1# 2# IP netfilter configuration 3# 4 5menu "IPv6: Netfilter Configuration (EXPERIMENTAL)" 6 depends on INET && IPV6 && NETFILTER && EXPERIMENTAL 7 8config NF_CONNTRACK_IPV6 9 tristate "IPv6 connection tracking support (EXPERIMENTAL)" 10 depends on INET && IPV6 && EXPERIMENTAL && NF_CONNTRACK 11 ---help--- 12 Connection tracking keeps a record of what packets have passed 13 through your machine, in order to figure out how they are related 14 into connections. 15 16 This is IPv6 support on Layer 3 independent connection tracking. 17 Layer 3 independent connection tracking is experimental scheme 18 which generalize ip_conntrack to support other layer 3 protocols. 19 20 To compile it as a module, choose M here. If unsure, say N. 21 22config IP6_NF_QUEUE 23 tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)" 24 depends on INET && IPV6 && NETFILTER && EXPERIMENTAL 25 ---help--- 26 27 This option adds a queue handler to the kernel for IPv6 28 packets which enables users to receive the filtered packets 29 with QUEUE target using libipq. 30 31 THis option enables the old IPv6-only "ip6_queue" implementation 32 which has been obsoleted by the new "nfnetlink_queue" code (see 33 CONFIG_NETFILTER_NETLINK_QUEUE). 34 35 (C) Fernando Anton 2001 36 IPv64 Project - Work based in IPv64 draft by Arturo Azcorra. 37 Universidad Carlos III de Madrid 38 Universidad Politecnica de Alcala de Henares 39 email: <fanton@it.uc3m.es>. 40 41 To compile it as a module, choose M here. If unsure, say N. 42 43config IP6_NF_IPTABLES 44 tristate "IP6 tables support (required for filtering)" 45 depends on INET && IPV6 && EXPERIMENTAL 46 select NETFILTER_XTABLES 47 help 48 ip6tables is a general, extensible packet identification framework. 49 Currently only the packet filtering and packet mangling subsystem 50 for IPv6 use this, but connection tracking is going to follow. 51 Say 'Y' or 'M' here if you want to use either of those. 52 53 To compile it as a module, choose M here. If unsure, say N. 54 55# The simple matches. 56config IP6_NF_MATCH_RT 57 tristate "Routing header match support" 58 depends on IP6_NF_IPTABLES 59 help 60 rt matching allows you to match packets based on the routing 61 header of the packet. 62 63 To compile it as a module, choose M here. If unsure, say N. 64 65config IP6_NF_MATCH_OPTS 66 tristate "Hop-by-hop and Dst opts header match support" 67 depends on IP6_NF_IPTABLES 68 help 69 This allows one to match packets based on the hop-by-hop 70 and destination options headers of a packet. 71 72 To compile it as a module, choose M here. If unsure, say N. 73 74config IP6_NF_MATCH_FRAG 75 tristate "Fragmentation header match support" 76 depends on IP6_NF_IPTABLES 77 help 78 frag matching allows you to match packets based on the fragmentation 79 header of the packet. 80 81 To compile it as a module, choose M here. If unsure, say N. 82 83config IP6_NF_MATCH_HL 84 tristate "HL match support" 85 depends on IP6_NF_IPTABLES 86 help 87 HL matching allows you to match packets based on the hop 88 limit of the packet. 89 90 To compile it as a module, choose M here. If unsure, say N. 91 92config IP6_NF_MATCH_OWNER 93 tristate "Owner match support" 94 depends on IP6_NF_IPTABLES 95 help 96 Packet owner matching allows you to match locally-generated packets 97 based on who created them: the user, group, process or session. 98 99 To compile it as a module, choose M here. If unsure, say N. 100 101config IP6_NF_MATCH_IPV6HEADER 102 tristate "IPv6 Extension Headers Match" 103 depends on IP6_NF_IPTABLES 104 help 105 This module allows one to match packets based upon 106 the ipv6 extension headers. 107 108 To compile it as a module, choose M here. If unsure, say N. 109 110config IP6_NF_MATCH_AH 111 tristate "AH match support" 112 depends on IP6_NF_IPTABLES 113 help 114 This module allows one to match AH packets. 115 116 To compile it as a module, choose M here. If unsure, say N. 117 118config IP6_NF_MATCH_MH 119 tristate "MH match support" 120 depends on IP6_NF_IPTABLES 121 help 122 This module allows one to match MH packets. 123 124 To compile it as a module, choose M here. If unsure, say N. 125 126config IP6_NF_MATCH_EUI64 127 tristate "EUI64 address check" 128 depends on IP6_NF_IPTABLES 129 help 130 This module performs checking on the IPv6 source address 131 Compares the last 64 bits with the EUI64 (delivered 132 from the MAC address) address 133 134 To compile it as a module, choose M here. If unsure, say N. 135 136# The targets 137config IP6_NF_FILTER 138 tristate "Packet filtering" 139 depends on IP6_NF_IPTABLES 140 help 141 Packet filtering defines a table `filter', which has a series of 142 rules for simple packet filtering at local input, forwarding and 143 local output. See the man page for iptables(8). 144 145 To compile it as a module, choose M here. If unsure, say N. 146 147config IP6_NF_TARGET_LOG 148 tristate "LOG target support" 149 depends on IP6_NF_FILTER 150 help 151 This option adds a `LOG' target, which allows you to create rules in 152 any iptables table which records the packet header to the syslog. 153 154 To compile it as a module, choose M here. If unsure, say N. 155 156config IP6_NF_TARGET_REJECT 157 tristate "REJECT target support" 158 depends on IP6_NF_FILTER 159 help 160 The REJECT target allows a filtering rule to specify that an ICMPv6 161 error should be issued in response to an incoming packet, rather 162 than silently being dropped. 163 164 To compile it as a module, choose M here. If unsure, say N. 165 166config IP6_NF_MANGLE 167 tristate "Packet mangling" 168 depends on IP6_NF_IPTABLES 169 help 170 This option adds a `mangle' table to iptables: see the man page for 171 iptables(8). This table is used for various packet alterations 172 which can effect how the packet is routed. 173 174 To compile it as a module, choose M here. If unsure, say N. 175 176config IP6_NF_TARGET_HL 177 tristate 'HL (hoplimit) target support' 178 depends on IP6_NF_MANGLE 179 help 180 This option adds a `HL' target, which enables the user to decrement 181 the hoplimit value of the IPv6 header or set it to a given (lower) 182 value. 183 184 While it is safe to decrement the hoplimit value, this option also 185 enables functionality to increment and set the hoplimit value of the 186 IPv6 header to arbitrary values. This is EXTREMELY DANGEROUS since 187 you can easily create immortal packets that loop forever on the 188 network. 189 190 To compile it as a module, choose M here. If unsure, say N. 191 192config IP6_NF_RAW 193 tristate 'raw table support (required for TRACE)' 194 depends on IP6_NF_IPTABLES 195 help 196 This option adds a `raw' table to ip6tables. This table is the very 197 first in the netfilter framework and hooks in at the PREROUTING 198 and OUTPUT chains. 199 200 If you want to compile it as a module, say M here and read 201 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 202 203endmenu 204 205