1 #
2 # IP netfilter configuration
3 #
5 menu "IP: Netfilter Configuration"
6 depends on INET && NETFILTER
8 config NF_DEFRAG_IPV4
9 tristate
10 default n
12 config NF_CONNTRACK_IPV4
13 tristate "IPv4 connection tracking support (required for NAT)"
14 depends on NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
16 select NF_DEFRAG_IPV4
17 ---help---
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
20 into connections.
22 This is IPv4 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
26 To compile it as a module, choose M here. If unsure, say N.
28 config NF_CONNTRACK_PROC_COMPAT
29 bool "proc/sysctl compatibility with old connection tracking"
30 depends on NF_CONNTRACK_PROCFS && NF_CONNTRACK_IPV4
31 default y
32 help
33 This option enables /proc and sysctl compatibility with the old
34 layer 3 dependent connection tracking. This is needed to keep
35 old programs that have not been adapted to the new names working.
37 If unsure, say Y.
39 config IP_NF_QUEUE
40 tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
41 depends on NETFILTER_ADVANCED
42 help
43 Netfilter has the ability to queue packets to user space: the
44 netlink device can be used to access them using this driver.
46 This option enables the old IPv4-only "ip_queue" implementation
47 which has been obsoleted by the new "nfnetlink_queue" code (see
48 CONFIG_NETFILTER_NETLINK_QUEUE).
50 To compile it as a module, choose M here. If unsure, say N.
52 config IP_NF_IPTABLES
53 tristate "IP tables support (required for filtering/masq/NAT)"
54 default m if NETFILTER_ADVANCED=n
55 select NETFILTER_XTABLES
56 help
57 iptables is a general, extensible packet identification framework.
58 The packet filtering and full NAT (masquerading, port forwarding,
59 etc) subsystems now use this: say `Y' or `M' here if you want to use
60 either of those.
62 To compile it as a module, choose M here. If unsure, say N.
64 if IP_NF_IPTABLES
66 # The matches.
67 config IP_NF_MATCH_AH
68 tristate '"ah" match support'
69 depends on NETFILTER_ADVANCED
70 help
71 This match extension allows you to match a range of SPIs
72 inside AH header of IPSec packets.
74 To compile it as a module, choose M here. If unsure, say N.
76 config IP_NF_MATCH_ECN
77 tristate '"ecn" match support'
78 depends on NETFILTER_ADVANCED
79 select NETFILTER_XT_MATCH_ECN
80 ---help---
81 This is a backwards-compat option for the user's convenience
82 (e.g. when running oldconfig). It selects
83 CONFIG_NETFILTER_XT_MATCH_ECN.
85 config IP_NF_MATCH_RPFILTER
86 tristate '"rpfilter" reverse path filter match support'
87 depends on NETFILTER_ADVANCED
88 ---help---
89 This option allows you to match packets whose replies would
90 go out via the interface the packet came in.
92 To compile it as a module, choose M here. If unsure, say N.
93 The module will be called ipt_rpfilter.
95 config IP_NF_MATCH_TTL
96 tristate '"ttl" match support'
97 depends on NETFILTER_ADVANCED
98 select NETFILTER_XT_MATCH_HL
99 ---help---
100 This is a backwards-compat option for the user's convenience
101 (e.g. when running oldconfig). It selects
102 CONFIG_NETFILTER_XT_MATCH_HL.
104 # `filter', generic and specific targets
105 config IP_NF_FILTER
106 tristate "Packet filtering"
107 default m if NETFILTER_ADVANCED=n
108 help
109 Packet filtering defines a table `filter', which has a series of
110 rules for simple packet filtering at local input, forwarding and
111 local output. See the man page for iptables(8).
113 To compile it as a module, choose M here. If unsure, say N.
115 config IP_NF_TARGET_REJECT
116 tristate "REJECT target support"
117 depends on IP_NF_FILTER
118 default m if NETFILTER_ADVANCED=n
119 help
120 The REJECT target allows a filtering rule to specify that an ICMP
121 error should be issued in response to an incoming packet, rather
122 than silently being dropped.
124 To compile it as a module, choose M here. If unsure, say N.
126 config IP_NF_TARGET_REJECT_SKERR
127 bool "Force socket error when rejecting with icmp*"
128 depends on IP_NF_TARGET_REJECT
129 default n
130 help
131 This option enables turning a "--reject-with icmp*" into a matching
132 socket error also.
133 The REJECT target normally allows sending an ICMP message. But it
134 leaves the local socket unaware of any ingress rejects.
136 If unsure, say N.
138 config IP_NF_TARGET_ULOG
139 tristate "ULOG target support"
140 default m if NETFILTER_ADVANCED=n
141 ---help---
143 This option enables the old IPv4-only "ipt_ULOG" implementation
144 which has been obsoleted by the new "nfnetlink_log" code (see
145 CONFIG_NETFILTER_NETLINK_LOG).
147 This option adds a `ULOG' target, which allows you to create rules in
148 any iptables table. The packet is passed to a userspace logging
149 daemon using netlink multicast sockets; unlike the LOG target
150 which can only be viewed through syslog.
152 The appropriate userspace logging daemon (ulogd) may be obtained from
153 <http://www.netfilter.org/projects/ulogd/index.html>
155 To compile it as a module, choose M here. If unsure, say N.
157 # NAT + specific targets: nf_conntrack
158 config NF_NAT_IPV4
159 tristate "IPv4 NAT"
160 depends on NF_CONNTRACK_IPV4
161 default m if NETFILTER_ADVANCED=n
162 select NF_NAT
163 help
164 The IPv4 NAT option allows masquerading, port forwarding and other
165 forms of full Network Address Port Translation. It is controlled by
166 the `nat' table in iptables: see the man page for iptables(8).
168 To compile it as a module, choose M here. If unsure, say N.
170 if NF_NAT_IPV4
172 config IP_NF_TARGET_MASQUERADE
173 tristate "MASQUERADE target support"
174 default m if NETFILTER_ADVANCED=n
175 help
176 Masquerading is a special case of NAT: all outgoing connections are
177 changed to seem to come from a particular interface's address, and
178 if the interface goes down, those connections are lost. This is
179 only useful for dialup accounts with dynamic IP address (ie. your IP
180 address will be different on next dialup).
182 To compile it as a module, choose M here. If unsure, say N.
184 config IP_NF_TARGET_NETMAP
185 tristate "NETMAP target support"
186 depends on NETFILTER_ADVANCED
187 select NETFILTER_XT_TARGET_NETMAP
188 ---help---
189 This is a backwards-compat option for the user's convenience
190 (e.g. when running oldconfig). It selects
191 CONFIG_NETFILTER_XT_TARGET_NETMAP.
193 config IP_NF_TARGET_REDIRECT
194 tristate "REDIRECT target support"
195 depends on NETFILTER_ADVANCED
196 select NETFILTER_XT_TARGET_REDIRECT
197 ---help---
198 This is a backwards-compat option for the user's convenience
199 (e.g. when running oldconfig). It selects
200 CONFIG_NETFILTER_XT_TARGET_REDIRECT.
202 endif
204 config NF_NAT_SNMP_BASIC
205 tristate "Basic SNMP-ALG support"
206 depends on NF_CONNTRACK_SNMP && NF_NAT_IPV4
207 depends on NETFILTER_ADVANCED
208 default NF_NAT && NF_CONNTRACK_SNMP
209 ---help---
211 This module implements an Application Layer Gateway (ALG) for
212 SNMP payloads. In conjunction with NAT, it allows a network
213 management system to access multiple private networks with
214 conflicting addresses. It works by modifying IP addresses
215 inside SNMP payloads to match IP-layer NAT mapping.
217 This is the "basic" form of SNMP-ALG, as described in RFC 2962
219 To compile it as a module, choose M here. If unsure, say N.
221 # If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
222 # or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
223 # From kconfig-language.txt:
224 #
225 # <expr> '&&' <expr> (6)
226 #
227 # (6) Returns the result of min(/expr/, /expr/).
229 config NF_NAT_PROTO_GRE
230 tristate
231 depends on NF_NAT_IPV4 && NF_CT_PROTO_GRE
233 config NF_NAT_PPTP
234 tristate
235 depends on NF_CONNTRACK && NF_NAT_IPV4
236 default NF_NAT_IPV4 && NF_CONNTRACK_PPTP
237 select NF_NAT_PROTO_GRE
239 config NF_NAT_H323
240 tristate
241 depends on NF_CONNTRACK && NF_NAT_IPV4
242 default NF_NAT_IPV4 && NF_CONNTRACK_H323
244 # mangle + specific targets
245 config IP_NF_MANGLE
246 tristate "Packet mangling"
247 default m if NETFILTER_ADVANCED=n
248 help
249 This option adds a `mangle' table to iptables: see the man page for
250 iptables(8). This table is used for various packet alterations
251 which can effect how the packet is routed.
253 To compile it as a module, choose M here. If unsure, say N.
255 config IP_NF_TARGET_CLUSTERIP
256 tristate "CLUSTERIP target support (EXPERIMENTAL)"
257 depends on IP_NF_MANGLE && EXPERIMENTAL
258 depends on NF_CONNTRACK_IPV4
259 depends on NETFILTER_ADVANCED
260 select NF_CONNTRACK_MARK
261 help
262 The CLUSTERIP target allows you to build load-balancing clusters of
263 network servers without having a dedicated load-balancing
264 router/server/switch.
266 To compile it as a module, choose M here. If unsure, say N.
268 config IP_NF_TARGET_ECN
269 tristate "ECN target support"
270 depends on IP_NF_MANGLE
271 depends on NETFILTER_ADVANCED
272 ---help---
273 This option adds a `ECN' target, which can be used in the iptables mangle
274 table.
276 You can use this target to remove the ECN bits from the IPv4 header of
277 an IP packet. This is particularly useful, if you need to work around
278 existing ECN blackholes on the internet, but don't want to disable
279 ECN support in general.
281 To compile it as a module, choose M here. If unsure, say N.
283 config IP_NF_TARGET_TTL
284 tristate '"TTL" target support'
285 depends on NETFILTER_ADVANCED && IP_NF_MANGLE
286 select NETFILTER_XT_TARGET_HL
287 ---help---
288 This is a backwards-compatible option for the user's convenience
289 (e.g. when running oldconfig). It selects
290 CONFIG_NETFILTER_XT_TARGET_HL.
292 # raw + specific targets
293 config IP_NF_RAW
294 tristate 'raw table support (required for NOTRACK/TRACE)'
295 help
296 This option adds a `raw' table to iptables. This table is the very
297 first in the netfilter framework and hooks in at the PREROUTING
298 and OUTPUT chains.
300 If you want to compile it as a module, say M here and read
301 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
303 # security table for MAC policy
304 config IP_NF_SECURITY
305 tristate "Security table"
306 depends on SECURITY
307 depends on NETFILTER_ADVANCED
308 help
309 This option adds a `security' table to iptables, for use
310 with Mandatory Access Control (MAC) policy.
312 If unsure, say N.
314 endif # IP_NF_IPTABLES
316 # ARP tables
317 config IP_NF_ARPTABLES
318 tristate "ARP tables support"
319 select NETFILTER_XTABLES
320 depends on NETFILTER_ADVANCED
321 help
322 arptables is a general, extensible packet identification framework.
323 The ARP packet filtering and mangling (manipulation)subsystems
324 use this: say Y or M here if you want to use either of those.
326 To compile it as a module, choose M here. If unsure, say N.
328 if IP_NF_ARPTABLES
330 config IP_NF_ARPFILTER
331 tristate "ARP packet filtering"
332 help
333 ARP packet filtering defines a table `filter', which has a series of
334 rules for simple ARP packet filtering at local input and
335 local output. On a bridge, you can also specify filtering rules
336 for forwarded ARP packets. See the man page for arptables(8).
338 To compile it as a module, choose M here. If unsure, say N.
340 config IP_NF_ARP_MANGLE
341 tristate "ARP payload mangling"
342 help
343 Allows altering the ARP packet payload: source and destination
344 hardware and network addresses.
346 endif # IP_NF_ARPTABLES
348 endmenu