1# 2# IP netfilter configuration 3# 4 5menu "IPv6: Netfilter Configuration" 6 depends on INET && IPV6 && NETFILTER 7 8config NF_CONNTRACK_IPV6 9 tristate "IPv6 connection tracking support" 10 depends on INET && IPV6 && NF_CONNTRACK 11 default m if NETFILTER_ADVANCED=n 12 ---help--- 13 Connection tracking keeps a record of what packets have passed 14 through your machine, in order to figure out how they are related 15 into connections. 16 17 This is IPv6 support on Layer 3 independent connection tracking. 18 Layer 3 independent connection tracking is experimental scheme 19 which generalize ip_conntrack to support other layer 3 protocols. 20 21 To compile it as a module, choose M here. If unsure, say N. 22 23config IP6_NF_QUEUE 24 tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)" 25 depends on INET && IPV6 && NETFILTER 26 depends on NETFILTER_ADVANCED 27 ---help--- 28 29 This option adds a queue handler to the kernel for IPv6 30 packets which enables users to receive the filtered packets 31 with QUEUE target using libipq. 32 33 This option enables the old IPv6-only "ip6_queue" implementation 34 which has been obsoleted by the new "nfnetlink_queue" code (see 35 CONFIG_NETFILTER_NETLINK_QUEUE). 36 37 (C) Fernando Anton 2001 38 IPv64 Project - Work based in IPv64 draft by Arturo Azcorra. 39 Universidad Carlos III de Madrid 40 Universidad Politecnica de Alcala de Henares 41 email: <fanton@it.uc3m.es>. 42 43 To compile it as a module, choose M here. If unsure, say N. 44 45config IP6_NF_IPTABLES 46 tristate "IP6 tables support (required for filtering)" 47 depends on INET && IPV6 48 select NETFILTER_XTABLES 49 default m if NETFILTER_ADVANCED=n 50 help 51 ip6tables is a general, extensible packet identification framework. 52 Currently only the packet filtering and packet mangling subsystem 53 for IPv6 use this, but connection tracking is going to follow. 54 Say 'Y' or 'M' here if you want to use either of those. 55 56 To compile it as a module, choose M here. If unsure, say N. 57 58# The simple matches. 59config IP6_NF_MATCH_AH 60 tristate '"ah" match support' 61 depends on IP6_NF_IPTABLES 62 depends on NETFILTER_ADVANCED 63 help 64 This module allows one to match AH packets. 65 66 To compile it as a module, choose M here. If unsure, say N. 67 68config IP6_NF_MATCH_EUI64 69 tristate '"eui64" address check' 70 depends on IP6_NF_IPTABLES 71 depends on NETFILTER_ADVANCED 72 help 73 This module performs checking on the IPv6 source address 74 Compares the last 64 bits with the EUI64 (delivered 75 from the MAC address) address 76 77 To compile it as a module, choose M here. If unsure, say N. 78 79config IP6_NF_MATCH_FRAG 80 tristate '"frag" Fragmentation header match support' 81 depends on IP6_NF_IPTABLES 82 depends on NETFILTER_ADVANCED 83 help 84 frag matching allows you to match packets based on the fragmentation 85 header of the packet. 86 87 To compile it as a module, choose M here. If unsure, say N. 88 89config IP6_NF_MATCH_OPTS 90 tristate '"hbh" hop-by-hop and "dst" opts header match support' 91 depends on IP6_NF_IPTABLES 92 depends on NETFILTER_ADVANCED 93 help 94 This allows one to match packets based on the hop-by-hop 95 and destination options headers of a packet. 96 97 To compile it as a module, choose M here. If unsure, say N. 98 99config IP6_NF_MATCH_HL 100 tristate '"hl" match support' 101 depends on IP6_NF_IPTABLES 102 depends on NETFILTER_ADVANCED 103 help 104 HL matching allows you to match packets based on the hop 105 limit of the packet. 106 107 To compile it as a module, choose M here. If unsure, say N. 108 109config IP6_NF_MATCH_IPV6HEADER 110 tristate '"ipv6header" IPv6 Extension Headers Match' 111 depends on IP6_NF_IPTABLES 112 default m if NETFILTER_ADVANCED=n 113 help 114 This module allows one to match packets based upon 115 the ipv6 extension headers. 116 117 To compile it as a module, choose M here. If unsure, say N. 118 119config IP6_NF_MATCH_MH 120 tristate '"mh" match support' 121 depends on IP6_NF_IPTABLES 122 depends on NETFILTER_ADVANCED 123 help 124 This module allows one to match MH packets. 125 126 To compile it as a module, choose M here. If unsure, say N. 127 128config IP6_NF_MATCH_RT 129 tristate '"rt" Routing header match support' 130 depends on IP6_NF_IPTABLES 131 depends on NETFILTER_ADVANCED 132 help 133 rt matching allows you to match packets based on the routing 134 header of the packet. 135 136 To compile it as a module, choose M here. If unsure, say N. 137 138# The targets 139config IP6_NF_TARGET_LOG 140 tristate "LOG target support" 141 depends on IP6_NF_IPTABLES 142 default m if NETFILTER_ADVANCED=n 143 help 144 This option adds a `LOG' target, which allows you to create rules in 145 any iptables table which records the packet header to the syslog. 146 147 To compile it as a module, choose M here. If unsure, say N. 148 149config IP6_NF_FILTER 150 tristate "Packet filtering" 151 depends on IP6_NF_IPTABLES 152 default m if NETFILTER_ADVANCED=n 153 help 154 Packet filtering defines a table `filter', which has a series of 155 rules for simple packet filtering at local input, forwarding and 156 local output. See the man page for iptables(8). 157 158 To compile it as a module, choose M here. If unsure, say N. 159 160config IP6_NF_TARGET_REJECT 161 tristate "REJECT target support" 162 depends on IP6_NF_FILTER 163 default m if NETFILTER_ADVANCED=n 164 help 165 The REJECT target allows a filtering rule to specify that an ICMPv6 166 error should be issued in response to an incoming packet, rather 167 than silently being dropped. 168 169 To compile it as a module, choose M here. If unsure, say N. 170 171config IP6_NF_MANGLE 172 tristate "Packet mangling" 173 depends on IP6_NF_IPTABLES 174 default m if NETFILTER_ADVANCED=n 175 help 176 This option adds a `mangle' table to iptables: see the man page for 177 iptables(8). This table is used for various packet alterations 178 which can effect how the packet is routed. 179 180 To compile it as a module, choose M here. If unsure, say N. 181 182config IP6_NF_TARGET_HL 183 tristate 'HL (hoplimit) target support' 184 depends on IP6_NF_MANGLE 185 depends on NETFILTER_ADVANCED 186 help 187 This option adds a `HL' target, which enables the user to decrement 188 the hoplimit value of the IPv6 header or set it to a given (lower) 189 value. 190 191 While it is safe to decrement the hoplimit value, this option also 192 enables functionality to increment and set the hoplimit value of the 193 IPv6 header to arbitrary values. This is EXTREMELY DANGEROUS since 194 you can easily create immortal packets that loop forever on the 195 network. 196 197 To compile it as a module, choose M here. If unsure, say N. 198 199config IP6_NF_RAW 200 tristate 'raw table support (required for TRACE)' 201 depends on IP6_NF_IPTABLES 202 depends on NETFILTER_ADVANCED 203 help 204 This option adds a `raw' table to ip6tables. This table is the very 205 first in the netfilter framework and hooks in at the PREROUTING 206 and OUTPUT chains. 207 208 If you want to compile it as a module, say M here and read 209 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 210 211# security table for MAC policy 212config IP6_NF_SECURITY 213 tristate "Security table" 214 depends on IP6_NF_IPTABLES 215 depends on SECURITY 216 depends on NETFILTER_ADVANCED 217 help 218 This option adds a `security' table to iptables, for use 219 with Mandatory Access Control (MAC) policy. 220 221 If unsure, say N. 222 223endmenu 224 225