1# 2# IP netfilter configuration 3# 4 5menu "IPv6: Netfilter Configuration" 6 depends on INET && IPV6 && NETFILTER 7 8config NF_DEFRAG_IPV6 9 tristate 10 default n 11 12config NF_CONNTRACK_IPV6 13 tristate "IPv6 connection tracking support" 14 depends on INET && IPV6 && NF_CONNTRACK 15 default m if NETFILTER_ADVANCED=n 16 select NF_DEFRAG_IPV6 17 ---help--- 18 Connection tracking keeps a record of what packets have passed 19 through your machine, in order to figure out how they are related 20 into connections. 21 22 This is IPv6 support on Layer 3 independent connection tracking. 23 Layer 3 independent connection tracking is experimental scheme 24 which generalize ip_conntrack to support other layer 3 protocols. 25 26 To compile it as a module, choose M here. If unsure, say N. 27 28config IP6_NF_IPTABLES 29 tristate "IP6 tables support (required for filtering)" 30 depends on INET && IPV6 31 select NETFILTER_XTABLES 32 default m if NETFILTER_ADVANCED=n 33 help 34 ip6tables is a general, extensible packet identification framework. 35 Currently only the packet filtering and packet mangling subsystem 36 for IPv6 use this, but connection tracking is going to follow. 37 Say 'Y' or 'M' here if you want to use either of those. 38 39 To compile it as a module, choose M here. If unsure, say N. 40 41if IP6_NF_IPTABLES 42 43# The simple matches. 44config IP6_NF_MATCH_AH 45 tristate '"ah" match support' 46 depends on NETFILTER_ADVANCED 47 help 48 This module allows one to match AH packets. 49 50 To compile it as a module, choose M here. If unsure, say N. 51 52config IP6_NF_MATCH_EUI64 53 tristate '"eui64" address check' 54 depends on NETFILTER_ADVANCED 55 help 56 This module performs checking on the IPv6 source address 57 Compares the last 64 bits with the EUI64 (delivered 58 from the MAC address) address 59 60 To compile it as a module, choose M here. If unsure, say N. 61 62config IP6_NF_MATCH_FRAG 63 tristate '"frag" Fragmentation header match support' 64 depends on NETFILTER_ADVANCED 65 help 66 frag matching allows you to match packets based on the fragmentation 67 header of the packet. 68 69 To compile it as a module, choose M here. If unsure, say N. 70 71config IP6_NF_MATCH_OPTS 72 tristate '"hbh" hop-by-hop and "dst" opts header match support' 73 depends on NETFILTER_ADVANCED 74 help 75 This allows one to match packets based on the hop-by-hop 76 and destination options headers of a packet. 77 78 To compile it as a module, choose M here. If unsure, say N. 79 80config IP6_NF_MATCH_HL 81 tristate '"hl" hoplimit match support' 82 depends on NETFILTER_ADVANCED 83 select NETFILTER_XT_MATCH_HL 84 ---help--- 85 This is a backwards-compat option for the user's convenience 86 (e.g. when running oldconfig). It selects 87 CONFIG_NETFILTER_XT_MATCH_HL. 88 89config IP6_NF_MATCH_IPV6HEADER 90 tristate '"ipv6header" IPv6 Extension Headers Match' 91 default m if NETFILTER_ADVANCED=n 92 help 93 This module allows one to match packets based upon 94 the ipv6 extension headers. 95 96 To compile it as a module, choose M here. If unsure, say N. 97 98config IP6_NF_MATCH_MH 99 tristate '"mh" match support' 100 depends on NETFILTER_ADVANCED 101 help 102 This module allows one to match MH packets. 103 104 To compile it as a module, choose M here. If unsure, say N. 105 106config IP6_NF_MATCH_RPFILTER 107 tristate '"rpfilter" reverse path filter match support' 108 depends on NETFILTER_ADVANCED && (IP6_NF_MANGLE || IP6_NF_RAW) 109 ---help--- 110 This option allows you to match packets whose replies would 111 go out via the interface the packet came in. 112 113 To compile it as a module, choose M here. If unsure, say N. 114 The module will be called ip6t_rpfilter. 115 116config IP6_NF_MATCH_RT 117 tristate '"rt" Routing header match support' 118 depends on NETFILTER_ADVANCED 119 help 120 rt matching allows you to match packets based on the routing 121 header of the packet. 122 123 To compile it as a module, choose M here. If unsure, say N. 124 125# The targets 126config IP6_NF_TARGET_HL 127 tristate '"HL" hoplimit target support' 128 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE 129 select NETFILTER_XT_TARGET_HL 130 ---help--- 131 This is a backwards-compatible option for the user's convenience 132 (e.g. when running oldconfig). It selects 133 CONFIG_NETFILTER_XT_TARGET_HL. 134 135config IP6_NF_FILTER 136 tristate "Packet filtering" 137 default m if NETFILTER_ADVANCED=n 138 help 139 Packet filtering defines a table `filter', which has a series of 140 rules for simple packet filtering at local input, forwarding and 141 local output. See the man page for iptables(8). 142 143 To compile it as a module, choose M here. If unsure, say N. 144 145config IP6_NF_TARGET_REJECT 146 tristate "REJECT target support" 147 depends on IP6_NF_FILTER 148 default m if NETFILTER_ADVANCED=n 149 help 150 The REJECT target allows a filtering rule to specify that an ICMPv6 151 error should be issued in response to an incoming packet, rather 152 than silently being dropped. 153 154 To compile it as a module, choose M here. If unsure, say N. 155 156config IP6_NF_TARGET_SYNPROXY 157 tristate "SYNPROXY target support" 158 depends on NF_CONNTRACK && NETFILTER_ADVANCED 159 select NETFILTER_SYNPROXY 160 select SYN_COOKIES 161 help 162 The SYNPROXY target allows you to intercept TCP connections and 163 establish them using syncookies before they are passed on to the 164 server. This allows to avoid conntrack and server resource usage 165 during SYN-flood attacks. 166 167 To compile it as a module, choose M here. If unsure, say N. 168 169config IP6_NF_MANGLE 170 tristate "Packet mangling" 171 default m if NETFILTER_ADVANCED=n 172 help 173 This option adds a `mangle' table to iptables: see the man page for 174 iptables(8). This table is used for various packet alterations 175 which can effect how the packet is routed. 176 177 To compile it as a module, choose M here. If unsure, say N. 178 179config IP6_NF_RAW 180 tristate 'raw table support (required for TRACE)' 181 help 182 This option adds a `raw' table to ip6tables. This table is the very 183 first in the netfilter framework and hooks in at the PREROUTING 184 and OUTPUT chains. 185 186 If you want to compile it as a module, say M here and read 187 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 188 189# security table for MAC policy 190config IP6_NF_SECURITY 191 tristate "Security table" 192 depends on SECURITY 193 depends on NETFILTER_ADVANCED 194 help 195 This option adds a `security' table to iptables, for use 196 with Mandatory Access Control (MAC) policy. 197 198 If unsure, say N. 199 200config NF_NAT_IPV6 201 tristate "IPv6 NAT" 202 depends on NF_CONNTRACK_IPV6 203 depends on NETFILTER_ADVANCED 204 select NF_NAT 205 help 206 The IPv6 NAT option allows masquerading, port forwarding and other 207 forms of full Network Address Port Translation. It is controlled by 208 the `nat' table in ip6tables, see the man page for ip6tables(8). 209 210 To compile it as a module, choose M here. If unsure, say N. 211 212if NF_NAT_IPV6 213 214config IP6_NF_TARGET_MASQUERADE 215 tristate "MASQUERADE target support" 216 help 217 Masquerading is a special case of NAT: all outgoing connections are 218 changed to seem to come from a particular interface's address, and 219 if the interface goes down, those connections are lost. This is 220 only useful for dialup accounts with dynamic IP address (ie. your IP 221 address will be different on next dialup). 222 223 To compile it as a module, choose M here. If unsure, say N. 224 225config IP6_NF_TARGET_NPT 226 tristate "NPT (Network Prefix translation) target support" 227 help 228 This option adds the `SNPT' and `DNPT' target, which perform 229 stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296. 230 231 To compile it as a module, choose M here. If unsure, say N. 232 233endif # NF_NAT_IPV6 234 235endif # IP6_NF_IPTABLES 236 237endmenu 238 239