1# 2# IP netfilter configuration 3# 4 5menu "IP: Netfilter Configuration" 6 depends on INET && NETFILTER 7 8config NF_DEFRAG_IPV4 9 tristate 10 default n 11 12config NF_SOCKET_IPV4 13 tristate "IPv4 socket lookup support" 14 help 15 This option enables the IPv4 socket lookup infrastructure. This is 16 is required by the {ip,nf}tables socket match. 17 18config NF_TPROXY_IPV4 19 tristate "IPv4 tproxy support" 20 21if NF_TABLES 22 23config NF_TABLES_IPV4 24 bool "IPv4 nf_tables support" 25 help 26 This option enables the IPv4 support for nf_tables. 27 28if NF_TABLES_IPV4 29 30config NFT_CHAIN_ROUTE_IPV4 31 tristate "IPv4 nf_tables route chain support" 32 help 33 This option enables the "route" chain for IPv4 in nf_tables. This 34 chain type is used to force packet re-routing after mangling header 35 fields such as the source, destination, type of service and 36 the packet mark. 37 38config NFT_REJECT_IPV4 39 select NF_REJECT_IPV4 40 default NFT_REJECT 41 tristate 42 43config NFT_DUP_IPV4 44 tristate "IPv4 nf_tables packet duplication support" 45 depends on !NF_CONNTRACK || NF_CONNTRACK 46 select NF_DUP_IPV4 47 help 48 This module enables IPv4 packet duplication support for nf_tables. 49 50config NFT_FIB_IPV4 51 select NFT_FIB 52 tristate "nf_tables fib / ip route lookup support" 53 help 54 This module enables IPv4 FIB lookups, e.g. for reverse path filtering. 55 It also allows query of the FIB for the route type, e.g. local, unicast, 56 multicast or blackhole. 57 58endif # NF_TABLES_IPV4 59 60config NF_TABLES_ARP 61 bool "ARP nf_tables support" 62 select NETFILTER_FAMILY_ARP 63 help 64 This option enables the ARP support for nf_tables. 65 66endif # NF_TABLES 67 68config NF_FLOW_TABLE_IPV4 69 tristate "Netfilter flow table IPv4 module" 70 depends on NF_FLOW_TABLE 71 help 72 This option adds the flow table IPv4 support. 73 74 To compile it as a module, choose M here. 75 76config NF_DUP_IPV4 77 tristate "Netfilter IPv4 packet duplication to alternate destination" 78 depends on !NF_CONNTRACK || NF_CONNTRACK 79 help 80 This option enables the nf_dup_ipv4 core, which duplicates an IPv4 81 packet to be rerouted to another destination. 82 83config NF_LOG_ARP 84 tristate "ARP packet logging" 85 default m if NETFILTER_ADVANCED=n 86 select NF_LOG_COMMON 87 88config NF_LOG_IPV4 89 tristate "IPv4 packet logging" 90 default m if NETFILTER_ADVANCED=n 91 select NF_LOG_COMMON 92 93config NF_REJECT_IPV4 94 tristate "IPv4 packet rejection" 95 default m if NETFILTER_ADVANCED=n 96 97config NF_NAT_IPV4 98 tristate "IPv4 NAT" 99 depends on NF_CONNTRACK 100 default m if NETFILTER_ADVANCED=n 101 select NF_NAT 102 help 103 The IPv4 NAT option allows masquerading, port forwarding and other 104 forms of full Network Address Port Translation. This can be 105 controlled by iptables or nft. 106 107if NF_NAT_IPV4 108 109if NF_TABLES 110config NFT_CHAIN_NAT_IPV4 111 depends on NF_TABLES_IPV4 112 tristate "IPv4 nf_tables nat chain support" 113 help 114 This option enables the "nat" chain for IPv4 in nf_tables. This 115 chain type is used to perform Network Address Translation (NAT) 116 packet transformations such as the source, destination address and 117 source and destination ports. 118 119config NFT_MASQ_IPV4 120 tristate "IPv4 masquerading support for nf_tables" 121 depends on NF_TABLES_IPV4 122 depends on NFT_MASQ 123 select NF_NAT_MASQUERADE 124 help 125 This is the expression that provides IPv4 masquerading support for 126 nf_tables. 127 128config NFT_REDIR_IPV4 129 tristate "IPv4 redirect support for nf_tables" 130 depends on NF_TABLES_IPV4 131 depends on NFT_REDIR 132 select NF_NAT_REDIRECT 133 help 134 This is the expression that provides IPv4 redirect support for 135 nf_tables. 136endif # NF_TABLES 137 138config NF_NAT_SNMP_BASIC 139 tristate "Basic SNMP-ALG support" 140 depends on NF_CONNTRACK_SNMP 141 depends on NETFILTER_ADVANCED 142 default NF_NAT && NF_CONNTRACK_SNMP 143 select ASN1 144 ---help--- 145 146 This module implements an Application Layer Gateway (ALG) for 147 SNMP payloads. In conjunction with NAT, it allows a network 148 management system to access multiple private networks with 149 conflicting addresses. It works by modifying IP addresses 150 inside SNMP payloads to match IP-layer NAT mapping. 151 152 This is the "basic" form of SNMP-ALG, as described in RFC 2962 153 154 To compile it as a module, choose M here. If unsure, say N. 155 156config NF_NAT_PPTP 157 tristate 158 depends on NF_CONNTRACK 159 default NF_CONNTRACK_PPTP 160 161config NF_NAT_H323 162 tristate 163 depends on NF_CONNTRACK 164 default NF_CONNTRACK_H323 165 166endif # NF_NAT_IPV4 167 168config IP_NF_IPTABLES 169 tristate "IP tables support (required for filtering/masq/NAT)" 170 default m if NETFILTER_ADVANCED=n 171 select NETFILTER_XTABLES 172 help 173 iptables is a general, extensible packet identification framework. 174 The packet filtering and full NAT (masquerading, port forwarding, 175 etc) subsystems now use this: say `Y' or `M' here if you want to use 176 either of those. 177 178 To compile it as a module, choose M here. If unsure, say N. 179 180if IP_NF_IPTABLES 181 182# The matches. 183config IP_NF_MATCH_AH 184 tristate '"ah" match support' 185 depends on NETFILTER_ADVANCED 186 help 187 This match extension allows you to match a range of SPIs 188 inside AH header of IPSec packets. 189 190 To compile it as a module, choose M here. If unsure, say N. 191 192config IP_NF_MATCH_ECN 193 tristate '"ecn" match support' 194 depends on NETFILTER_ADVANCED 195 select NETFILTER_XT_MATCH_ECN 196 ---help--- 197 This is a backwards-compat option for the user's convenience 198 (e.g. when running oldconfig). It selects 199 CONFIG_NETFILTER_XT_MATCH_ECN. 200 201config IP_NF_MATCH_RPFILTER 202 tristate '"rpfilter" reverse path filter match support' 203 depends on NETFILTER_ADVANCED 204 depends on IP_NF_MANGLE || IP_NF_RAW 205 ---help--- 206 This option allows you to match packets whose replies would 207 go out via the interface the packet came in. 208 209 To compile it as a module, choose M here. If unsure, say N. 210 The module will be called ipt_rpfilter. 211 212config IP_NF_MATCH_TTL 213 tristate '"ttl" match support' 214 depends on NETFILTER_ADVANCED 215 select NETFILTER_XT_MATCH_HL 216 ---help--- 217 This is a backwards-compat option for the user's convenience 218 (e.g. when running oldconfig). It selects 219 CONFIG_NETFILTER_XT_MATCH_HL. 220 221# `filter', generic and specific targets 222config IP_NF_FILTER 223 tristate "Packet filtering" 224 default m if NETFILTER_ADVANCED=n 225 help 226 Packet filtering defines a table `filter', which has a series of 227 rules for simple packet filtering at local input, forwarding and 228 local output. See the man page for iptables(8). 229 230 To compile it as a module, choose M here. If unsure, say N. 231 232config IP_NF_TARGET_REJECT 233 tristate "REJECT target support" 234 depends on IP_NF_FILTER 235 select NF_REJECT_IPV4 236 default m if NETFILTER_ADVANCED=n 237 help 238 The REJECT target allows a filtering rule to specify that an ICMP 239 error should be issued in response to an incoming packet, rather 240 than silently being dropped. 241 242 To compile it as a module, choose M here. If unsure, say N. 243 244config IP_NF_TARGET_SYNPROXY 245 tristate "SYNPROXY target support" 246 depends on NF_CONNTRACK && NETFILTER_ADVANCED 247 select NETFILTER_SYNPROXY 248 select SYN_COOKIES 249 help 250 The SYNPROXY target allows you to intercept TCP connections and 251 establish them using syncookies before they are passed on to the 252 server. This allows to avoid conntrack and server resource usage 253 during SYN-flood attacks. 254 255 To compile it as a module, choose M here. If unsure, say N. 256 257# NAT + specific targets: nf_conntrack 258config IP_NF_NAT 259 tristate "iptables NAT support" 260 depends on NF_CONNTRACK 261 default m if NETFILTER_ADVANCED=n 262 select NF_NAT 263 select NF_NAT_IPV4 264 select NETFILTER_XT_NAT 265 help 266 This enables the `nat' table in iptables. This allows masquerading, 267 port forwarding and other forms of full Network Address Port 268 Translation. 269 270 To compile it as a module, choose M here. If unsure, say N. 271 272if IP_NF_NAT 273 274config IP_NF_TARGET_MASQUERADE 275 tristate "MASQUERADE target support" 276 select NF_NAT_MASQUERADE 277 default m if NETFILTER_ADVANCED=n 278 help 279 Masquerading is a special case of NAT: all outgoing connections are 280 changed to seem to come from a particular interface's address, and 281 if the interface goes down, those connections are lost. This is 282 only useful for dialup accounts with dynamic IP address (ie. your IP 283 address will be different on next dialup). 284 285 To compile it as a module, choose M here. If unsure, say N. 286 287config IP_NF_TARGET_NETMAP 288 tristate "NETMAP target support" 289 depends on NETFILTER_ADVANCED 290 select NETFILTER_XT_TARGET_NETMAP 291 ---help--- 292 This is a backwards-compat option for the user's convenience 293 (e.g. when running oldconfig). It selects 294 CONFIG_NETFILTER_XT_TARGET_NETMAP. 295 296config IP_NF_TARGET_REDIRECT 297 tristate "REDIRECT target support" 298 depends on NETFILTER_ADVANCED 299 select NETFILTER_XT_TARGET_REDIRECT 300 ---help--- 301 This is a backwards-compat option for the user's convenience 302 (e.g. when running oldconfig). It selects 303 CONFIG_NETFILTER_XT_TARGET_REDIRECT. 304 305endif # IP_NF_NAT 306 307# mangle + specific targets 308config IP_NF_MANGLE 309 tristate "Packet mangling" 310 default m if NETFILTER_ADVANCED=n 311 help 312 This option adds a `mangle' table to iptables: see the man page for 313 iptables(8). This table is used for various packet alterations 314 which can effect how the packet is routed. 315 316 To compile it as a module, choose M here. If unsure, say N. 317 318config IP_NF_TARGET_CLUSTERIP 319 tristate "CLUSTERIP target support" 320 depends on IP_NF_MANGLE 321 depends on NF_CONNTRACK 322 depends on NETFILTER_ADVANCED 323 select NF_CONNTRACK_MARK 324 select NETFILTER_FAMILY_ARP 325 help 326 The CLUSTERIP target allows you to build load-balancing clusters of 327 network servers without having a dedicated load-balancing 328 router/server/switch. 329 330 To compile it as a module, choose M here. If unsure, say N. 331 332config IP_NF_TARGET_ECN 333 tristate "ECN target support" 334 depends on IP_NF_MANGLE 335 depends on NETFILTER_ADVANCED 336 ---help--- 337 This option adds a `ECN' target, which can be used in the iptables mangle 338 table. 339 340 You can use this target to remove the ECN bits from the IPv4 header of 341 an IP packet. This is particularly useful, if you need to work around 342 existing ECN blackholes on the internet, but don't want to disable 343 ECN support in general. 344 345 To compile it as a module, choose M here. If unsure, say N. 346 347config IP_NF_TARGET_TTL 348 tristate '"TTL" target support' 349 depends on NETFILTER_ADVANCED && IP_NF_MANGLE 350 select NETFILTER_XT_TARGET_HL 351 ---help--- 352 This is a backwards-compatible option for the user's convenience 353 (e.g. when running oldconfig). It selects 354 CONFIG_NETFILTER_XT_TARGET_HL. 355 356# raw + specific targets 357config IP_NF_RAW 358 tristate 'raw table support (required for NOTRACK/TRACE)' 359 help 360 This option adds a `raw' table to iptables. This table is the very 361 first in the netfilter framework and hooks in at the PREROUTING 362 and OUTPUT chains. 363 364 If you want to compile it as a module, say M here and read 365 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 366 367# security table for MAC policy 368config IP_NF_SECURITY 369 tristate "Security table" 370 depends on SECURITY 371 depends on NETFILTER_ADVANCED 372 help 373 This option adds a `security' table to iptables, for use 374 with Mandatory Access Control (MAC) policy. 375 376 If unsure, say N. 377 378endif # IP_NF_IPTABLES 379 380# ARP tables 381config IP_NF_ARPTABLES 382 tristate "ARP tables support" 383 select NETFILTER_XTABLES 384 select NETFILTER_FAMILY_ARP 385 depends on NETFILTER_ADVANCED 386 help 387 arptables is a general, extensible packet identification framework. 388 The ARP packet filtering and mangling (manipulation)subsystems 389 use this: say Y or M here if you want to use either of those. 390 391 To compile it as a module, choose M here. If unsure, say N. 392 393if IP_NF_ARPTABLES 394 395config IP_NF_ARPFILTER 396 tristate "ARP packet filtering" 397 help 398 ARP packet filtering defines a table `filter', which has a series of 399 rules for simple ARP packet filtering at local input and 400 local output. On a bridge, you can also specify filtering rules 401 for forwarded ARP packets. See the man page for arptables(8). 402 403 To compile it as a module, choose M here. If unsure, say N. 404 405config IP_NF_ARP_MANGLE 406 tristate "ARP payload mangling" 407 help 408 Allows altering the ARP packet payload: source and destination 409 hardware and network addresses. 410 411endif # IP_NF_ARPTABLES 412 413endmenu 414 415