2 # IP netfilter configuration
5 menu "IP: Netfilter Configuration"
6 depends on INET && NETFILTER
12 config NF_CONNTRACK_IPV4
13 tristate "IPv4 connection tracking support (required for NAT)"
14 depends on NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
22 This is IPv4 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
26 To compile it as a module, choose M here. If unsure, say N.
31 tristate "IPv4 nf_tables support"
33 This option enables the IPv4 support for nf_tables.
37 config NFT_CHAIN_ROUTE_IPV4
38 tristate "IPv4 nf_tables route chain support"
40 This option enables the "route" chain for IPv4 in nf_tables. This
41 chain type is used to force packet re-routing after mangling header
42 fields such as the source, destination, type of service and
45 config NFT_REJECT_IPV4
51 tristate "IPv4 nf_tables packet duplication support"
52 depends on !NF_CONNTRACK || NF_CONNTRACK
55 This module enables IPv4 packet duplication support for nf_tables.
59 tristate "nf_tables fib / ip route lookup support"
61 This module enables IPv4 FIB lookups, e.g. for reverse path filtering.
62 It also allows query of the FIB for the route type, e.g. local, unicast,
63 multicast or blackhole.
65 endif # NF_TABLES_IPV4
68 tristate "ARP nf_tables support"
70 This option enables the ARP support for nf_tables.
75 tristate "Netfilter IPv4 packet duplication to alternate destination"
76 depends on !NF_CONNTRACK || NF_CONNTRACK
78 This option enables the nf_dup_ipv4 core, which duplicates an IPv4
79 packet to be rerouted to another destination.
82 tristate "ARP packet logging"
83 default m if NETFILTER_ADVANCED=n
87 tristate "IPv4 packet logging"
88 default m if NETFILTER_ADVANCED=n
92 tristate "IPv4 packet rejection"
93 default m if NETFILTER_ADVANCED=n
97 depends on NF_CONNTRACK_IPV4
98 default m if NETFILTER_ADVANCED=n
101 The IPv4 NAT option allows masquerading, port forwarding and other
102 forms of full Network Address Port Translation. This can be
103 controlled by iptables or nft.
107 config NFT_CHAIN_NAT_IPV4
108 depends on NF_TABLES_IPV4
109 tristate "IPv4 nf_tables nat chain support"
111 This option enables the "nat" chain for IPv4 in nf_tables. This
112 chain type is used to perform Network Address Translation (NAT)
113 packet transformations such as the source, destination address and
114 source and destination ports.
116 config NF_NAT_MASQUERADE_IPV4
117 tristate "IPv4 masquerade support"
119 This is the kernel functionality to provide NAT in the masquerade
120 flavour (automatic source address selection).
123 tristate "IPv4 masquerading support for nf_tables"
124 depends on NF_TABLES_IPV4
126 select NF_NAT_MASQUERADE_IPV4
128 This is the expression that provides IPv4 masquerading support for
131 config NFT_REDIR_IPV4
132 tristate "IPv4 redirect support for nf_tables"
133 depends on NF_TABLES_IPV4
135 select NF_NAT_REDIRECT
137 This is the expression that provides IPv4 redirect support for
140 config NF_NAT_SNMP_BASIC
141 tristate "Basic SNMP-ALG support"
142 depends on NF_CONNTRACK_SNMP
143 depends on NETFILTER_ADVANCED
144 default NF_NAT && NF_CONNTRACK_SNMP
147 This module implements an Application Layer Gateway (ALG) for
148 SNMP payloads. In conjunction with NAT, it allows a network
149 management system to access multiple private networks with
150 conflicting addresses. It works by modifying IP addresses
151 inside SNMP payloads to match IP-layer NAT mapping.
153 This is the "basic" form of SNMP-ALG, as described in RFC 2962
155 To compile it as a module, choose M here. If unsure, say N.
157 config NF_NAT_PROTO_GRE
159 depends on NF_CT_PROTO_GRE
163 depends on NF_CONNTRACK
164 default NF_CONNTRACK_PPTP
165 select NF_NAT_PROTO_GRE
169 depends on NF_CONNTRACK
170 default NF_CONNTRACK_H323
174 config IP_NF_IPTABLES
175 tristate "IP tables support (required for filtering/masq/NAT)"
176 default m if NETFILTER_ADVANCED=n
177 select NETFILTER_XTABLES
179 iptables is a general, extensible packet identification framework.
180 The packet filtering and full NAT (masquerading, port forwarding,
181 etc) subsystems now use this: say `Y' or `M' here if you want to use
184 To compile it as a module, choose M here. If unsure, say N.
189 config IP_NF_MATCH_AH
190 tristate '"ah" match support'
191 depends on NETFILTER_ADVANCED
193 This match extension allows you to match a range of SPIs
194 inside AH header of IPSec packets.
196 To compile it as a module, choose M here. If unsure, say N.
198 config IP_NF_MATCH_ECN
199 tristate '"ecn" match support'
200 depends on NETFILTER_ADVANCED
201 select NETFILTER_XT_MATCH_ECN
203 This is a backwards-compat option for the user's convenience
204 (e.g. when running oldconfig). It selects
205 CONFIG_NETFILTER_XT_MATCH_ECN.
207 config IP_NF_MATCH_RPFILTER
208 tristate '"rpfilter" reverse path filter match support'
209 depends on NETFILTER_ADVANCED
210 depends on IP_NF_MANGLE || IP_NF_RAW
212 This option allows you to match packets whose replies would
213 go out via the interface the packet came in.
215 To compile it as a module, choose M here. If unsure, say N.
216 The module will be called ipt_rpfilter.
218 config IP_NF_MATCH_TTL
219 tristate '"ttl" match support'
220 depends on NETFILTER_ADVANCED
221 select NETFILTER_XT_MATCH_HL
223 This is a backwards-compat option for the user's convenience
224 (e.g. when running oldconfig). It selects
225 CONFIG_NETFILTER_XT_MATCH_HL.
227 # `filter', generic and specific targets
229 tristate "Packet filtering"
230 default m if NETFILTER_ADVANCED=n
232 Packet filtering defines a table `filter', which has a series of
233 rules for simple packet filtering at local input, forwarding and
234 local output. See the man page for iptables(8).
236 To compile it as a module, choose M here. If unsure, say N.
238 config IP_NF_TARGET_REJECT
239 tristate "REJECT target support"
240 depends on IP_NF_FILTER
241 select NF_REJECT_IPV4
242 default m if NETFILTER_ADVANCED=n
244 The REJECT target allows a filtering rule to specify that an ICMP
245 error should be issued in response to an incoming packet, rather
246 than silently being dropped.
248 To compile it as a module, choose M here. If unsure, say N.
250 config IP_NF_TARGET_SYNPROXY
251 tristate "SYNPROXY target support"
252 depends on NF_CONNTRACK && NETFILTER_ADVANCED
253 select NETFILTER_SYNPROXY
256 The SYNPROXY target allows you to intercept TCP connections and
257 establish them using syncookies before they are passed on to the
258 server. This allows to avoid conntrack and server resource usage
259 during SYN-flood attacks.
261 To compile it as a module, choose M here. If unsure, say N.
263 # NAT + specific targets: nf_conntrack
265 tristate "iptables NAT support"
266 depends on NF_CONNTRACK_IPV4
267 default m if NETFILTER_ADVANCED=n
270 select NETFILTER_XT_NAT
272 This enables the `nat' table in iptables. This allows masquerading,
273 port forwarding and other forms of full Network Address Port
276 To compile it as a module, choose M here. If unsure, say N.
280 config IP_NF_TARGET_MASQUERADE
281 tristate "MASQUERADE target support"
282 select NF_NAT_MASQUERADE_IPV4
283 default m if NETFILTER_ADVANCED=n
285 Masquerading is a special case of NAT: all outgoing connections are
286 changed to seem to come from a particular interface's address, and
287 if the interface goes down, those connections are lost. This is
288 only useful for dialup accounts with dynamic IP address (ie. your IP
289 address will be different on next dialup).
291 To compile it as a module, choose M here. If unsure, say N.
293 config IP_NF_TARGET_NETMAP
294 tristate "NETMAP target support"
295 depends on NETFILTER_ADVANCED
296 select NETFILTER_XT_TARGET_NETMAP
298 This is a backwards-compat option for the user's convenience
299 (e.g. when running oldconfig). It selects
300 CONFIG_NETFILTER_XT_TARGET_NETMAP.
302 config IP_NF_TARGET_REDIRECT
303 tristate "REDIRECT target support"
304 depends on NETFILTER_ADVANCED
305 select NETFILTER_XT_TARGET_REDIRECT
307 This is a backwards-compat option for the user's convenience
308 (e.g. when running oldconfig). It selects
309 CONFIG_NETFILTER_XT_TARGET_REDIRECT.
313 # mangle + specific targets
315 tristate "Packet mangling"
316 default m if NETFILTER_ADVANCED=n
318 This option adds a `mangle' table to iptables: see the man page for
319 iptables(8). This table is used for various packet alterations
320 which can effect how the packet is routed.
322 To compile it as a module, choose M here. If unsure, say N.
324 config IP_NF_TARGET_CLUSTERIP
325 tristate "CLUSTERIP target support"
326 depends on IP_NF_MANGLE
327 depends on NF_CONNTRACK_IPV4
328 depends on NETFILTER_ADVANCED
329 select NF_CONNTRACK_MARK
331 The CLUSTERIP target allows you to build load-balancing clusters of
332 network servers without having a dedicated load-balancing
333 router/server/switch.
335 To compile it as a module, choose M here. If unsure, say N.
337 config IP_NF_TARGET_ECN
338 tristate "ECN target support"
339 depends on IP_NF_MANGLE
340 depends on NETFILTER_ADVANCED
342 This option adds a `ECN' target, which can be used in the iptables mangle
345 You can use this target to remove the ECN bits from the IPv4 header of
346 an IP packet. This is particularly useful, if you need to work around
347 existing ECN blackholes on the internet, but don't want to disable
348 ECN support in general.
350 To compile it as a module, choose M here. If unsure, say N.
352 config IP_NF_TARGET_TTL
353 tristate '"TTL" target support'
354 depends on NETFILTER_ADVANCED && IP_NF_MANGLE
355 select NETFILTER_XT_TARGET_HL
357 This is a backwards-compatible option for the user's convenience
358 (e.g. when running oldconfig). It selects
359 CONFIG_NETFILTER_XT_TARGET_HL.
361 # raw + specific targets
363 tristate 'raw table support (required for NOTRACK/TRACE)'
365 This option adds a `raw' table to iptables. This table is the very
366 first in the netfilter framework and hooks in at the PREROUTING
369 If you want to compile it as a module, say M here and read
370 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
372 # security table for MAC policy
373 config IP_NF_SECURITY
374 tristate "Security table"
376 depends on NETFILTER_ADVANCED
378 This option adds a `security' table to iptables, for use
379 with Mandatory Access Control (MAC) policy.
383 endif # IP_NF_IPTABLES
386 config IP_NF_ARPTABLES
387 tristate "ARP tables support"
388 select NETFILTER_XTABLES
389 depends on NETFILTER_ADVANCED
391 arptables is a general, extensible packet identification framework.
392 The ARP packet filtering and mangling (manipulation)subsystems
393 use this: say Y or M here if you want to use either of those.
395 To compile it as a module, choose M here. If unsure, say N.
399 config IP_NF_ARPFILTER
400 tristate "ARP packet filtering"
402 ARP packet filtering defines a table `filter', which has a series of
403 rules for simple ARP packet filtering at local input and
404 local output. On a bridge, you can also specify filtering rules
405 for forwarded ARP packets. See the man page for arptables(8).
407 To compile it as a module, choose M here. If unsure, say N.
409 config IP_NF_ARP_MANGLE
410 tristate "ARP payload mangling"
412 Allows altering the ARP packet payload: source and destination
413 hardware and network addresses.
415 endif # IP_NF_ARPTABLES