1# 2# IP netfilter configuration 3# 4 5menu "IPv6: Netfilter Configuration" 6 depends on INET && IPV6 && NETFILTER 7 8config NF_SOCKET_IPV6 9 tristate "IPv6 socket lookup support" 10 help 11 This option enables the IPv6 socket lookup infrastructure. This 12 is used by the {ip6,nf}tables socket match. 13 14config NF_TPROXY_IPV6 15 tristate "IPv6 tproxy support" 16 17if NF_TABLES 18 19config NF_TABLES_IPV6 20 bool "IPv6 nf_tables support" 21 help 22 This option enables the IPv6 support for nf_tables. 23 24if NF_TABLES_IPV6 25 26config NFT_CHAIN_ROUTE_IPV6 27 tristate "IPv6 nf_tables route chain support" 28 help 29 This option enables the "route" chain for IPv6 in nf_tables. This 30 chain type is used to force packet re-routing after mangling header 31 fields such as the source, destination, flowlabel, hop-limit and 32 the packet mark. 33 34if NF_NAT 35 36config NFT_CHAIN_NAT_IPV6 37 tristate "IPv6 nf_tables nat chain support" 38 help 39 This option enables the "nat" chain for IPv6 in nf_tables. This 40 chain type is used to perform Network Address Translation (NAT) 41 packet transformations such as the source, destination address and 42 source and destination ports. 43endif # NF_NAT 44 45config NFT_REJECT_IPV6 46 select NF_REJECT_IPV6 47 default NFT_REJECT 48 tristate 49 50config NFT_DUP_IPV6 51 tristate "IPv6 nf_tables packet duplication support" 52 depends on !NF_CONNTRACK || NF_CONNTRACK 53 select NF_DUP_IPV6 54 help 55 This module enables IPv6 packet duplication support for nf_tables. 56 57config NFT_FIB_IPV6 58 tristate "nf_tables fib / ipv6 route lookup support" 59 select NFT_FIB 60 help 61 This module enables IPv6 FIB lookups, e.g. for reverse path filtering. 62 It also allows query of the FIB for the route type, e.g. local, unicast, 63 multicast or blackhole. 64 65endif # NF_TABLES_IPV6 66endif # NF_TABLES 67 68config NF_FLOW_TABLE_IPV6 69 tristate "Netfilter flow table IPv6 module" 70 depends on NF_FLOW_TABLE 71 help 72 This option adds the flow table IPv6 support. 73 74 To compile it as a module, choose M here. 75 76config NF_DUP_IPV6 77 tristate "Netfilter IPv6 packet duplication to alternate destination" 78 depends on !NF_CONNTRACK || NF_CONNTRACK 79 help 80 This option enables the nf_dup_ipv6 core, which duplicates an IPv6 81 packet to be rerouted to another destination. 82 83config NF_REJECT_IPV6 84 tristate "IPv6 packet rejection" 85 default m if NETFILTER_ADVANCED=n 86 87config NF_LOG_IPV6 88 tristate "IPv6 packet logging" 89 default m if NETFILTER_ADVANCED=n 90 select NF_LOG_COMMON 91 92config IP6_NF_IPTABLES 93 tristate "IP6 tables support (required for filtering)" 94 depends on INET && IPV6 95 select NETFILTER_XTABLES 96 default m if NETFILTER_ADVANCED=n 97 help 98 ip6tables is a general, extensible packet identification framework. 99 Currently only the packet filtering and packet mangling subsystem 100 for IPv6 use this, but connection tracking is going to follow. 101 Say 'Y' or 'M' here if you want to use either of those. 102 103 To compile it as a module, choose M here. If unsure, say N. 104 105if IP6_NF_IPTABLES 106 107# The simple matches. 108config IP6_NF_MATCH_AH 109 tristate '"ah" match support' 110 depends on NETFILTER_ADVANCED 111 help 112 This module allows one to match AH packets. 113 114 To compile it as a module, choose M here. If unsure, say N. 115 116config IP6_NF_MATCH_EUI64 117 tristate '"eui64" address check' 118 depends on NETFILTER_ADVANCED 119 help 120 This module performs checking on the IPv6 source address 121 Compares the last 64 bits with the EUI64 (delivered 122 from the MAC address) address 123 124 To compile it as a module, choose M here. If unsure, say N. 125 126config IP6_NF_MATCH_FRAG 127 tristate '"frag" Fragmentation header match support' 128 depends on NETFILTER_ADVANCED 129 help 130 frag matching allows you to match packets based on the fragmentation 131 header of the packet. 132 133 To compile it as a module, choose M here. If unsure, say N. 134 135config IP6_NF_MATCH_OPTS 136 tristate '"hbh" hop-by-hop and "dst" opts header match support' 137 depends on NETFILTER_ADVANCED 138 help 139 This allows one to match packets based on the hop-by-hop 140 and destination options headers of a packet. 141 142 To compile it as a module, choose M here. If unsure, say N. 143 144config IP6_NF_MATCH_HL 145 tristate '"hl" hoplimit match support' 146 depends on NETFILTER_ADVANCED 147 select NETFILTER_XT_MATCH_HL 148 ---help--- 149 This is a backwards-compat option for the user's convenience 150 (e.g. when running oldconfig). It selects 151 CONFIG_NETFILTER_XT_MATCH_HL. 152 153config IP6_NF_MATCH_IPV6HEADER 154 tristate '"ipv6header" IPv6 Extension Headers Match' 155 default m if NETFILTER_ADVANCED=n 156 help 157 This module allows one to match packets based upon 158 the ipv6 extension headers. 159 160 To compile it as a module, choose M here. If unsure, say N. 161 162config IP6_NF_MATCH_MH 163 tristate '"mh" match support' 164 depends on NETFILTER_ADVANCED 165 help 166 This module allows one to match MH packets. 167 168 To compile it as a module, choose M here. If unsure, say N. 169 170config IP6_NF_MATCH_RPFILTER 171 tristate '"rpfilter" reverse path filter match support' 172 depends on NETFILTER_ADVANCED 173 depends on IP6_NF_MANGLE || IP6_NF_RAW 174 ---help--- 175 This option allows you to match packets whose replies would 176 go out via the interface the packet came in. 177 178 To compile it as a module, choose M here. If unsure, say N. 179 The module will be called ip6t_rpfilter. 180 181config IP6_NF_MATCH_RT 182 tristate '"rt" Routing header match support' 183 depends on NETFILTER_ADVANCED 184 help 185 rt matching allows you to match packets based on the routing 186 header of the packet. 187 188 To compile it as a module, choose M here. If unsure, say N. 189 190config IP6_NF_MATCH_SRH 191 tristate '"srh" Segment Routing header match support' 192 depends on NETFILTER_ADVANCED 193 help 194 srh matching allows you to match packets based on the segment 195 routing header of the packet. 196 197 To compile it as a module, choose M here. If unsure, say N. 198 199# The targets 200config IP6_NF_TARGET_HL 201 tristate '"HL" hoplimit target support' 202 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE 203 select NETFILTER_XT_TARGET_HL 204 ---help--- 205 This is a backwards-compatible option for the user's convenience 206 (e.g. when running oldconfig). It selects 207 CONFIG_NETFILTER_XT_TARGET_HL. 208 209config IP6_NF_FILTER 210 tristate "Packet filtering" 211 default m if NETFILTER_ADVANCED=n 212 help 213 Packet filtering defines a table `filter', which has a series of 214 rules for simple packet filtering at local input, forwarding and 215 local output. See the man page for iptables(8). 216 217 To compile it as a module, choose M here. If unsure, say N. 218 219config IP6_NF_TARGET_REJECT 220 tristate "REJECT target support" 221 depends on IP6_NF_FILTER 222 select NF_REJECT_IPV6 223 default m if NETFILTER_ADVANCED=n 224 help 225 The REJECT target allows a filtering rule to specify that an ICMPv6 226 error should be issued in response to an incoming packet, rather 227 than silently being dropped. 228 229 To compile it as a module, choose M here. If unsure, say N. 230 231config IP6_NF_TARGET_SYNPROXY 232 tristate "SYNPROXY target support" 233 depends on NF_CONNTRACK && NETFILTER_ADVANCED 234 select NETFILTER_SYNPROXY 235 select SYN_COOKIES 236 help 237 The SYNPROXY target allows you to intercept TCP connections and 238 establish them using syncookies before they are passed on to the 239 server. This allows to avoid conntrack and server resource usage 240 during SYN-flood attacks. 241 242 To compile it as a module, choose M here. If unsure, say N. 243 244config IP6_NF_MANGLE 245 tristate "Packet mangling" 246 default m if NETFILTER_ADVANCED=n 247 help 248 This option adds a `mangle' table to iptables: see the man page for 249 iptables(8). This table is used for various packet alterations 250 which can effect how the packet is routed. 251 252 To compile it as a module, choose M here. If unsure, say N. 253 254config IP6_NF_RAW 255 tristate 'raw table support (required for TRACE)' 256 help 257 This option adds a `raw' table to ip6tables. This table is the very 258 first in the netfilter framework and hooks in at the PREROUTING 259 and OUTPUT chains. 260 261 If you want to compile it as a module, say M here and read 262 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 263 264# security table for MAC policy 265config IP6_NF_SECURITY 266 tristate "Security table" 267 depends on SECURITY 268 depends on NETFILTER_ADVANCED 269 help 270 This option adds a `security' table to iptables, for use 271 with Mandatory Access Control (MAC) policy. 272 273 If unsure, say N. 274 275config IP6_NF_NAT 276 tristate "ip6tables NAT support" 277 depends on NF_CONNTRACK 278 depends on NETFILTER_ADVANCED 279 select NF_NAT 280 select NETFILTER_XT_NAT 281 help 282 This enables the `nat' table in ip6tables. This allows masquerading, 283 port forwarding and other forms of full Network Address Port 284 Translation. 285 286 To compile it as a module, choose M here. If unsure, say N. 287 288if IP6_NF_NAT 289 290config IP6_NF_TARGET_MASQUERADE 291 tristate "MASQUERADE target support" 292 select NF_NAT_MASQUERADE 293 help 294 Masquerading is a special case of NAT: all outgoing connections are 295 changed to seem to come from a particular interface's address, and 296 if the interface goes down, those connections are lost. This is 297 only useful for dialup accounts with dynamic IP address (ie. your IP 298 address will be different on next dialup). 299 300 To compile it as a module, choose M here. If unsure, say N. 301 302config IP6_NF_TARGET_NPT 303 tristate "NPT (Network Prefix translation) target support" 304 help 305 This option adds the `SNPT' and `DNPT' target, which perform 306 stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296. 307 308 To compile it as a module, choose M here. If unsure, say N. 309 310endif # IP6_NF_NAT 311 312endif # IP6_NF_IPTABLES 313endmenu 314 315config NF_DEFRAG_IPV6 316 tristate 317