35 old programs that have not been adapted to the new names working. 36 37 If unsure, say Y. 38 39if NF_TABLES 40 41config NF_TABLES_IPV4 42 tristate "IPv4 nf_tables support" 43 help 44 This option enables the IPv4 support for nf_tables. 45 46if NF_TABLES_IPV4 47 48config NFT_CHAIN_ROUTE_IPV4 49 tristate "IPv4 nf_tables route chain support" 50 help 51 This option enables the "route" chain for IPv4 in nf_tables. This 52 chain type is used to force packet re-routing after mangling header 53 fields such as the source, destination, type of service and 54 the packet mark. 55 56config NFT_REJECT_IPV4 57 select NF_REJECT_IPV4 58 default NFT_REJECT 59 tristate 60 61config NFT_DUP_IPV4 62 tristate "IPv4 nf_tables packet duplication support" 63 select NF_DUP_IPV4 64 help 65 This module enables IPv4 packet duplication support for nf_tables. 66 67endif # NF_TABLES_IPV4 68 69config NF_TABLES_ARP 70 tristate "ARP nf_tables support" 71 help 72 This option enables the ARP support for nf_tables. 73 74endif # NF_TABLES 75 76config NF_DUP_IPV4 77 tristate "Netfilter IPv4 packet duplication to alternate destination" 78 depends on !NF_CONNTRACK || NF_CONNTRACK 79 help 80 This option enables the nf_dup_ipv4 core, which duplicates an IPv4 81 packet to be rerouted to another destination. 82 83config NF_LOG_ARP 84 tristate "ARP packet logging" 85 default m if NETFILTER_ADVANCED=n 86 select NF_LOG_COMMON 87 88config NF_LOG_IPV4 89 tristate "IPv4 packet logging" 90 default m if NETFILTER_ADVANCED=n 91 select NF_LOG_COMMON 92 93config NF_REJECT_IPV4 94 tristate "IPv4 packet rejection" 95 default m if NETFILTER_ADVANCED=n 96 97config NF_NAT_IPV4 98 tristate "IPv4 NAT" 99 depends on NF_CONNTRACK_IPV4 100 default m if NETFILTER_ADVANCED=n 101 select NF_NAT 102 help 103 The IPv4 NAT option allows masquerading, port forwarding and other 104 forms of full Network Address Port Translation. This can be 105 controlled by iptables or nft. 106 107if NF_NAT_IPV4 108 109config NFT_CHAIN_NAT_IPV4 110 depends on NF_TABLES_IPV4 111 tristate "IPv4 nf_tables nat chain support" 112 help 113 This option enables the "nat" chain for IPv4 in nf_tables. This 114 chain type is used to perform Network Address Translation (NAT) 115 packet transformations such as the source, destination address and 116 source and destination ports. 117 118config NF_NAT_MASQUERADE_IPV4 119 tristate "IPv4 masquerade support" 120 help 121 This is the kernel functionality to provide NAT in the masquerade 122 flavour (automatic source address selection). 123 124config NFT_MASQ_IPV4 125 tristate "IPv4 masquerading support for nf_tables" 126 depends on NF_TABLES_IPV4 127 depends on NFT_MASQ 128 select NF_NAT_MASQUERADE_IPV4 129 help 130 This is the expression that provides IPv4 masquerading support for 131 nf_tables. 132 133config NFT_REDIR_IPV4 134 tristate "IPv4 redirect support for nf_tables" 135 depends on NF_TABLES_IPV4 136 depends on NFT_REDIR 137 select NF_NAT_REDIRECT 138 help 139 This is the expression that provides IPv4 redirect support for 140 nf_tables. 141 142config NF_NAT_SNMP_BASIC 143 tristate "Basic SNMP-ALG support" 144 depends on NF_CONNTRACK_SNMP 145 depends on NETFILTER_ADVANCED 146 default NF_NAT && NF_CONNTRACK_SNMP 147 ---help--- 148 149 This module implements an Application Layer Gateway (ALG) for 150 SNMP payloads. In conjunction with NAT, it allows a network 151 management system to access multiple private networks with 152 conflicting addresses. It works by modifying IP addresses 153 inside SNMP payloads to match IP-layer NAT mapping. 154 155 This is the "basic" form of SNMP-ALG, as described in RFC 2962 156 157 To compile it as a module, choose M here. If unsure, say N. 158 159config NF_NAT_PROTO_GRE 160 tristate 161 depends on NF_CT_PROTO_GRE 162 163config NF_NAT_PPTP 164 tristate 165 depends on NF_CONNTRACK 166 default NF_CONNTRACK_PPTP 167 select NF_NAT_PROTO_GRE 168 169config NF_NAT_H323 170 tristate 171 depends on NF_CONNTRACK 172 default NF_CONNTRACK_H323 173 174endif # NF_NAT_IPV4 175 176config IP_NF_IPTABLES 177 tristate "IP tables support (required for filtering/masq/NAT)" 178 default m if NETFILTER_ADVANCED=n 179 select NETFILTER_XTABLES 180 help 181 iptables is a general, extensible packet identification framework. 182 The packet filtering and full NAT (masquerading, port forwarding, 183 etc) subsystems now use this: say `Y' or `M' here if you want to use 184 either of those. 185 186 To compile it as a module, choose M here. If unsure, say N. 187 188if IP_NF_IPTABLES 189 190# The matches. 191config IP_NF_MATCH_AH 192 tristate '"ah" match support' 193 depends on NETFILTER_ADVANCED 194 help 195 This match extension allows you to match a range of SPIs 196 inside AH header of IPSec packets. 197 198 To compile it as a module, choose M here. If unsure, say N. 199 200config IP_NF_MATCH_ECN 201 tristate '"ecn" match support' 202 depends on NETFILTER_ADVANCED 203 select NETFILTER_XT_MATCH_ECN 204 ---help--- 205 This is a backwards-compat option for the user's convenience 206 (e.g. when running oldconfig). It selects 207 CONFIG_NETFILTER_XT_MATCH_ECN. 208 209config IP_NF_MATCH_RPFILTER 210 tristate '"rpfilter" reverse path filter match support' 211 depends on NETFILTER_ADVANCED 212 depends on IP_NF_MANGLE || IP_NF_RAW 213 ---help--- 214 This option allows you to match packets whose replies would 215 go out via the interface the packet came in. 216 217 To compile it as a module, choose M here. If unsure, say N. 218 The module will be called ipt_rpfilter. 219 220config IP_NF_MATCH_TTL 221 tristate '"ttl" match support' 222 depends on NETFILTER_ADVANCED 223 select NETFILTER_XT_MATCH_HL 224 ---help--- 225 This is a backwards-compat option for the user's convenience 226 (e.g. when running oldconfig). It selects 227 CONFIG_NETFILTER_XT_MATCH_HL. 228 229# `filter', generic and specific targets 230config IP_NF_FILTER 231 tristate "Packet filtering" 232 default m if NETFILTER_ADVANCED=n 233 help 234 Packet filtering defines a table `filter', which has a series of 235 rules for simple packet filtering at local input, forwarding and 236 local output. See the man page for iptables(8). 237 238 To compile it as a module, choose M here. If unsure, say N. 239 240config IP_NF_TARGET_REJECT 241 tristate "REJECT target support" 242 depends on IP_NF_FILTER 243 select NF_REJECT_IPV4 244 default m if NETFILTER_ADVANCED=n 245 help 246 The REJECT target allows a filtering rule to specify that an ICMP 247 error should be issued in response to an incoming packet, rather 248 than silently being dropped. 249 250 To compile it as a module, choose M here. If unsure, say N. 251 252config IP_NF_TARGET_SYNPROXY 253 tristate "SYNPROXY target support" 254 depends on NF_CONNTRACK && NETFILTER_ADVANCED 255 select NETFILTER_SYNPROXY 256 select SYN_COOKIES 257 help 258 The SYNPROXY target allows you to intercept TCP connections and 259 establish them using syncookies before they are passed on to the 260 server. This allows to avoid conntrack and server resource usage 261 during SYN-flood attacks. 262 263 To compile it as a module, choose M here. If unsure, say N. 264 265# NAT + specific targets: nf_conntrack 266config IP_NF_NAT 267 tristate "iptables NAT support" 268 depends on NF_CONNTRACK_IPV4 269 default m if NETFILTER_ADVANCED=n 270 select NF_NAT 271 select NF_NAT_IPV4 272 select NETFILTER_XT_NAT 273 help 274 This enables the `nat' table in iptables. This allows masquerading, 275 port forwarding and other forms of full Network Address Port 276 Translation. 277 278 To compile it as a module, choose M here. If unsure, say N. 279 280if IP_NF_NAT 281 282config IP_NF_TARGET_MASQUERADE 283 tristate "MASQUERADE target support" 284 select NF_NAT_MASQUERADE_IPV4 285 default m if NETFILTER_ADVANCED=n 286 help 287 Masquerading is a special case of NAT: all outgoing connections are 288 changed to seem to come from a particular interface's address, and 289 if the interface goes down, those connections are lost. This is 290 only useful for dialup accounts with dynamic IP address (ie. your IP 291 address will be different on next dialup). 292 293 To compile it as a module, choose M here. If unsure, say N. 294 295config IP_NF_TARGET_NETMAP 296 tristate "NETMAP target support" 297 depends on NETFILTER_ADVANCED 298 select NETFILTER_XT_TARGET_NETMAP 299 ---help--- 300 This is a backwards-compat option for the user's convenience 301 (e.g. when running oldconfig). It selects 302 CONFIG_NETFILTER_XT_TARGET_NETMAP. 303 304config IP_NF_TARGET_REDIRECT 305 tristate "REDIRECT target support" 306 depends on NETFILTER_ADVANCED 307 select NETFILTER_XT_TARGET_REDIRECT 308 ---help--- 309 This is a backwards-compat option for the user's convenience 310 (e.g. when running oldconfig). It selects 311 CONFIG_NETFILTER_XT_TARGET_REDIRECT. 312 313endif # IP_NF_NAT 314 315# mangle + specific targets 316config IP_NF_MANGLE 317 tristate "Packet mangling" 318 default m if NETFILTER_ADVANCED=n 319 help 320 This option adds a `mangle' table to iptables: see the man page for 321 iptables(8). This table is used for various packet alterations 322 which can effect how the packet is routed. 323 324 To compile it as a module, choose M here. If unsure, say N. 325 326config IP_NF_TARGET_CLUSTERIP 327 tristate "CLUSTERIP target support" 328 depends on IP_NF_MANGLE 329 depends on NF_CONNTRACK_IPV4 330 depends on NETFILTER_ADVANCED 331 select NF_CONNTRACK_MARK 332 help 333 The CLUSTERIP target allows you to build load-balancing clusters of 334 network servers without having a dedicated load-balancing 335 router/server/switch. 336 337 To compile it as a module, choose M here. If unsure, say N. 338 339config IP_NF_TARGET_ECN 340 tristate "ECN target support" 341 depends on IP_NF_MANGLE 342 depends on NETFILTER_ADVANCED 343 ---help--- 344 This option adds a `ECN' target, which can be used in the iptables mangle 345 table. 346 347 You can use this target to remove the ECN bits from the IPv4 header of 348 an IP packet. This is particularly useful, if you need to work around 349 existing ECN blackholes on the internet, but don't want to disable 350 ECN support in general. 351 352 To compile it as a module, choose M here. If unsure, say N. 353 354config IP_NF_TARGET_TTL 355 tristate '"TTL" target support' 356 depends on NETFILTER_ADVANCED && IP_NF_MANGLE 357 select NETFILTER_XT_TARGET_HL 358 ---help--- 359 This is a backwards-compatible option for the user's convenience 360 (e.g. when running oldconfig). It selects 361 CONFIG_NETFILTER_XT_TARGET_HL. 362 363# raw + specific targets 364config IP_NF_RAW 365 tristate 'raw table support (required for NOTRACK/TRACE)' 366 help 367 This option adds a `raw' table to iptables. This table is the very 368 first in the netfilter framework and hooks in at the PREROUTING 369 and OUTPUT chains. 370 371 If you want to compile it as a module, say M here and read 372 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 373 374# security table for MAC policy 375config IP_NF_SECURITY 376 tristate "Security table" 377 depends on SECURITY 378 depends on NETFILTER_ADVANCED 379 help 380 This option adds a `security' table to iptables, for use 381 with Mandatory Access Control (MAC) policy. 382 383 If unsure, say N. 384 385endif # IP_NF_IPTABLES 386 387# ARP tables 388config IP_NF_ARPTABLES 389 tristate "ARP tables support" 390 select NETFILTER_XTABLES 391 depends on NETFILTER_ADVANCED 392 help 393 arptables is a general, extensible packet identification framework. 394 The ARP packet filtering and mangling (manipulation)subsystems 395 use this: say Y or M here if you want to use either of those. 396 397 To compile it as a module, choose M here. If unsure, say N. 398 399if IP_NF_ARPTABLES 400 401config IP_NF_ARPFILTER 402 tristate "ARP packet filtering" 403 help 404 ARP packet filtering defines a table `filter', which has a series of 405 rules for simple ARP packet filtering at local input and 406 local output. On a bridge, you can also specify filtering rules 407 for forwarded ARP packets. See the man page for arptables(8). 408 409 To compile it as a module, choose M here. If unsure, say N. 410 411config IP_NF_ARP_MANGLE 412 tristate "ARP payload mangling" 413 help 414 Allows altering the ARP packet payload: source and destination 415 hardware and network addresses. 416 417endif # IP_NF_ARPTABLES 418 419endmenu 420 421