1# 2# IP netfilter configuration 3# 4 5menu "IPv6: Netfilter Configuration" 6 depends on INET && IPV6 && NETFILTER 7 8config NF_DEFRAG_IPV6 9 tristate 10 default n 11 12config NF_CONNTRACK_IPV6 13 tristate "IPv6 connection tracking support" 14 depends on INET && IPV6 && NF_CONNTRACK 15 default m if NETFILTER_ADVANCED=n 16 select NF_DEFRAG_IPV6 17 ---help--- 18 Connection tracking keeps a record of what packets have passed 19 through your machine, in order to figure out how they are related 20 into connections. 21 22 This is IPv6 support on Layer 3 independent connection tracking. 23 Layer 3 independent connection tracking is experimental scheme 24 which generalize ip_conntrack to support other layer 3 protocols. 25 26 To compile it as a module, choose M here. If unsure, say N. 27 28config IP6_NF_QUEUE 29 tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)" 30 depends on INET && IPV6 && NETFILTER 31 depends on NETFILTER_ADVANCED 32 ---help--- 33 34 This option adds a queue handler to the kernel for IPv6 35 packets which enables users to receive the filtered packets 36 with QUEUE target using libipq. 37 38 This option enables the old IPv6-only "ip6_queue" implementation 39 which has been obsoleted by the new "nfnetlink_queue" code (see 40 CONFIG_NETFILTER_NETLINK_QUEUE). 41 42 (C) Fernando Anton 2001 43 IPv64 Project - Work based in IPv64 draft by Arturo Azcorra. 44 Universidad Carlos III de Madrid 45 Universidad Politecnica de Alcala de Henares 46 email: <fanton@it.uc3m.es>. 47 48 To compile it as a module, choose M here. If unsure, say N. 49 50config IP6_NF_IPTABLES 51 tristate "IP6 tables support (required for filtering)" 52 depends on INET && IPV6 53 select NETFILTER_XTABLES 54 default m if NETFILTER_ADVANCED=n 55 help 56 ip6tables is a general, extensible packet identification framework. 57 Currently only the packet filtering and packet mangling subsystem 58 for IPv6 use this, but connection tracking is going to follow. 59 Say 'Y' or 'M' here if you want to use either of those. 60 61 To compile it as a module, choose M here. If unsure, say N. 62 63if IP6_NF_IPTABLES 64 65# The simple matches. 66config IP6_NF_MATCH_AH 67 tristate '"ah" match support' 68 depends on NETFILTER_ADVANCED 69 help 70 This module allows one to match AH packets. 71 72 To compile it as a module, choose M here. If unsure, say N. 73 74config IP6_NF_MATCH_EUI64 75 tristate '"eui64" address check' 76 depends on NETFILTER_ADVANCED 77 help 78 This module performs checking on the IPv6 source address 79 Compares the last 64 bits with the EUI64 (delivered 80 from the MAC address) address 81 82 To compile it as a module, choose M here. If unsure, say N. 83 84config IP6_NF_MATCH_FRAG 85 tristate '"frag" Fragmentation header match support' 86 depends on NETFILTER_ADVANCED 87 help 88 frag matching allows you to match packets based on the fragmentation 89 header of the packet. 90 91 To compile it as a module, choose M here. If unsure, say N. 92 93config IP6_NF_MATCH_OPTS 94 tristate '"hbh" hop-by-hop and "dst" opts header match support' 95 depends on NETFILTER_ADVANCED 96 help 97 This allows one to match packets based on the hop-by-hop 98 and destination options headers of a packet. 99 100 To compile it as a module, choose M here. If unsure, say N. 101 102config IP6_NF_MATCH_HL 103 tristate '"hl" hoplimit match support' 104 depends on NETFILTER_ADVANCED 105 select NETFILTER_XT_MATCH_HL 106 ---help--- 107 This is a backwards-compat option for the user's convenience 108 (e.g. when running oldconfig). It selects 109 CONFIG_NETFILTER_XT_MATCH_HL. 110 111config IP6_NF_MATCH_IPV6HEADER 112 tristate '"ipv6header" IPv6 Extension Headers Match' 113 default m if NETFILTER_ADVANCED=n 114 help 115 This module allows one to match packets based upon 116 the ipv6 extension headers. 117 118 To compile it as a module, choose M here. If unsure, say N. 119 120config IP6_NF_MATCH_MH 121 tristate '"mh" match support' 122 depends on NETFILTER_ADVANCED 123 help 124 This module allows one to match MH packets. 125 126 To compile it as a module, choose M here. If unsure, say N. 127 128config IP6_NF_MATCH_RPFILTER 129 tristate '"rpfilter" reverse path filter match support' 130 depends on NETFILTER_ADVANCED 131 ---help--- 132 This option allows you to match packets whose replies would 133 go out via the interface the packet came in. 134 135 To compile it as a module, choose M here. If unsure, say N. 136 The module will be called ip6t_rpfilter. 137 138config IP6_NF_MATCH_RT 139 tristate '"rt" Routing header match support' 140 depends on NETFILTER_ADVANCED 141 help 142 rt matching allows you to match packets based on the routing 143 header of the packet. 144 145 To compile it as a module, choose M here. If unsure, say N. 146 147# The targets 148config IP6_NF_TARGET_HL 149 tristate '"HL" hoplimit target support' 150 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE 151 select NETFILTER_XT_TARGET_HL 152 ---help--- 153 This is a backwards-compatible option for the user's convenience 154 (e.g. when running oldconfig). It selects 155 CONFIG_NETFILTER_XT_TARGET_HL. 156 157config IP6_NF_FILTER 158 tristate "Packet filtering" 159 default m if NETFILTER_ADVANCED=n 160 help 161 Packet filtering defines a table `filter', which has a series of 162 rules for simple packet filtering at local input, forwarding and 163 local output. See the man page for iptables(8). 164 165 To compile it as a module, choose M here. If unsure, say N. 166 167config IP6_NF_TARGET_REJECT 168 tristate "REJECT target support" 169 depends on IP6_NF_FILTER 170 default m if NETFILTER_ADVANCED=n 171 help 172 The REJECT target allows a filtering rule to specify that an ICMPv6 173 error should be issued in response to an incoming packet, rather 174 than silently being dropped. 175 176 To compile it as a module, choose M here. If unsure, say N. 177 178config IP6_NF_MANGLE 179 tristate "Packet mangling" 180 default m if NETFILTER_ADVANCED=n 181 help 182 This option adds a `mangle' table to iptables: see the man page for 183 iptables(8). This table is used for various packet alterations 184 which can effect how the packet is routed. 185 186 To compile it as a module, choose M here. If unsure, say N. 187 188config IP6_NF_RAW 189 tristate 'raw table support (required for TRACE)' 190 help 191 This option adds a `raw' table to ip6tables. This table is the very 192 first in the netfilter framework and hooks in at the PREROUTING 193 and OUTPUT chains. 194 195 If you want to compile it as a module, say M here and read 196 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 197 198# security table for MAC policy 199config IP6_NF_SECURITY 200 tristate "Security table" 201 depends on SECURITY 202 depends on NETFILTER_ADVANCED 203 help 204 This option adds a `security' table to iptables, for use 205 with Mandatory Access Control (MAC) policy. 206 207 If unsure, say N. 208 209endif # IP6_NF_IPTABLES 210 211endmenu 212 213