1# 2# IP netfilter configuration 3# 4 5menu "IPv6: Netfilter Configuration" 6 depends on INET && IPV6 && NETFILTER 7 8config NF_DEFRAG_IPV6 9 tristate 10 default n 11 12config NF_CONNTRACK_IPV6 13 tristate "IPv6 connection tracking support" 14 depends on INET && IPV6 && NF_CONNTRACK 15 default m if NETFILTER_ADVANCED=n 16 select NF_DEFRAG_IPV6 17 ---help--- 18 Connection tracking keeps a record of what packets have passed 19 through your machine, in order to figure out how they are related 20 into connections. 21 22 This is IPv6 support on Layer 3 independent connection tracking. 23 Layer 3 independent connection tracking is experimental scheme 24 which generalize ip_conntrack to support other layer 3 protocols. 25 26 To compile it as a module, choose M here. If unsure, say N. 27 28config NF_SOCKET_IPV6 29 tristate "IPv6 socket lookup support" 30 help 31 This option enables the IPv6 socket lookup infrastructure. This 32 is used by the ip6tables socket match. 33 34if NF_TABLES 35 36config NF_TABLES_IPV6 37 tristate "IPv6 nf_tables support" 38 help 39 This option enables the IPv6 support for nf_tables. 40 41if NF_TABLES_IPV6 42 43config NFT_CHAIN_ROUTE_IPV6 44 tristate "IPv6 nf_tables route chain support" 45 help 46 This option enables the "route" chain for IPv6 in nf_tables. This 47 chain type is used to force packet re-routing after mangling header 48 fields such as the source, destination, flowlabel, hop-limit and 49 the packet mark. 50 51config NFT_REJECT_IPV6 52 select NF_REJECT_IPV6 53 default NFT_REJECT 54 tristate 55 56config NFT_DUP_IPV6 57 tristate "IPv6 nf_tables packet duplication support" 58 depends on !NF_CONNTRACK || NF_CONNTRACK 59 select NF_DUP_IPV6 60 help 61 This module enables IPv6 packet duplication support for nf_tables. 62 63config NFT_FIB_IPV6 64 tristate "nf_tables fib / ipv6 route lookup support" 65 select NFT_FIB 66 help 67 This module enables IPv6 FIB lookups, e.g. for reverse path filtering. 68 It also allows query of the FIB for the route type, e.g. local, unicast, 69 multicast or blackhole. 70 71endif # NF_TABLES_IPV6 72endif # NF_TABLES 73 74config NF_DUP_IPV6 75 tristate "Netfilter IPv6 packet duplication to alternate destination" 76 depends on !NF_CONNTRACK || NF_CONNTRACK 77 help 78 This option enables the nf_dup_ipv6 core, which duplicates an IPv6 79 packet to be rerouted to another destination. 80 81config NF_REJECT_IPV6 82 tristate "IPv6 packet rejection" 83 default m if NETFILTER_ADVANCED=n 84 85config NF_LOG_IPV6 86 tristate "IPv6 packet logging" 87 default m if NETFILTER_ADVANCED=n 88 select NF_LOG_COMMON 89 90config NF_NAT_IPV6 91 tristate "IPv6 NAT" 92 depends on NF_CONNTRACK_IPV6 93 depends on NETFILTER_ADVANCED 94 select NF_NAT 95 help 96 The IPv6 NAT option allows masquerading, port forwarding and other 97 forms of full Network Address Port Translation. This can be 98 controlled by iptables or nft. 99 100if NF_NAT_IPV6 101 102config NFT_CHAIN_NAT_IPV6 103 depends on NF_TABLES_IPV6 104 tristate "IPv6 nf_tables nat chain support" 105 help 106 This option enables the "nat" chain for IPv6 in nf_tables. This 107 chain type is used to perform Network Address Translation (NAT) 108 packet transformations such as the source, destination address and 109 source and destination ports. 110 111config NF_NAT_MASQUERADE_IPV6 112 tristate "IPv6 masquerade support" 113 help 114 This is the kernel functionality to provide NAT in the masquerade 115 flavour (automatic source address selection) for IPv6. 116 117config NFT_MASQ_IPV6 118 tristate "IPv6 masquerade support for nf_tables" 119 depends on NF_TABLES_IPV6 120 depends on NFT_MASQ 121 select NF_NAT_MASQUERADE_IPV6 122 help 123 This is the expression that provides IPv4 masquerading support for 124 nf_tables. 125 126config NFT_REDIR_IPV6 127 tristate "IPv6 redirect support for nf_tables" 128 depends on NF_TABLES_IPV6 129 depends on NFT_REDIR 130 select NF_NAT_REDIRECT 131 help 132 This is the expression that provides IPv4 redirect support for 133 nf_tables. 134 135endif # NF_NAT_IPV6 136 137config IP6_NF_IPTABLES 138 tristate "IP6 tables support (required for filtering)" 139 depends on INET && IPV6 140 select NETFILTER_XTABLES 141 default m if NETFILTER_ADVANCED=n 142 help 143 ip6tables is a general, extensible packet identification framework. 144 Currently only the packet filtering and packet mangling subsystem 145 for IPv6 use this, but connection tracking is going to follow. 146 Say 'Y' or 'M' here if you want to use either of those. 147 148 To compile it as a module, choose M here. If unsure, say N. 149 150if IP6_NF_IPTABLES 151 152# The simple matches. 153config IP6_NF_MATCH_AH 154 tristate '"ah" match support' 155 depends on NETFILTER_ADVANCED 156 help 157 This module allows one to match AH packets. 158 159 To compile it as a module, choose M here. If unsure, say N. 160 161config IP6_NF_MATCH_EUI64 162 tristate '"eui64" address check' 163 depends on NETFILTER_ADVANCED 164 help 165 This module performs checking on the IPv6 source address 166 Compares the last 64 bits with the EUI64 (delivered 167 from the MAC address) address 168 169 To compile it as a module, choose M here. If unsure, say N. 170 171config IP6_NF_MATCH_FRAG 172 tristate '"frag" Fragmentation header match support' 173 depends on NETFILTER_ADVANCED 174 help 175 frag matching allows you to match packets based on the fragmentation 176 header of the packet. 177 178 To compile it as a module, choose M here. If unsure, say N. 179 180config IP6_NF_MATCH_OPTS 181 tristate '"hbh" hop-by-hop and "dst" opts header match support' 182 depends on NETFILTER_ADVANCED 183 help 184 This allows one to match packets based on the hop-by-hop 185 and destination options headers of a packet. 186 187 To compile it as a module, choose M here. If unsure, say N. 188 189config IP6_NF_MATCH_HL 190 tristate '"hl" hoplimit match support' 191 depends on NETFILTER_ADVANCED 192 select NETFILTER_XT_MATCH_HL 193 ---help--- 194 This is a backwards-compat option for the user's convenience 195 (e.g. when running oldconfig). It selects 196 CONFIG_NETFILTER_XT_MATCH_HL. 197 198config IP6_NF_MATCH_IPV6HEADER 199 tristate '"ipv6header" IPv6 Extension Headers Match' 200 default m if NETFILTER_ADVANCED=n 201 help 202 This module allows one to match packets based upon 203 the ipv6 extension headers. 204 205 To compile it as a module, choose M here. If unsure, say N. 206 207config IP6_NF_MATCH_MH 208 tristate '"mh" match support' 209 depends on NETFILTER_ADVANCED 210 help 211 This module allows one to match MH packets. 212 213 To compile it as a module, choose M here. If unsure, say N. 214 215config IP6_NF_MATCH_RPFILTER 216 tristate '"rpfilter" reverse path filter match support' 217 depends on NETFILTER_ADVANCED 218 depends on IP6_NF_MANGLE || IP6_NF_RAW 219 ---help--- 220 This option allows you to match packets whose replies would 221 go out via the interface the packet came in. 222 223 To compile it as a module, choose M here. If unsure, say N. 224 The module will be called ip6t_rpfilter. 225 226config IP6_NF_MATCH_RT 227 tristate '"rt" Routing header match support' 228 depends on NETFILTER_ADVANCED 229 help 230 rt matching allows you to match packets based on the routing 231 header of the packet. 232 233 To compile it as a module, choose M here. If unsure, say N. 234 235# The targets 236config IP6_NF_TARGET_HL 237 tristate '"HL" hoplimit target support' 238 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE 239 select NETFILTER_XT_TARGET_HL 240 ---help--- 241 This is a backwards-compatible option for the user's convenience 242 (e.g. when running oldconfig). It selects 243 CONFIG_NETFILTER_XT_TARGET_HL. 244 245config IP6_NF_FILTER 246 tristate "Packet filtering" 247 default m if NETFILTER_ADVANCED=n 248 help 249 Packet filtering defines a table `filter', which has a series of 250 rules for simple packet filtering at local input, forwarding and 251 local output. See the man page for iptables(8). 252 253 To compile it as a module, choose M here. If unsure, say N. 254 255config IP6_NF_TARGET_REJECT 256 tristate "REJECT target support" 257 depends on IP6_NF_FILTER 258 select NF_REJECT_IPV6 259 default m if NETFILTER_ADVANCED=n 260 help 261 The REJECT target allows a filtering rule to specify that an ICMPv6 262 error should be issued in response to an incoming packet, rather 263 than silently being dropped. 264 265 To compile it as a module, choose M here. If unsure, say N. 266 267config IP6_NF_TARGET_SYNPROXY 268 tristate "SYNPROXY target support" 269 depends on NF_CONNTRACK && NETFILTER_ADVANCED 270 select NETFILTER_SYNPROXY 271 select SYN_COOKIES 272 help 273 The SYNPROXY target allows you to intercept TCP connections and 274 establish them using syncookies before they are passed on to the 275 server. This allows to avoid conntrack and server resource usage 276 during SYN-flood attacks. 277 278 To compile it as a module, choose M here. If unsure, say N. 279 280config IP6_NF_MANGLE 281 tristate "Packet mangling" 282 default m if NETFILTER_ADVANCED=n 283 help 284 This option adds a `mangle' table to iptables: see the man page for 285 iptables(8). This table is used for various packet alterations 286 which can effect how the packet is routed. 287 288 To compile it as a module, choose M here. If unsure, say N. 289 290config IP6_NF_RAW 291 tristate 'raw table support (required for TRACE)' 292 help 293 This option adds a `raw' table to ip6tables. This table is the very 294 first in the netfilter framework and hooks in at the PREROUTING 295 and OUTPUT chains. 296 297 If you want to compile it as a module, say M here and read 298 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 299 300# security table for MAC policy 301config IP6_NF_SECURITY 302 tristate "Security table" 303 depends on SECURITY 304 depends on NETFILTER_ADVANCED 305 help 306 This option adds a `security' table to iptables, for use 307 with Mandatory Access Control (MAC) policy. 308 309 If unsure, say N. 310 311config IP6_NF_NAT 312 tristate "ip6tables NAT support" 313 depends on NF_CONNTRACK_IPV6 314 depends on NETFILTER_ADVANCED 315 select NF_NAT 316 select NF_NAT_IPV6 317 select NETFILTER_XT_NAT 318 help 319 This enables the `nat' table in ip6tables. This allows masquerading, 320 port forwarding and other forms of full Network Address Port 321 Translation. 322 323 To compile it as a module, choose M here. If unsure, say N. 324 325if IP6_NF_NAT 326 327config IP6_NF_TARGET_MASQUERADE 328 tristate "MASQUERADE target support" 329 select NF_NAT_MASQUERADE_IPV6 330 help 331 Masquerading is a special case of NAT: all outgoing connections are 332 changed to seem to come from a particular interface's address, and 333 if the interface goes down, those connections are lost. This is 334 only useful for dialup accounts with dynamic IP address (ie. your IP 335 address will be different on next dialup). 336 337 To compile it as a module, choose M here. If unsure, say N. 338 339config IP6_NF_TARGET_NPT 340 tristate "NPT (Network Prefix translation) target support" 341 help 342 This option adds the `SNPT' and `DNPT' target, which perform 343 stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296. 344 345 To compile it as a module, choose M here. If unsure, say N. 346 347endif # IP6_NF_NAT 348 349endif # IP6_NF_IPTABLES 350 351endmenu 352 353