1# 2# IP netfilter configuration 3# 4 5menu "IPv6: Netfilter Configuration" 6 depends on INET && IPV6 && NETFILTER 7 8config NF_SOCKET_IPV6 9 tristate "IPv6 socket lookup support" 10 help 11 This option enables the IPv6 socket lookup infrastructure. This 12 is used by the {ip6,nf}tables socket match. 13 14config NF_TPROXY_IPV6 15 tristate "IPv6 tproxy support" 16 17if NF_TABLES 18 19config NF_TABLES_IPV6 20 bool "IPv6 nf_tables support" 21 help 22 This option enables the IPv6 support for nf_tables. 23 24if NF_TABLES_IPV6 25 26config NFT_CHAIN_ROUTE_IPV6 27 tristate "IPv6 nf_tables route chain support" 28 help 29 This option enables the "route" chain for IPv6 in nf_tables. This 30 chain type is used to force packet re-routing after mangling header 31 fields such as the source, destination, flowlabel, hop-limit and 32 the packet mark. 33 34if NF_NAT 35 36config NFT_CHAIN_NAT_IPV6 37 tristate "IPv6 nf_tables nat chain support" 38 help 39 This option enables the "nat" chain for IPv6 in nf_tables. This 40 chain type is used to perform Network Address Translation (NAT) 41 packet transformations such as the source, destination address and 42 source and destination ports. 43 44config NFT_MASQ_IPV6 45 tristate "IPv6 masquerade support for nf_tables" 46 depends on NFT_MASQ 47 select NF_NAT_MASQUERADE 48 help 49 This is the expression that provides IPv4 masquerading support for 50 nf_tables. 51 52endif # NF_NAT 53 54config NFT_REJECT_IPV6 55 select NF_REJECT_IPV6 56 default NFT_REJECT 57 tristate 58 59config NFT_DUP_IPV6 60 tristate "IPv6 nf_tables packet duplication support" 61 depends on !NF_CONNTRACK || NF_CONNTRACK 62 select NF_DUP_IPV6 63 help 64 This module enables IPv6 packet duplication support for nf_tables. 65 66config NFT_FIB_IPV6 67 tristate "nf_tables fib / ipv6 route lookup support" 68 select NFT_FIB 69 help 70 This module enables IPv6 FIB lookups, e.g. for reverse path filtering. 71 It also allows query of the FIB for the route type, e.g. local, unicast, 72 multicast or blackhole. 73 74endif # NF_TABLES_IPV6 75endif # NF_TABLES 76 77config NF_FLOW_TABLE_IPV6 78 tristate "Netfilter flow table IPv6 module" 79 depends on NF_FLOW_TABLE 80 help 81 This option adds the flow table IPv6 support. 82 83 To compile it as a module, choose M here. 84 85config NF_DUP_IPV6 86 tristate "Netfilter IPv6 packet duplication to alternate destination" 87 depends on !NF_CONNTRACK || NF_CONNTRACK 88 help 89 This option enables the nf_dup_ipv6 core, which duplicates an IPv6 90 packet to be rerouted to another destination. 91 92config NF_REJECT_IPV6 93 tristate "IPv6 packet rejection" 94 default m if NETFILTER_ADVANCED=n 95 96config NF_LOG_IPV6 97 tristate "IPv6 packet logging" 98 default m if NETFILTER_ADVANCED=n 99 select NF_LOG_COMMON 100 101config IP6_NF_IPTABLES 102 tristate "IP6 tables support (required for filtering)" 103 depends on INET && IPV6 104 select NETFILTER_XTABLES 105 default m if NETFILTER_ADVANCED=n 106 help 107 ip6tables is a general, extensible packet identification framework. 108 Currently only the packet filtering and packet mangling subsystem 109 for IPv6 use this, but connection tracking is going to follow. 110 Say 'Y' or 'M' here if you want to use either of those. 111 112 To compile it as a module, choose M here. If unsure, say N. 113 114if IP6_NF_IPTABLES 115 116# The simple matches. 117config IP6_NF_MATCH_AH 118 tristate '"ah" match support' 119 depends on NETFILTER_ADVANCED 120 help 121 This module allows one to match AH packets. 122 123 To compile it as a module, choose M here. If unsure, say N. 124 125config IP6_NF_MATCH_EUI64 126 tristate '"eui64" address check' 127 depends on NETFILTER_ADVANCED 128 help 129 This module performs checking on the IPv6 source address 130 Compares the last 64 bits with the EUI64 (delivered 131 from the MAC address) address 132 133 To compile it as a module, choose M here. If unsure, say N. 134 135config IP6_NF_MATCH_FRAG 136 tristate '"frag" Fragmentation header match support' 137 depends on NETFILTER_ADVANCED 138 help 139 frag matching allows you to match packets based on the fragmentation 140 header of the packet. 141 142 To compile it as a module, choose M here. If unsure, say N. 143 144config IP6_NF_MATCH_OPTS 145 tristate '"hbh" hop-by-hop and "dst" opts header match support' 146 depends on NETFILTER_ADVANCED 147 help 148 This allows one to match packets based on the hop-by-hop 149 and destination options headers of a packet. 150 151 To compile it as a module, choose M here. If unsure, say N. 152 153config IP6_NF_MATCH_HL 154 tristate '"hl" hoplimit match support' 155 depends on NETFILTER_ADVANCED 156 select NETFILTER_XT_MATCH_HL 157 ---help--- 158 This is a backwards-compat option for the user's convenience 159 (e.g. when running oldconfig). It selects 160 CONFIG_NETFILTER_XT_MATCH_HL. 161 162config IP6_NF_MATCH_IPV6HEADER 163 tristate '"ipv6header" IPv6 Extension Headers Match' 164 default m if NETFILTER_ADVANCED=n 165 help 166 This module allows one to match packets based upon 167 the ipv6 extension headers. 168 169 To compile it as a module, choose M here. If unsure, say N. 170 171config IP6_NF_MATCH_MH 172 tristate '"mh" match support' 173 depends on NETFILTER_ADVANCED 174 help 175 This module allows one to match MH packets. 176 177 To compile it as a module, choose M here. If unsure, say N. 178 179config IP6_NF_MATCH_RPFILTER 180 tristate '"rpfilter" reverse path filter match support' 181 depends on NETFILTER_ADVANCED 182 depends on IP6_NF_MANGLE || IP6_NF_RAW 183 ---help--- 184 This option allows you to match packets whose replies would 185 go out via the interface the packet came in. 186 187 To compile it as a module, choose M here. If unsure, say N. 188 The module will be called ip6t_rpfilter. 189 190config IP6_NF_MATCH_RT 191 tristate '"rt" Routing header match support' 192 depends on NETFILTER_ADVANCED 193 help 194 rt matching allows you to match packets based on the routing 195 header of the packet. 196 197 To compile it as a module, choose M here. If unsure, say N. 198 199config IP6_NF_MATCH_SRH 200 tristate '"srh" Segment Routing header match support' 201 depends on NETFILTER_ADVANCED 202 help 203 srh matching allows you to match packets based on the segment 204 routing header of the packet. 205 206 To compile it as a module, choose M here. If unsure, say N. 207 208# The targets 209config IP6_NF_TARGET_HL 210 tristate '"HL" hoplimit target support' 211 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE 212 select NETFILTER_XT_TARGET_HL 213 ---help--- 214 This is a backwards-compatible option for the user's convenience 215 (e.g. when running oldconfig). It selects 216 CONFIG_NETFILTER_XT_TARGET_HL. 217 218config IP6_NF_FILTER 219 tristate "Packet filtering" 220 default m if NETFILTER_ADVANCED=n 221 help 222 Packet filtering defines a table `filter', which has a series of 223 rules for simple packet filtering at local input, forwarding and 224 local output. See the man page for iptables(8). 225 226 To compile it as a module, choose M here. If unsure, say N. 227 228config IP6_NF_TARGET_REJECT 229 tristate "REJECT target support" 230 depends on IP6_NF_FILTER 231 select NF_REJECT_IPV6 232 default m if NETFILTER_ADVANCED=n 233 help 234 The REJECT target allows a filtering rule to specify that an ICMPv6 235 error should be issued in response to an incoming packet, rather 236 than silently being dropped. 237 238 To compile it as a module, choose M here. If unsure, say N. 239 240config IP6_NF_TARGET_SYNPROXY 241 tristate "SYNPROXY target support" 242 depends on NF_CONNTRACK && NETFILTER_ADVANCED 243 select NETFILTER_SYNPROXY 244 select SYN_COOKIES 245 help 246 The SYNPROXY target allows you to intercept TCP connections and 247 establish them using syncookies before they are passed on to the 248 server. This allows to avoid conntrack and server resource usage 249 during SYN-flood attacks. 250 251 To compile it as a module, choose M here. If unsure, say N. 252 253config IP6_NF_MANGLE 254 tristate "Packet mangling" 255 default m if NETFILTER_ADVANCED=n 256 help 257 This option adds a `mangle' table to iptables: see the man page for 258 iptables(8). This table is used for various packet alterations 259 which can effect how the packet is routed. 260 261 To compile it as a module, choose M here. If unsure, say N. 262 263config IP6_NF_RAW 264 tristate 'raw table support (required for TRACE)' 265 help 266 This option adds a `raw' table to ip6tables. This table is the very 267 first in the netfilter framework and hooks in at the PREROUTING 268 and OUTPUT chains. 269 270 If you want to compile it as a module, say M here and read 271 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 272 273# security table for MAC policy 274config IP6_NF_SECURITY 275 tristate "Security table" 276 depends on SECURITY 277 depends on NETFILTER_ADVANCED 278 help 279 This option adds a `security' table to iptables, for use 280 with Mandatory Access Control (MAC) policy. 281 282 If unsure, say N. 283 284config IP6_NF_NAT 285 tristate "ip6tables NAT support" 286 depends on NF_CONNTRACK 287 depends on NETFILTER_ADVANCED 288 select NF_NAT 289 select NETFILTER_XT_NAT 290 help 291 This enables the `nat' table in ip6tables. This allows masquerading, 292 port forwarding and other forms of full Network Address Port 293 Translation. 294 295 To compile it as a module, choose M here. If unsure, say N. 296 297if IP6_NF_NAT 298 299config IP6_NF_TARGET_MASQUERADE 300 tristate "MASQUERADE target support" 301 select NF_NAT_MASQUERADE 302 help 303 Masquerading is a special case of NAT: all outgoing connections are 304 changed to seem to come from a particular interface's address, and 305 if the interface goes down, those connections are lost. This is 306 only useful for dialup accounts with dynamic IP address (ie. your IP 307 address will be different on next dialup). 308 309 To compile it as a module, choose M here. If unsure, say N. 310 311config IP6_NF_TARGET_NPT 312 tristate "NPT (Network Prefix translation) target support" 313 help 314 This option adds the `SNPT' and `DNPT' target, which perform 315 stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296. 316 317 To compile it as a module, choose M here. If unsure, say N. 318 319endif # IP6_NF_NAT 320 321endif # IP6_NF_IPTABLES 322endmenu 323 324config NF_DEFRAG_IPV6 325 tristate 326