1# SPDX-License-Identifier: GPL-2.0-only 2# 3# IP netfilter configuration 4# 5 6menu "IP: Netfilter Configuration" 7 depends on INET && NETFILTER 8 9config NF_DEFRAG_IPV4 10 tristate 11 default n 12 13config NF_SOCKET_IPV4 14 tristate "IPv4 socket lookup support" 15 help 16 This option enables the IPv4 socket lookup infrastructure. This is 17 is required by the {ip,nf}tables socket match. 18 19config NF_TPROXY_IPV4 20 tristate "IPv4 tproxy support" 21 22if NF_TABLES 23 24config NF_TABLES_IPV4 25 bool "IPv4 nf_tables support" 26 help 27 This option enables the IPv4 support for nf_tables. 28 29if NF_TABLES_IPV4 30 31config NFT_REJECT_IPV4 32 select NF_REJECT_IPV4 33 default NFT_REJECT 34 tristate 35 36config NFT_DUP_IPV4 37 tristate "IPv4 nf_tables packet duplication support" 38 depends on !NF_CONNTRACK || NF_CONNTRACK 39 select NF_DUP_IPV4 40 help 41 This module enables IPv4 packet duplication support for nf_tables. 42 43config NFT_FIB_IPV4 44 select NFT_FIB 45 tristate "nf_tables fib / ip route lookup support" 46 help 47 This module enables IPv4 FIB lookups, e.g. for reverse path filtering. 48 It also allows query of the FIB for the route type, e.g. local, unicast, 49 multicast or blackhole. 50 51endif # NF_TABLES_IPV4 52 53config NF_TABLES_ARP 54 bool "ARP nf_tables support" 55 select NETFILTER_FAMILY_ARP 56 help 57 This option enables the ARP support for nf_tables. 58 59endif # NF_TABLES 60 61config NF_FLOW_TABLE_IPV4 62 tristate 63 select NF_FLOW_TABLE_INET 64 65config NF_DUP_IPV4 66 tristate "Netfilter IPv4 packet duplication to alternate destination" 67 depends on !NF_CONNTRACK || NF_CONNTRACK 68 help 69 This option enables the nf_dup_ipv4 core, which duplicates an IPv4 70 packet to be rerouted to another destination. 71 72config NF_LOG_ARP 73 tristate "ARP packet logging" 74 default m if NETFILTER_ADVANCED=n 75 select NF_LOG_SYSLOG 76 help 77 This is a backwards-compat option for the user's convenience 78 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG. 79 80config NF_LOG_IPV4 81 tristate "IPv4 packet logging" 82 default m if NETFILTER_ADVANCED=n 83 select NF_LOG_SYSLOG 84 help 85 This is a backwards-compat option for the user's convenience 86 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG. 87 88config NF_REJECT_IPV4 89 tristate "IPv4 packet rejection" 90 default m if NETFILTER_ADVANCED=n 91 92if NF_NAT 93config NF_NAT_SNMP_BASIC 94 tristate "Basic SNMP-ALG support" 95 depends on NF_CONNTRACK_SNMP 96 depends on NETFILTER_ADVANCED 97 default NF_NAT && NF_CONNTRACK_SNMP 98 select ASN1 99 help 100 101 This module implements an Application Layer Gateway (ALG) for 102 SNMP payloads. In conjunction with NAT, it allows a network 103 management system to access multiple private networks with 104 conflicting addresses. It works by modifying IP addresses 105 inside SNMP payloads to match IP-layer NAT mapping. 106 107 This is the "basic" form of SNMP-ALG, as described in RFC 2962 108 109 To compile it as a module, choose M here. If unsure, say N. 110 111config NF_NAT_PPTP 112 tristate 113 depends on NF_CONNTRACK 114 default NF_CONNTRACK_PPTP 115 116config NF_NAT_H323 117 tristate 118 depends on NF_CONNTRACK 119 default NF_CONNTRACK_H323 120 121endif # NF_NAT 122 123config IP_NF_IPTABLES 124 tristate "IP tables support (required for filtering/masq/NAT)" 125 default m if NETFILTER_ADVANCED=n 126 select NETFILTER_XTABLES 127 help 128 iptables is a general, extensible packet identification framework. 129 The packet filtering and full NAT (masquerading, port forwarding, 130 etc) subsystems now use this: say `Y' or `M' here if you want to use 131 either of those. 132 133 To compile it as a module, choose M here. If unsure, say N. 134 135if IP_NF_IPTABLES 136 137# The matches. 138config IP_NF_MATCH_AH 139 tristate '"ah" match support' 140 depends on NETFILTER_ADVANCED 141 help 142 This match extension allows you to match a range of SPIs 143 inside AH header of IPSec packets. 144 145 To compile it as a module, choose M here. If unsure, say N. 146 147config IP_NF_MATCH_ECN 148 tristate '"ecn" match support' 149 depends on NETFILTER_ADVANCED 150 select NETFILTER_XT_MATCH_ECN 151 help 152 This is a backwards-compat option for the user's convenience 153 (e.g. when running oldconfig). It selects 154 CONFIG_NETFILTER_XT_MATCH_ECN. 155 156config IP_NF_MATCH_RPFILTER 157 tristate '"rpfilter" reverse path filter match support' 158 depends on NETFILTER_ADVANCED 159 depends on IP_NF_MANGLE || IP_NF_RAW 160 help 161 This option allows you to match packets whose replies would 162 go out via the interface the packet came in. 163 164 To compile it as a module, choose M here. If unsure, say N. 165 The module will be called ipt_rpfilter. 166 167config IP_NF_MATCH_TTL 168 tristate '"ttl" match support' 169 depends on NETFILTER_ADVANCED 170 select NETFILTER_XT_MATCH_HL 171 help 172 This is a backwards-compat option for the user's convenience 173 (e.g. when running oldconfig). It selects 174 CONFIG_NETFILTER_XT_MATCH_HL. 175 176# `filter', generic and specific targets 177config IP_NF_FILTER 178 tristate "Packet filtering" 179 default m if NETFILTER_ADVANCED=n 180 help 181 Packet filtering defines a table `filter', which has a series of 182 rules for simple packet filtering at local input, forwarding and 183 local output. See the man page for iptables(8). 184 185 To compile it as a module, choose M here. If unsure, say N. 186 187config IP_NF_TARGET_REJECT 188 tristate "REJECT target support" 189 depends on IP_NF_FILTER 190 select NF_REJECT_IPV4 191 default m if NETFILTER_ADVANCED=n 192 help 193 The REJECT target allows a filtering rule to specify that an ICMP 194 error should be issued in response to an incoming packet, rather 195 than silently being dropped. 196 197 To compile it as a module, choose M here. If unsure, say N. 198 199config IP_NF_TARGET_SYNPROXY 200 tristate "SYNPROXY target support" 201 depends on NF_CONNTRACK && NETFILTER_ADVANCED 202 select NETFILTER_SYNPROXY 203 select SYN_COOKIES 204 help 205 The SYNPROXY target allows you to intercept TCP connections and 206 establish them using syncookies before they are passed on to the 207 server. This allows to avoid conntrack and server resource usage 208 during SYN-flood attacks. 209 210 To compile it as a module, choose M here. If unsure, say N. 211 212# NAT + specific targets: nf_conntrack 213config IP_NF_NAT 214 tristate "iptables NAT support" 215 depends on NF_CONNTRACK 216 default m if NETFILTER_ADVANCED=n 217 select NF_NAT 218 select NETFILTER_XT_NAT 219 help 220 This enables the `nat' table in iptables. This allows masquerading, 221 port forwarding and other forms of full Network Address Port 222 Translation. 223 224 To compile it as a module, choose M here. If unsure, say N. 225 226if IP_NF_NAT 227 228config IP_NF_TARGET_MASQUERADE 229 tristate "MASQUERADE target support" 230 select NETFILTER_XT_TARGET_MASQUERADE 231 help 232 This is a backwards-compat option for the user's convenience 233 (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE. 234 235config IP_NF_TARGET_NETMAP 236 tristate "NETMAP target support" 237 depends on NETFILTER_ADVANCED 238 select NETFILTER_XT_TARGET_NETMAP 239 help 240 This is a backwards-compat option for the user's convenience 241 (e.g. when running oldconfig). It selects 242 CONFIG_NETFILTER_XT_TARGET_NETMAP. 243 244config IP_NF_TARGET_REDIRECT 245 tristate "REDIRECT target support" 246 depends on NETFILTER_ADVANCED 247 select NETFILTER_XT_TARGET_REDIRECT 248 help 249 This is a backwards-compat option for the user's convenience 250 (e.g. when running oldconfig). It selects 251 CONFIG_NETFILTER_XT_TARGET_REDIRECT. 252 253endif # IP_NF_NAT 254 255# mangle + specific targets 256config IP_NF_MANGLE 257 tristate "Packet mangling" 258 default m if NETFILTER_ADVANCED=n 259 help 260 This option adds a `mangle' table to iptables: see the man page for 261 iptables(8). This table is used for various packet alterations 262 which can effect how the packet is routed. 263 264 To compile it as a module, choose M here. If unsure, say N. 265 266config IP_NF_TARGET_CLUSTERIP 267 tristate "CLUSTERIP target support" 268 depends on IP_NF_MANGLE 269 depends on NF_CONNTRACK 270 depends on NETFILTER_ADVANCED 271 select NF_CONNTRACK_MARK 272 select NETFILTER_FAMILY_ARP 273 help 274 The CLUSTERIP target allows you to build load-balancing clusters of 275 network servers without having a dedicated load-balancing 276 router/server/switch. 277 278 To compile it as a module, choose M here. If unsure, say N. 279 280config IP_NF_TARGET_ECN 281 tristate "ECN target support" 282 depends on IP_NF_MANGLE 283 depends on NETFILTER_ADVANCED 284 help 285 This option adds a `ECN' target, which can be used in the iptables mangle 286 table. 287 288 You can use this target to remove the ECN bits from the IPv4 header of 289 an IP packet. This is particularly useful, if you need to work around 290 existing ECN blackholes on the internet, but don't want to disable 291 ECN support in general. 292 293 To compile it as a module, choose M here. If unsure, say N. 294 295config IP_NF_TARGET_TTL 296 tristate '"TTL" target support' 297 depends on NETFILTER_ADVANCED && IP_NF_MANGLE 298 select NETFILTER_XT_TARGET_HL 299 help 300 This is a backwards-compatible option for the user's convenience 301 (e.g. when running oldconfig). It selects 302 CONFIG_NETFILTER_XT_TARGET_HL. 303 304# raw + specific targets 305config IP_NF_RAW 306 tristate 'raw table support (required for NOTRACK/TRACE)' 307 help 308 This option adds a `raw' table to iptables. This table is the very 309 first in the netfilter framework and hooks in at the PREROUTING 310 and OUTPUT chains. 311 312 If you want to compile it as a module, say M here and read 313 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 314 315# security table for MAC policy 316config IP_NF_SECURITY 317 tristate "Security table" 318 depends on SECURITY 319 depends on NETFILTER_ADVANCED 320 help 321 This option adds a `security' table to iptables, for use 322 with Mandatory Access Control (MAC) policy. 323 324 If unsure, say N. 325 326endif # IP_NF_IPTABLES 327 328# ARP tables 329config IP_NF_ARPTABLES 330 tristate "ARP tables support" 331 select NETFILTER_XTABLES 332 select NETFILTER_FAMILY_ARP 333 depends on NETFILTER_ADVANCED 334 help 335 arptables is a general, extensible packet identification framework. 336 The ARP packet filtering and mangling (manipulation)subsystems 337 use this: say Y or M here if you want to use either of those. 338 339 To compile it as a module, choose M here. If unsure, say N. 340 341if IP_NF_ARPTABLES 342 343config IP_NF_ARPFILTER 344 tristate "ARP packet filtering" 345 help 346 ARP packet filtering defines a table `filter', which has a series of 347 rules for simple ARP packet filtering at local input and 348 local output. On a bridge, you can also specify filtering rules 349 for forwarded ARP packets. See the man page for arptables(8). 350 351 To compile it as a module, choose M here. If unsure, say N. 352 353config IP_NF_ARP_MANGLE 354 tristate "ARP payload mangling" 355 help 356 Allows altering the ARP packet payload: source and destination 357 hardware and network addresses. 358 359endif # IP_NF_ARPTABLES 360 361endmenu 362 363