1# 2# IP netfilter configuration 3# 4 5menu "IPv6: Netfilter Configuration" 6 depends on INET && IPV6 && NETFILTER 7 8config NF_CONNTRACK_IPV6 9 tristate "IPv6 connection tracking support" 10 depends on INET && IPV6 && NF_CONNTRACK 11 default m if NETFILTER_ADVANCED=n 12 ---help--- 13 Connection tracking keeps a record of what packets have passed 14 through your machine, in order to figure out how they are related 15 into connections. 16 17 This is IPv6 support on Layer 3 independent connection tracking. 18 Layer 3 independent connection tracking is experimental scheme 19 which generalize ip_conntrack to support other layer 3 protocols. 20 21 To compile it as a module, choose M here. If unsure, say N. 22 23config IP6_NF_QUEUE 24 tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)" 25 depends on INET && IPV6 && NETFILTER 26 depends on NETFILTER_ADVANCED 27 ---help--- 28 29 This option adds a queue handler to the kernel for IPv6 30 packets which enables users to receive the filtered packets 31 with QUEUE target using libipq. 32 33 This option enables the old IPv6-only "ip6_queue" implementation 34 which has been obsoleted by the new "nfnetlink_queue" code (see 35 CONFIG_NETFILTER_NETLINK_QUEUE). 36 37 (C) Fernando Anton 2001 38 IPv64 Project - Work based in IPv64 draft by Arturo Azcorra. 39 Universidad Carlos III de Madrid 40 Universidad Politecnica de Alcala de Henares 41 email: <fanton@it.uc3m.es>. 42 43 To compile it as a module, choose M here. If unsure, say N. 44 45config IP6_NF_IPTABLES 46 tristate "IP6 tables support (required for filtering)" 47 depends on INET && IPV6 48 select NETFILTER_XTABLES 49 default m if NETFILTER_ADVANCED=n 50 help 51 ip6tables is a general, extensible packet identification framework. 52 Currently only the packet filtering and packet mangling subsystem 53 for IPv6 use this, but connection tracking is going to follow. 54 Say 'Y' or 'M' here if you want to use either of those. 55 56 To compile it as a module, choose M here. If unsure, say N. 57 58# The simple matches. 59config IP6_NF_MATCH_RT 60 tristate '"rt" Routing header match support' 61 depends on IP6_NF_IPTABLES 62 depends on NETFILTER_ADVANCED 63 help 64 rt matching allows you to match packets based on the routing 65 header of the packet. 66 67 To compile it as a module, choose M here. If unsure, say N. 68 69config IP6_NF_MATCH_OPTS 70 tristate '"hopbyhop" and "dst" opts header match support' 71 depends on IP6_NF_IPTABLES 72 depends on NETFILTER_ADVANCED 73 help 74 This allows one to match packets based on the hop-by-hop 75 and destination options headers of a packet. 76 77 To compile it as a module, choose M here. If unsure, say N. 78 79config IP6_NF_MATCH_FRAG 80 tristate '"frag" Fragmentation header match support' 81 depends on IP6_NF_IPTABLES 82 depends on NETFILTER_ADVANCED 83 help 84 frag matching allows you to match packets based on the fragmentation 85 header of the packet. 86 87 To compile it as a module, choose M here. If unsure, say N. 88 89config IP6_NF_MATCH_HL 90 tristate '"hl" match support' 91 depends on IP6_NF_IPTABLES 92 depends on NETFILTER_ADVANCED 93 help 94 HL matching allows you to match packets based on the hop 95 limit of the packet. 96 97 To compile it as a module, choose M here. If unsure, say N. 98 99config IP6_NF_MATCH_IPV6HEADER 100 tristate '"ipv6header" IPv6 Extension Headers Match' 101 depends on IP6_NF_IPTABLES 102 depends on NETFILTER_ADVANCED 103 help 104 This module allows one to match packets based upon 105 the ipv6 extension headers. 106 107 To compile it as a module, choose M here. If unsure, say N. 108 109config IP6_NF_MATCH_AH 110 tristate '"ah" match support' 111 depends on IP6_NF_IPTABLES 112 depends on NETFILTER_ADVANCED 113 help 114 This module allows one to match AH packets. 115 116 To compile it as a module, choose M here. If unsure, say N. 117 118config IP6_NF_MATCH_MH 119 tristate '"mh" match support' 120 depends on IP6_NF_IPTABLES 121 depends on NETFILTER_ADVANCED 122 help 123 This module allows one to match MH packets. 124 125 To compile it as a module, choose M here. If unsure, say N. 126 127config IP6_NF_MATCH_EUI64 128 tristate '"eui64" address check' 129 depends on IP6_NF_IPTABLES 130 depends on NETFILTER_ADVANCED 131 help 132 This module performs checking on the IPv6 source address 133 Compares the last 64 bits with the EUI64 (delivered 134 from the MAC address) address 135 136 To compile it as a module, choose M here. If unsure, say N. 137 138# The targets 139config IP6_NF_FILTER 140 tristate "Packet filtering" 141 depends on IP6_NF_IPTABLES 142 default m if NETFILTER_ADVANCED=n 143 help 144 Packet filtering defines a table `filter', which has a series of 145 rules for simple packet filtering at local input, forwarding and 146 local output. See the man page for iptables(8). 147 148 To compile it as a module, choose M here. If unsure, say N. 149 150config IP6_NF_TARGET_LOG 151 tristate "LOG target support" 152 depends on IP6_NF_FILTER 153 default m if NETFILTER_ADVANCED=n 154 help 155 This option adds a `LOG' target, which allows you to create rules in 156 any iptables table which records the packet header to the syslog. 157 158 To compile it as a module, choose M here. If unsure, say N. 159 160config IP6_NF_TARGET_REJECT 161 tristate "REJECT target support" 162 depends on IP6_NF_FILTER 163 default m if NETFILTER_ADVANCED=n 164 help 165 The REJECT target allows a filtering rule to specify that an ICMPv6 166 error should be issued in response to an incoming packet, rather 167 than silently being dropped. 168 169 To compile it as a module, choose M here. If unsure, say N. 170 171config IP6_NF_MANGLE 172 tristate "Packet mangling" 173 depends on IP6_NF_IPTABLES 174 default m if NETFILTER_ADVANCED=n 175 help 176 This option adds a `mangle' table to iptables: see the man page for 177 iptables(8). This table is used for various packet alterations 178 which can effect how the packet is routed. 179 180 To compile it as a module, choose M here. If unsure, say N. 181 182config IP6_NF_TARGET_HL 183 tristate 'HL (hoplimit) target support' 184 depends on IP6_NF_MANGLE 185 depends on NETFILTER_ADVANCED 186 help 187 This option adds a `HL' target, which enables the user to decrement 188 the hoplimit value of the IPv6 header or set it to a given (lower) 189 value. 190 191 While it is safe to decrement the hoplimit value, this option also 192 enables functionality to increment and set the hoplimit value of the 193 IPv6 header to arbitrary values. This is EXTREMELY DANGEROUS since 194 you can easily create immortal packets that loop forever on the 195 network. 196 197 To compile it as a module, choose M here. If unsure, say N. 198 199config IP6_NF_RAW 200 tristate 'raw table support (required for TRACE)' 201 depends on IP6_NF_IPTABLES 202 depends on NETFILTER_ADVANCED 203 help 204 This option adds a `raw' table to ip6tables. This table is the very 205 first in the netfilter framework and hooks in at the PREROUTING 206 and OUTPUT chains. 207 208 If you want to compile it as a module, say M here and read 209 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 210 211endmenu 212 213