1# 2# IP netfilter configuration 3# 4 5menu "IP: Netfilter Configuration" 6 depends on INET && NETFILTER 7 8config NF_DEFRAG_IPV4 9 tristate 10 default n 11 12config NF_SOCKET_IPV4 13 tristate "IPv4 socket lookup support" 14 help 15 This option enables the IPv4 socket lookup infrastructure. This is 16 is required by the {ip,nf}tables socket match. 17 18config NF_TPROXY_IPV4 19 tristate "IPv4 tproxy support" 20 21if NF_TABLES 22 23config NF_TABLES_IPV4 24 bool "IPv4 nf_tables support" 25 help 26 This option enables the IPv4 support for nf_tables. 27 28if NF_TABLES_IPV4 29 30config NFT_REJECT_IPV4 31 select NF_REJECT_IPV4 32 default NFT_REJECT 33 tristate 34 35config NFT_DUP_IPV4 36 tristate "IPv4 nf_tables packet duplication support" 37 depends on !NF_CONNTRACK || NF_CONNTRACK 38 select NF_DUP_IPV4 39 help 40 This module enables IPv4 packet duplication support for nf_tables. 41 42config NFT_FIB_IPV4 43 select NFT_FIB 44 tristate "nf_tables fib / ip route lookup support" 45 help 46 This module enables IPv4 FIB lookups, e.g. for reverse path filtering. 47 It also allows query of the FIB for the route type, e.g. local, unicast, 48 multicast or blackhole. 49 50endif # NF_TABLES_IPV4 51 52config NF_TABLES_ARP 53 bool "ARP nf_tables support" 54 select NETFILTER_FAMILY_ARP 55 help 56 This option enables the ARP support for nf_tables. 57 58endif # NF_TABLES 59 60config NF_FLOW_TABLE_IPV4 61 tristate "Netfilter flow table IPv4 module" 62 depends on NF_FLOW_TABLE 63 help 64 This option adds the flow table IPv4 support. 65 66 To compile it as a module, choose M here. 67 68config NF_DUP_IPV4 69 tristate "Netfilter IPv4 packet duplication to alternate destination" 70 depends on !NF_CONNTRACK || NF_CONNTRACK 71 help 72 This option enables the nf_dup_ipv4 core, which duplicates an IPv4 73 packet to be rerouted to another destination. 74 75config NF_LOG_ARP 76 tristate "ARP packet logging" 77 default m if NETFILTER_ADVANCED=n 78 select NF_LOG_COMMON 79 80config NF_LOG_IPV4 81 tristate "IPv4 packet logging" 82 default m if NETFILTER_ADVANCED=n 83 select NF_LOG_COMMON 84 85config NF_REJECT_IPV4 86 tristate "IPv4 packet rejection" 87 default m if NETFILTER_ADVANCED=n 88 89if NF_NAT 90config NF_NAT_SNMP_BASIC 91 tristate "Basic SNMP-ALG support" 92 depends on NF_CONNTRACK_SNMP 93 depends on NETFILTER_ADVANCED 94 default NF_NAT && NF_CONNTRACK_SNMP 95 select ASN1 96 ---help--- 97 98 This module implements an Application Layer Gateway (ALG) for 99 SNMP payloads. In conjunction with NAT, it allows a network 100 management system to access multiple private networks with 101 conflicting addresses. It works by modifying IP addresses 102 inside SNMP payloads to match IP-layer NAT mapping. 103 104 This is the "basic" form of SNMP-ALG, as described in RFC 2962 105 106 To compile it as a module, choose M here. If unsure, say N. 107 108config NF_NAT_PPTP 109 tristate 110 depends on NF_CONNTRACK 111 default NF_CONNTRACK_PPTP 112 113config NF_NAT_H323 114 tristate 115 depends on NF_CONNTRACK 116 default NF_CONNTRACK_H323 117 118endif # NF_NAT 119 120config IP_NF_IPTABLES 121 tristate "IP tables support (required for filtering/masq/NAT)" 122 default m if NETFILTER_ADVANCED=n 123 select NETFILTER_XTABLES 124 help 125 iptables is a general, extensible packet identification framework. 126 The packet filtering and full NAT (masquerading, port forwarding, 127 etc) subsystems now use this: say `Y' or `M' here if you want to use 128 either of those. 129 130 To compile it as a module, choose M here. If unsure, say N. 131 132if IP_NF_IPTABLES 133 134# The matches. 135config IP_NF_MATCH_AH 136 tristate '"ah" match support' 137 depends on NETFILTER_ADVANCED 138 help 139 This match extension allows you to match a range of SPIs 140 inside AH header of IPSec packets. 141 142 To compile it as a module, choose M here. If unsure, say N. 143 144config IP_NF_MATCH_ECN 145 tristate '"ecn" match support' 146 depends on NETFILTER_ADVANCED 147 select NETFILTER_XT_MATCH_ECN 148 ---help--- 149 This is a backwards-compat option for the user's convenience 150 (e.g. when running oldconfig). It selects 151 CONFIG_NETFILTER_XT_MATCH_ECN. 152 153config IP_NF_MATCH_RPFILTER 154 tristate '"rpfilter" reverse path filter match support' 155 depends on NETFILTER_ADVANCED 156 depends on IP_NF_MANGLE || IP_NF_RAW 157 ---help--- 158 This option allows you to match packets whose replies would 159 go out via the interface the packet came in. 160 161 To compile it as a module, choose M here. If unsure, say N. 162 The module will be called ipt_rpfilter. 163 164config IP_NF_MATCH_TTL 165 tristate '"ttl" match support' 166 depends on NETFILTER_ADVANCED 167 select NETFILTER_XT_MATCH_HL 168 ---help--- 169 This is a backwards-compat option for the user's convenience 170 (e.g. when running oldconfig). It selects 171 CONFIG_NETFILTER_XT_MATCH_HL. 172 173# `filter', generic and specific targets 174config IP_NF_FILTER 175 tristate "Packet filtering" 176 default m if NETFILTER_ADVANCED=n 177 help 178 Packet filtering defines a table `filter', which has a series of 179 rules for simple packet filtering at local input, forwarding and 180 local output. See the man page for iptables(8). 181 182 To compile it as a module, choose M here. If unsure, say N. 183 184config IP_NF_TARGET_REJECT 185 tristate "REJECT target support" 186 depends on IP_NF_FILTER 187 select NF_REJECT_IPV4 188 default m if NETFILTER_ADVANCED=n 189 help 190 The REJECT target allows a filtering rule to specify that an ICMP 191 error should be issued in response to an incoming packet, rather 192 than silently being dropped. 193 194 To compile it as a module, choose M here. If unsure, say N. 195 196config IP_NF_TARGET_SYNPROXY 197 tristate "SYNPROXY target support" 198 depends on NF_CONNTRACK && NETFILTER_ADVANCED 199 select NETFILTER_SYNPROXY 200 select SYN_COOKIES 201 help 202 The SYNPROXY target allows you to intercept TCP connections and 203 establish them using syncookies before they are passed on to the 204 server. This allows to avoid conntrack and server resource usage 205 during SYN-flood attacks. 206 207 To compile it as a module, choose M here. If unsure, say N. 208 209# NAT + specific targets: nf_conntrack 210config IP_NF_NAT 211 tristate "iptables NAT support" 212 depends on NF_CONNTRACK 213 default m if NETFILTER_ADVANCED=n 214 select NF_NAT 215 select NETFILTER_XT_NAT 216 help 217 This enables the `nat' table in iptables. This allows masquerading, 218 port forwarding and other forms of full Network Address Port 219 Translation. 220 221 To compile it as a module, choose M here. If unsure, say N. 222 223if IP_NF_NAT 224 225config IP_NF_TARGET_MASQUERADE 226 tristate "MASQUERADE target support" 227 select NF_NAT_MASQUERADE 228 default m if NETFILTER_ADVANCED=n 229 help 230 Masquerading is a special case of NAT: all outgoing connections are 231 changed to seem to come from a particular interface's address, and 232 if the interface goes down, those connections are lost. This is 233 only useful for dialup accounts with dynamic IP address (ie. your IP 234 address will be different on next dialup). 235 236 To compile it as a module, choose M here. If unsure, say N. 237 238config IP_NF_TARGET_NETMAP 239 tristate "NETMAP target support" 240 depends on NETFILTER_ADVANCED 241 select NETFILTER_XT_TARGET_NETMAP 242 ---help--- 243 This is a backwards-compat option for the user's convenience 244 (e.g. when running oldconfig). It selects 245 CONFIG_NETFILTER_XT_TARGET_NETMAP. 246 247config IP_NF_TARGET_REDIRECT 248 tristate "REDIRECT target support" 249 depends on NETFILTER_ADVANCED 250 select NETFILTER_XT_TARGET_REDIRECT 251 ---help--- 252 This is a backwards-compat option for the user's convenience 253 (e.g. when running oldconfig). It selects 254 CONFIG_NETFILTER_XT_TARGET_REDIRECT. 255 256endif # IP_NF_NAT 257 258# mangle + specific targets 259config IP_NF_MANGLE 260 tristate "Packet mangling" 261 default m if NETFILTER_ADVANCED=n 262 help 263 This option adds a `mangle' table to iptables: see the man page for 264 iptables(8). This table is used for various packet alterations 265 which can effect how the packet is routed. 266 267 To compile it as a module, choose M here. If unsure, say N. 268 269config IP_NF_TARGET_CLUSTERIP 270 tristate "CLUSTERIP target support" 271 depends on IP_NF_MANGLE 272 depends on NF_CONNTRACK 273 depends on NETFILTER_ADVANCED 274 select NF_CONNTRACK_MARK 275 select NETFILTER_FAMILY_ARP 276 help 277 The CLUSTERIP target allows you to build load-balancing clusters of 278 network servers without having a dedicated load-balancing 279 router/server/switch. 280 281 To compile it as a module, choose M here. If unsure, say N. 282 283config IP_NF_TARGET_ECN 284 tristate "ECN target support" 285 depends on IP_NF_MANGLE 286 depends on NETFILTER_ADVANCED 287 ---help--- 288 This option adds a `ECN' target, which can be used in the iptables mangle 289 table. 290 291 You can use this target to remove the ECN bits from the IPv4 header of 292 an IP packet. This is particularly useful, if you need to work around 293 existing ECN blackholes on the internet, but don't want to disable 294 ECN support in general. 295 296 To compile it as a module, choose M here. If unsure, say N. 297 298config IP_NF_TARGET_TTL 299 tristate '"TTL" target support' 300 depends on NETFILTER_ADVANCED && IP_NF_MANGLE 301 select NETFILTER_XT_TARGET_HL 302 ---help--- 303 This is a backwards-compatible option for the user's convenience 304 (e.g. when running oldconfig). It selects 305 CONFIG_NETFILTER_XT_TARGET_HL. 306 307# raw + specific targets 308config IP_NF_RAW 309 tristate 'raw table support (required for NOTRACK/TRACE)' 310 help 311 This option adds a `raw' table to iptables. This table is the very 312 first in the netfilter framework and hooks in at the PREROUTING 313 and OUTPUT chains. 314 315 If you want to compile it as a module, say M here and read 316 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 317 318# security table for MAC policy 319config IP_NF_SECURITY 320 tristate "Security table" 321 depends on SECURITY 322 depends on NETFILTER_ADVANCED 323 help 324 This option adds a `security' table to iptables, for use 325 with Mandatory Access Control (MAC) policy. 326 327 If unsure, say N. 328 329endif # IP_NF_IPTABLES 330 331# ARP tables 332config IP_NF_ARPTABLES 333 tristate "ARP tables support" 334 select NETFILTER_XTABLES 335 select NETFILTER_FAMILY_ARP 336 depends on NETFILTER_ADVANCED 337 help 338 arptables is a general, extensible packet identification framework. 339 The ARP packet filtering and mangling (manipulation)subsystems 340 use this: say Y or M here if you want to use either of those. 341 342 To compile it as a module, choose M here. If unsure, say N. 343 344if IP_NF_ARPTABLES 345 346config IP_NF_ARPFILTER 347 tristate "ARP packet filtering" 348 help 349 ARP packet filtering defines a table `filter', which has a series of 350 rules for simple ARP packet filtering at local input and 351 local output. On a bridge, you can also specify filtering rules 352 for forwarded ARP packets. See the man page for arptables(8). 353 354 To compile it as a module, choose M here. If unsure, say N. 355 356config IP_NF_ARP_MANGLE 357 tristate "ARP payload mangling" 358 help 359 Allows altering the ARP packet payload: source and destination 360 hardware and network addresses. 361 362endif # IP_NF_ARPTABLES 363 364endmenu 365 366