1# 2# IP netfilter configuration 3# 4 5menu "IPv6: Netfilter Configuration" 6 depends on INET && IPV6 && NETFILTER 7 8config NF_SOCKET_IPV6 9 tristate "IPv6 socket lookup support" 10 help 11 This option enables the IPv6 socket lookup infrastructure. This 12 is used by the {ip6,nf}tables socket match. 13 14config NF_TPROXY_IPV6 15 tristate "IPv6 tproxy support" 16 17if NF_TABLES 18 19config NF_TABLES_IPV6 20 bool "IPv6 nf_tables support" 21 help 22 This option enables the IPv6 support for nf_tables. 23 24if NF_TABLES_IPV6 25 26config NFT_CHAIN_ROUTE_IPV6 27 tristate "IPv6 nf_tables route chain support" 28 help 29 This option enables the "route" chain for IPv6 in nf_tables. This 30 chain type is used to force packet re-routing after mangling header 31 fields such as the source, destination, flowlabel, hop-limit and 32 the packet mark. 33 34if NF_NAT 35 36config NFT_CHAIN_NAT_IPV6 37 tristate "IPv6 nf_tables nat chain support" 38 help 39 This option enables the "nat" chain for IPv6 in nf_tables. This 40 chain type is used to perform Network Address Translation (NAT) 41 packet transformations such as the source, destination address and 42 source and destination ports. 43 44config NFT_MASQ_IPV6 45 tristate "IPv6 masquerade support for nf_tables" 46 depends on NFT_MASQ 47 select NF_NAT_MASQUERADE 48 help 49 This is the expression that provides IPv4 masquerading support for 50 nf_tables. 51 52config NFT_REDIR_IPV6 53 tristate "IPv6 redirect support for nf_tables" 54 depends on NFT_REDIR 55 select NF_NAT_REDIRECT 56 help 57 This is the expression that provides IPv4 redirect support for 58 nf_tables. 59 60endif # NF_NAT 61 62config NFT_REJECT_IPV6 63 select NF_REJECT_IPV6 64 default NFT_REJECT 65 tristate 66 67config NFT_DUP_IPV6 68 tristate "IPv6 nf_tables packet duplication support" 69 depends on !NF_CONNTRACK || NF_CONNTRACK 70 select NF_DUP_IPV6 71 help 72 This module enables IPv6 packet duplication support for nf_tables. 73 74config NFT_FIB_IPV6 75 tristate "nf_tables fib / ipv6 route lookup support" 76 select NFT_FIB 77 help 78 This module enables IPv6 FIB lookups, e.g. for reverse path filtering. 79 It also allows query of the FIB for the route type, e.g. local, unicast, 80 multicast or blackhole. 81 82endif # NF_TABLES_IPV6 83endif # NF_TABLES 84 85config NF_FLOW_TABLE_IPV6 86 tristate "Netfilter flow table IPv6 module" 87 depends on NF_FLOW_TABLE 88 help 89 This option adds the flow table IPv6 support. 90 91 To compile it as a module, choose M here. 92 93config NF_DUP_IPV6 94 tristate "Netfilter IPv6 packet duplication to alternate destination" 95 depends on !NF_CONNTRACK || NF_CONNTRACK 96 help 97 This option enables the nf_dup_ipv6 core, which duplicates an IPv6 98 packet to be rerouted to another destination. 99 100config NF_REJECT_IPV6 101 tristate "IPv6 packet rejection" 102 default m if NETFILTER_ADVANCED=n 103 104config NF_LOG_IPV6 105 tristate "IPv6 packet logging" 106 default m if NETFILTER_ADVANCED=n 107 select NF_LOG_COMMON 108 109config IP6_NF_IPTABLES 110 tristate "IP6 tables support (required for filtering)" 111 depends on INET && IPV6 112 select NETFILTER_XTABLES 113 default m if NETFILTER_ADVANCED=n 114 help 115 ip6tables is a general, extensible packet identification framework. 116 Currently only the packet filtering and packet mangling subsystem 117 for IPv6 use this, but connection tracking is going to follow. 118 Say 'Y' or 'M' here if you want to use either of those. 119 120 To compile it as a module, choose M here. If unsure, say N. 121 122if IP6_NF_IPTABLES 123 124# The simple matches. 125config IP6_NF_MATCH_AH 126 tristate '"ah" match support' 127 depends on NETFILTER_ADVANCED 128 help 129 This module allows one to match AH packets. 130 131 To compile it as a module, choose M here. If unsure, say N. 132 133config IP6_NF_MATCH_EUI64 134 tristate '"eui64" address check' 135 depends on NETFILTER_ADVANCED 136 help 137 This module performs checking on the IPv6 source address 138 Compares the last 64 bits with the EUI64 (delivered 139 from the MAC address) address 140 141 To compile it as a module, choose M here. If unsure, say N. 142 143config IP6_NF_MATCH_FRAG 144 tristate '"frag" Fragmentation header match support' 145 depends on NETFILTER_ADVANCED 146 help 147 frag matching allows you to match packets based on the fragmentation 148 header of the packet. 149 150 To compile it as a module, choose M here. If unsure, say N. 151 152config IP6_NF_MATCH_OPTS 153 tristate '"hbh" hop-by-hop and "dst" opts header match support' 154 depends on NETFILTER_ADVANCED 155 help 156 This allows one to match packets based on the hop-by-hop 157 and destination options headers of a packet. 158 159 To compile it as a module, choose M here. If unsure, say N. 160 161config IP6_NF_MATCH_HL 162 tristate '"hl" hoplimit match support' 163 depends on NETFILTER_ADVANCED 164 select NETFILTER_XT_MATCH_HL 165 ---help--- 166 This is a backwards-compat option for the user's convenience 167 (e.g. when running oldconfig). It selects 168 CONFIG_NETFILTER_XT_MATCH_HL. 169 170config IP6_NF_MATCH_IPV6HEADER 171 tristate '"ipv6header" IPv6 Extension Headers Match' 172 default m if NETFILTER_ADVANCED=n 173 help 174 This module allows one to match packets based upon 175 the ipv6 extension headers. 176 177 To compile it as a module, choose M here. If unsure, say N. 178 179config IP6_NF_MATCH_MH 180 tristate '"mh" match support' 181 depends on NETFILTER_ADVANCED 182 help 183 This module allows one to match MH packets. 184 185 To compile it as a module, choose M here. If unsure, say N. 186 187config IP6_NF_MATCH_RPFILTER 188 tristate '"rpfilter" reverse path filter match support' 189 depends on NETFILTER_ADVANCED 190 depends on IP6_NF_MANGLE || IP6_NF_RAW 191 ---help--- 192 This option allows you to match packets whose replies would 193 go out via the interface the packet came in. 194 195 To compile it as a module, choose M here. If unsure, say N. 196 The module will be called ip6t_rpfilter. 197 198config IP6_NF_MATCH_RT 199 tristate '"rt" Routing header match support' 200 depends on NETFILTER_ADVANCED 201 help 202 rt matching allows you to match packets based on the routing 203 header of the packet. 204 205 To compile it as a module, choose M here. If unsure, say N. 206 207config IP6_NF_MATCH_SRH 208 tristate '"srh" Segment Routing header match support' 209 depends on NETFILTER_ADVANCED 210 help 211 srh matching allows you to match packets based on the segment 212 routing header of the packet. 213 214 To compile it as a module, choose M here. If unsure, say N. 215 216# The targets 217config IP6_NF_TARGET_HL 218 tristate '"HL" hoplimit target support' 219 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE 220 select NETFILTER_XT_TARGET_HL 221 ---help--- 222 This is a backwards-compatible option for the user's convenience 223 (e.g. when running oldconfig). It selects 224 CONFIG_NETFILTER_XT_TARGET_HL. 225 226config IP6_NF_FILTER 227 tristate "Packet filtering" 228 default m if NETFILTER_ADVANCED=n 229 help 230 Packet filtering defines a table `filter', which has a series of 231 rules for simple packet filtering at local input, forwarding and 232 local output. See the man page for iptables(8). 233 234 To compile it as a module, choose M here. If unsure, say N. 235 236config IP6_NF_TARGET_REJECT 237 tristate "REJECT target support" 238 depends on IP6_NF_FILTER 239 select NF_REJECT_IPV6 240 default m if NETFILTER_ADVANCED=n 241 help 242 The REJECT target allows a filtering rule to specify that an ICMPv6 243 error should be issued in response to an incoming packet, rather 244 than silently being dropped. 245 246 To compile it as a module, choose M here. If unsure, say N. 247 248config IP6_NF_TARGET_SYNPROXY 249 tristate "SYNPROXY target support" 250 depends on NF_CONNTRACK && NETFILTER_ADVANCED 251 select NETFILTER_SYNPROXY 252 select SYN_COOKIES 253 help 254 The SYNPROXY target allows you to intercept TCP connections and 255 establish them using syncookies before they are passed on to the 256 server. This allows to avoid conntrack and server resource usage 257 during SYN-flood attacks. 258 259 To compile it as a module, choose M here. If unsure, say N. 260 261config IP6_NF_MANGLE 262 tristate "Packet mangling" 263 default m if NETFILTER_ADVANCED=n 264 help 265 This option adds a `mangle' table to iptables: see the man page for 266 iptables(8). This table is used for various packet alterations 267 which can effect how the packet is routed. 268 269 To compile it as a module, choose M here. If unsure, say N. 270 271config IP6_NF_RAW 272 tristate 'raw table support (required for TRACE)' 273 help 274 This option adds a `raw' table to ip6tables. This table is the very 275 first in the netfilter framework and hooks in at the PREROUTING 276 and OUTPUT chains. 277 278 If you want to compile it as a module, say M here and read 279 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 280 281# security table for MAC policy 282config IP6_NF_SECURITY 283 tristate "Security table" 284 depends on SECURITY 285 depends on NETFILTER_ADVANCED 286 help 287 This option adds a `security' table to iptables, for use 288 with Mandatory Access Control (MAC) policy. 289 290 If unsure, say N. 291 292config IP6_NF_NAT 293 tristate "ip6tables NAT support" 294 depends on NF_CONNTRACK 295 depends on NETFILTER_ADVANCED 296 select NF_NAT 297 select NETFILTER_XT_NAT 298 help 299 This enables the `nat' table in ip6tables. This allows masquerading, 300 port forwarding and other forms of full Network Address Port 301 Translation. 302 303 To compile it as a module, choose M here. If unsure, say N. 304 305if IP6_NF_NAT 306 307config IP6_NF_TARGET_MASQUERADE 308 tristate "MASQUERADE target support" 309 select NF_NAT_MASQUERADE 310 help 311 Masquerading is a special case of NAT: all outgoing connections are 312 changed to seem to come from a particular interface's address, and 313 if the interface goes down, those connections are lost. This is 314 only useful for dialup accounts with dynamic IP address (ie. your IP 315 address will be different on next dialup). 316 317 To compile it as a module, choose M here. If unsure, say N. 318 319config IP6_NF_TARGET_NPT 320 tristate "NPT (Network Prefix translation) target support" 321 help 322 This option adds the `SNPT' and `DNPT' target, which perform 323 stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296. 324 325 To compile it as a module, choose M here. If unsure, say N. 326 327endif # IP6_NF_NAT 328 329endif # IP6_NF_IPTABLES 330endmenu 331 332config NF_DEFRAG_IPV6 333 tristate 334