net/ipv4/netfilter/Kconfig

   1 #
   2 # IP netfilter configuration
   3 #
   4
   5 menu "IP: Netfilter Configuration"
   6         depends on INET && NETFILTER
   7
   8 config NF_CONNTRACK_IPV4
   9         tristate "IPv4 support for new connection tracking (EXPERIMENTAL)"
  10         depends on EXPERIMENTAL && NF_CONNTRACK
  11         ---help---
  12           Connection tracking keeps a record of what packets have passed
  13           through your machine, in order to figure out how they are related
  14           into connections.
  15
  16           This is IPv4 support on Layer 3 independent connection tracking.
  17           Layer 3 independent connection tracking is experimental scheme
  18           which generalize ip_conntrack to support other layer 3 protocols.
  19
  20           To compile it as a module, choose M here.  If unsure, say N.
  21
  22 # connection tracking, helpers and protocols
  23 config IP_NF_CONNTRACK
  24         tristate "Connection tracking (required for masq/NAT)"
  25         ---help---
  26           Connection tracking keeps a record of what packets have passed
  27           through your machine, in order to figure out how they are related
  28           into connections.
  29
  30           This is required to do Masquerading or other kinds of Network
  31           Address Translation (except for Fast NAT).  It can also be used to
  32           enhance packet filtering (see `Connection state match support'
  33           below).
  34
  35           To compile it as a module, choose M here.  If unsure, say N.
  36
  37 config IP_NF_CT_ACCT
  38         bool "Connection tracking flow accounting"
  39         depends on IP_NF_CONNTRACK
  40         help
  41           If this option is enabled, the connection tracking code will
  42           keep per-flow packet and byte counters.
  43
  44           Those counters can be used for flow-based accounting or the
  45           `connbytes' match.
  46
  47           If unsure, say `N'.
  48
  49 config IP_NF_CONNTRACK_MARK
  50         bool  'Connection mark tracking support'
  51         depends on IP_NF_CONNTRACK
  52         help
  53           This option enables support for connection marks, used by the
  54           `CONNMARK' target and `connmark' match. Similar to the mark value
  55           of packets, but this mark value is kept in the conntrack session
  56           instead of the individual packets.
  57
  58 config IP_NF_CONNTRACK_EVENTS
  59         bool "Connection tracking events (EXPERIMENTAL)"
  60         depends on EXPERIMENTAL && IP_NF_CONNTRACK
  61         help
  62           If this option is enabled, the connection tracking code will
  63           provide a notifier chain that can be used by other kernel code
  64           to get notified about changes in the connection tracking state.
  65
  66           IF unsure, say `N'.
  67
  68 config IP_NF_CONNTRACK_NETLINK
  69         tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
  70         depends on EXPERIMENTAL && IP_NF_CONNTRACK && NETFILTER_NETLINK
  71         depends on IP_NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
  72         depends on IP_NF_NAT=n || IP_NF_NAT
  73         help
  74           This option enables support for a netlink-based userspace interface
  75
  76
  77 config IP_NF_CT_PROTO_SCTP
  78         tristate  'SCTP protocol connection tracking support (EXPERIMENTAL)'
  79         depends on IP_NF_CONNTRACK && EXPERIMENTAL
  80         help
  81           With this option enabled, the connection tracking code will
  82           be able to do state tracking on SCTP connections.
  83
  84           If you want to compile it as a module, say M here and read
  85           <file:Documentation/modules.txt>.  If unsure, say `N'.
  86
  87 config IP_NF_FTP
  88         tristate "FTP protocol support"
  89         depends on IP_NF_CONNTRACK
  90         help
  91           Tracking FTP connections is problematic: special helpers are
  92           required for tracking them, and doing masquerading and other forms
  93           of Network Address Translation on them.
  94
  95           To compile it as a module, choose M here.  If unsure, say Y.
  96
  97 config IP_NF_IRC
  98         tristate "IRC protocol support"
  99         depends on IP_NF_CONNTRACK
 100         ---help---
 101           There is a commonly-used extension to IRC called
 102           Direct Client-to-Client Protocol (DCC).  This enables users to send
 103           files to each other, and also chat to each other without the need
 104           of a server.  DCC Sending is used anywhere you send files over IRC,
 105           and DCC Chat is most commonly used by Eggdrop bots.  If you are
 106           using NAT, this extension will enable you to send files and initiate
 107           chats.  Note that you do NOT need this extension to get files or
 108           have others initiate chats, or everything else in IRC.
 109
 110           To compile it as a module, choose M here.  If unsure, say Y.
 111
 112 config IP_NF_NETBIOS_NS
 113         tristate "NetBIOS name service protocol support (EXPERIMENTAL)"
 114         depends on IP_NF_CONNTRACK && EXPERIMENTAL
 115         help
 116           NetBIOS name service requests are sent as broadcast messages from an
 117           unprivileged port and responded to with unicast messages to the
 118           same port. This make them hard to firewall properly because connection
 119           tracking doesn't deal with broadcasts. This helper tracks locally
 120           originating NetBIOS name service requests and the corresponding
 121           responses. It relies on correct IP address configuration, specifically
 122           netmask and broadcast address. When properly configured, the output
 123           of "ip address show" should look similar to this:
 124
 125           $ ip -4 address show eth0
 126           4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
 127               inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
 128
 129           To compile it as a module, choose M here.  If unsure, say N.
 130
 131 config IP_NF_TFTP
 132         tristate "TFTP protocol support"
 133         depends on IP_NF_CONNTRACK
 134         help
 135           TFTP connection tracking helper, this is required depending
 136           on how restrictive your ruleset is.
 137           If you are using a tftp client behind -j SNAT or -j MASQUERADING
 138           you will need this.
 139
 140           To compile it as a module, choose M here.  If unsure, say Y.
 141
 142 config IP_NF_AMANDA
 143         tristate "Amanda backup protocol support"
 144         depends on IP_NF_CONNTRACK
 145         help
 146           If you are running the Amanda backup package <http://www.amanda.org/>
 147           on this machine or machines that will be MASQUERADED through this
 148           machine, then you may want to enable this feature.  This allows the
 149           connection tracking and natting code to allow the sub-channels that
 150           Amanda requires for communication of the backup data, messages and
 151           index.
 152
 153           To compile it as a module, choose M here.  If unsure, say Y.
 154
 155 config IP_NF_PPTP
 156         tristate  'PPTP protocol support'
 157         depends on IP_NF_CONNTRACK
 158         help
 159           This module adds support for PPTP (Point to Point Tunnelling
 160           Protocol, RFC2637) connection tracking and NAT.
 161
 162           If you are running PPTP sessions over a stateful firewall or NAT
 163           box, you may want to enable this feature.
 164
 165           Please note that not all PPTP modes of operation are supported yet.
 166           For more info, read top of the file
 167           net/ipv4/netfilter/ip_conntrack_pptp.c
 168
 169           If you want to compile it as a module, say M here and read
 170           Documentation/modules.txt.  If unsure, say `N'.
 171
 172 config IP_NF_H323
 173         tristate  'H.323 protocol support'
 174         depends on IP_NF_CONNTRACK
 175         help
 176           H.323 is a VoIP signalling protocol from ITU-T. As one of the most
 177           important VoIP protocols, it is widely used by voice hardware and
 178           software including voice gateways, IP phones, Netmeeting, OpenPhone,
 179           Gnomemeeting, etc.
 180
 181           With this module you can support H.323 on a connection tracking/NAT
 182           firewall.
 183
 184           This module supports RAS, Fast-start, H.245 tunnelling, RTP/RTCP
 185           and T.120 based data and applications including audio, video, FAX,
 186           chat, whiteboard, file transfer, etc. For more information, please
 187           see http://nath323.sourceforge.net/.
 188
 189           If you want to compile it as a module, say 'M' here and read
 190           Documentation/modules.txt.  If unsure, say 'N'.
 191
 192 config IP_NF_QUEUE
 193         tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
 194         help
 195           Netfilter has the ability to queue packets to user space: the
 196           netlink device can be used to access them using this driver.
 197
 198           This option enables the old IPv4-only "ip_queue" implementation
 199           which has been obsoleted by the new "nfnetlink_queue" code (see
 200           CONFIG_NETFILTER_NETLINK_QUEUE).
 201
 202           To compile it as a module, choose M here.  If unsure, say N.
 203
 204 config IP_NF_IPTABLES
 205         tristate "IP tables support (required for filtering/masq/NAT)"
 206         depends on NETFILTER_XTABLES
 207         help
 208           iptables is a general, extensible packet identification framework.
 209           The packet filtering and full NAT (masquerading, port forwarding,
 210           etc) subsystems now use this: say `Y' or `M' here if you want to use
 211           either of those.
 212
 213           To compile it as a module, choose M here.  If unsure, say N.
 214
 215 # The matches.
 216 config IP_NF_MATCH_IPRANGE
 217         tristate "IP range match support"
 218         depends on IP_NF_IPTABLES
 219         help
 220           This option makes possible to match IP addresses against IP address
 221           ranges.
 222
 223           To compile it as a module, choose M here.  If unsure, say N.
 224
 225 config IP_NF_MATCH_TOS
 226         tristate "TOS match support"
 227         depends on IP_NF_IPTABLES
 228         help
 229           TOS matching allows you to match packets based on the Type Of
 230           Service fields of the IP packet.
 231
 232           To compile it as a module, choose M here.  If unsure, say N.
 233
 234 config IP_NF_MATCH_RECENT
 235         tristate "recent match support"
 236         depends on IP_NF_IPTABLES
 237         help
 238           This match is used for creating one or many lists of recently
 239           used addresses and then matching against that/those list(s).
 240
 241           Short options are available by using 'iptables -m recent -h'
 242           Official Website: <http://snowman.net/projects/ipt_recent/>
 243
 244           To compile it as a module, choose M here.  If unsure, say N.
 245
 246 config IP_NF_MATCH_ECN
 247         tristate "ECN match support"
 248         depends on IP_NF_IPTABLES
 249         help
 250           This option adds a `ECN' match, which allows you to match against
 251           the IPv4 and TCP header ECN fields.
 252
 253           To compile it as a module, choose M here.  If unsure, say N.
 254
 255 config IP_NF_MATCH_DSCP
 256         tristate "DSCP match support"
 257         depends on IP_NF_IPTABLES
 258         help
 259           This option adds a `DSCP' match, which allows you to match against
 260           the IPv4 header DSCP field (DSCP codepoint).
 261
 262           The DSCP codepoint can have any value between 0x0 and 0x4f.
 263
 264           To compile it as a module, choose M here.  If unsure, say N.
 265
 266 config IP_NF_MATCH_AH
 267         tristate "AH match support"
 268         depends on IP_NF_IPTABLES
 269         help
 270           This match extension allows you to match a range of SPIs
 271           inside AH header of IPSec packets.
 272
 273           To compile it as a module, choose M here.  If unsure, say N.
 274
 275 config IP_NF_MATCH_TTL
 276         tristate "TTL match support"
 277         depends on IP_NF_IPTABLES
 278         help
 279           This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
 280           to match packets by their TTL value.
 281
 282           To compile it as a module, choose M here.  If unsure, say N.
 283
 284 config IP_NF_MATCH_OWNER
 285         tristate "Owner match support"
 286         depends on IP_NF_IPTABLES
 287         help
 288           Packet owner matching allows you to match locally-generated packets
 289           based on who created them: the user, group, process or session.
 290
 291           To compile it as a module, choose M here.  If unsure, say N.
 292
 293 config IP_NF_MATCH_ADDRTYPE
 294         tristate  'address type match support'
 295         depends on IP_NF_IPTABLES
 296         help
 297           This option allows you to match what routing thinks of an address,
 298           eg. UNICAST, LOCAL, BROADCAST, ...
 299
 300           If you want to compile it as a module, say M here and read
 301           <file:Documentation/modules.txt>.  If unsure, say `N'.
 302
 303 config IP_NF_MATCH_HASHLIMIT
 304         tristate  'hashlimit match support'
 305         depends on IP_NF_IPTABLES
 306         help
 307           This option adds a new iptables `hashlimit' match.
 308
 309           As opposed to `limit', this match dynamically crates a hash table
 310           of limit buckets, based on your selection of source/destination
 311           ip addresses and/or ports.
 312
 313           It enables you to express policies like `10kpps for any given
 314           destination IP' or `500pps from any given source IP'  with a single
 315           IPtables rule.
 316
 317 # `filter', generic and specific targets
 318 config IP_NF_FILTER
 319         tristate "Packet filtering"
 320         depends on IP_NF_IPTABLES
 321         help
 322           Packet filtering defines a table `filter', which has a series of
 323           rules for simple packet filtering at local input, forwarding and
 324           local output.  See the man page for iptables(8).
 325
 326           To compile it as a module, choose M here.  If unsure, say N.
 327
 328 config IP_NF_TARGET_REJECT
 329         tristate "REJECT target support"
 330         depends on IP_NF_FILTER
 331         help
 332           The REJECT target allows a filtering rule to specify that an ICMP
 333           error should be issued in response to an incoming packet, rather
 334           than silently being dropped.
 335
 336           To compile it as a module, choose M here.  If unsure, say N.
 337
 338 config IP_NF_TARGET_LOG
 339         tristate "LOG target support"
 340         depends on IP_NF_IPTABLES
 341         help
 342           This option adds a `LOG' target, which allows you to create rules in
 343           any iptables table which records the packet header to the syslog.
 344
 345           To compile it as a module, choose M here.  If unsure, say N.
 346
 347 config IP_NF_TARGET_ULOG
 348         tristate "ULOG target support (OBSOLETE)"
 349         depends on IP_NF_IPTABLES
 350         ---help---
 351
 352           This option enables the old IPv4-only "ipt_ULOG" implementation
 353           which has been obsoleted by the new "nfnetlink_log" code (see
 354           CONFIG_NETFILTER_NETLINK_LOG).
 355
 356           This option adds a `ULOG' target, which allows you to create rules in
 357           any iptables table. The packet is passed to a userspace logging
 358           daemon using netlink multicast sockets; unlike the LOG target
 359           which can only be viewed through syslog.
 360
 361           The apropriate userspace logging daemon (ulogd) may be obtained from
 362           <http://www.gnumonks.org/projects/ulogd/>
 363
 364           To compile it as a module, choose M here.  If unsure, say N.
 365
 366 config IP_NF_TARGET_TCPMSS
 367         tristate "TCPMSS target support"
 368         depends on IP_NF_IPTABLES
 369         ---help---
 370           This option adds a `TCPMSS' target, which allows you to alter the
 371           MSS value of TCP SYN packets, to control the maximum size for that
 372           connection (usually limiting it to your outgoing interface's MTU
 373           minus 40).
 374
 375           This is used to overcome criminally braindead ISPs or servers which
 376           block ICMP Fragmentation Needed packets.  The symptoms of this
 377           problem are that everything works fine from your Linux
 378           firewall/router, but machines behind it can never exchange large
 379           packets:
 380                 1) Web browsers connect, then hang with no data received.
 381                 2) Small mail works fine, but large emails hang.
 382                 3) ssh works fine, but scp hangs after initial handshaking.
 383
 384           Workaround: activate this option and add a rule to your firewall
 385           configuration like:
 386
 387           iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
 388                          -j TCPMSS --clamp-mss-to-pmtu
 389
 390           To compile it as a module, choose M here.  If unsure, say N.
 391
 392 # NAT + specific targets
 393 config IP_NF_NAT
 394         tristate "Full NAT"
 395         depends on IP_NF_IPTABLES && IP_NF_CONNTRACK
 396         help
 397           The Full NAT option allows masquerading, port forwarding and other
 398           forms of full Network Address Port Translation.  It is controlled by
 399           the `nat' table in iptables: see the man page for iptables(8).
 400
 401           To compile it as a module, choose M here.  If unsure, say N.
 402
 403 config IP_NF_NAT_NEEDED
 404         bool
 405         depends on IP_NF_NAT != n
 406         default y
 407
 408 config IP_NF_TARGET_MASQUERADE
 409         tristate "MASQUERADE target support"
 410         depends on IP_NF_NAT
 411         help
 412           Masquerading is a special case of NAT: all outgoing connections are
 413           changed to seem to come from a particular interface's address, and
 414           if the interface goes down, those connections are lost.  This is
 415           only useful for dialup accounts with dynamic IP address (ie. your IP
 416           address will be different on next dialup).
 417
 418           To compile it as a module, choose M here.  If unsure, say N.
 419
 420 config IP_NF_TARGET_REDIRECT
 421         tristate "REDIRECT target support"
 422         depends on IP_NF_NAT
 423         help
 424           REDIRECT is a special case of NAT: all incoming connections are
 425           mapped onto the incoming interface's address, causing the packets to
 426           come to the local machine instead of passing through.  This is
 427           useful for transparent proxies.
 428
 429           To compile it as a module, choose M here.  If unsure, say N.
 430
 431 config IP_NF_TARGET_NETMAP
 432         tristate "NETMAP target support"
 433         depends on IP_NF_NAT
 434         help
 435           NETMAP is an implementation of static 1:1 NAT mapping of network
 436           addresses. It maps the network address part, while keeping the host
 437           address part intact. It is similar to Fast NAT, except that
 438           Netfilter's connection tracking doesn't work well with Fast NAT.
 439
 440           To compile it as a module, choose M here.  If unsure, say N.
 441
 442 config IP_NF_TARGET_SAME
 443         tristate "SAME target support"
 444         depends on IP_NF_NAT
 445         help
 446           This option adds a `SAME' target, which works like the standard SNAT
 447           target, but attempts to give clients the same IP for all connections.
 448
 449           To compile it as a module, choose M here.  If unsure, say N.
 450
 451 config IP_NF_NAT_SNMP_BASIC
 452         tristate "Basic SNMP-ALG support (EXPERIMENTAL)"
 453         depends on EXPERIMENTAL && IP_NF_NAT
 454         ---help---
 455
 456           This module implements an Application Layer Gateway (ALG) for
 457           SNMP payloads.  In conjunction with NAT, it allows a network
 458           management system to access multiple private networks with
 459           conflicting addresses.  It works by modifying IP addresses
 460           inside SNMP payloads to match IP-layer NAT mapping.
 461
 462           This is the "basic" form of SNMP-ALG, as described in RFC 2962
 463
 464           To compile it as a module, choose M here.  If unsure, say N.
 465
 466 config IP_NF_NAT_IRC
 467         tristate
 468         depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
 469         default IP_NF_NAT if IP_NF_IRC=y
 470         default m if IP_NF_IRC=m
 471
 472 # If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
 473 # or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.  Argh.
 474 config IP_NF_NAT_FTP
 475         tristate
 476         depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
 477         default IP_NF_NAT if IP_NF_FTP=y
 478         default m if IP_NF_FTP=m
 479
 480 config IP_NF_NAT_TFTP
 481         tristate
 482         depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
 483         default IP_NF_NAT if IP_NF_TFTP=y
 484         default m if IP_NF_TFTP=m
 485
 486 config IP_NF_NAT_AMANDA
 487         tristate
 488         depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
 489         default IP_NF_NAT if IP_NF_AMANDA=y
 490         default m if IP_NF_AMANDA=m
 491
 492 config IP_NF_NAT_PPTP
 493         tristate
 494         depends on IP_NF_NAT!=n && IP_NF_PPTP!=n
 495         default IP_NF_NAT if IP_NF_PPTP=y
 496         default m if IP_NF_PPTP=m
 497
 498 config IP_NF_NAT_H323
 499         tristate
 500         depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
 501         default IP_NF_NAT if IP_NF_H323=y
 502         default m if IP_NF_H323=m
 503
 504 # mangle + specific targets
 505 config IP_NF_MANGLE
 506         tristate "Packet mangling"
 507         depends on IP_NF_IPTABLES
 508         help
 509           This option adds a `mangle' table to iptables: see the man page for
 510           iptables(8).  This table is used for various packet alterations
 511           which can effect how the packet is routed.
 512
 513           To compile it as a module, choose M here.  If unsure, say N.
 514
 515 config IP_NF_TARGET_TOS
 516         tristate "TOS target support"
 517         depends on IP_NF_MANGLE
 518         help
 519           This option adds a `TOS' target, which allows you to create rules in
 520           the `mangle' table which alter the Type Of Service field of an IP
 521           packet prior to routing.
 522
 523           To compile it as a module, choose M here.  If unsure, say N.
 524
 525 config IP_NF_TARGET_ECN
 526         tristate "ECN target support"
 527         depends on IP_NF_MANGLE
 528         ---help---
 529           This option adds a `ECN' target, which can be used in the iptables mangle
 530           table.
 531
 532           You can use this target to remove the ECN bits from the IPv4 header of
 533           an IP packet.  This is particularly useful, if you need to work around
 534           existing ECN blackholes on the internet, but don't want to disable
 535           ECN support in general.
 536
 537           To compile it as a module, choose M here.  If unsure, say N.
 538
 539 config IP_NF_TARGET_DSCP
 540         tristate "DSCP target support"
 541         depends on IP_NF_MANGLE
 542         help
 543           This option adds a `DSCP' match, which allows you to match against
 544           the IPv4 header DSCP field (DSCP codepoint).
 545
 546           The DSCP codepoint can have any value between 0x0 and 0x4f.
 547
 548           To compile it as a module, choose M here.  If unsure, say N.
 549
 550 config IP_NF_TARGET_TTL
 551         tristate  'TTL target support'
 552         depends on IP_NF_MANGLE
 553         help
 554           This option adds a `TTL' target, which enables the user to modify
 555           the TTL value of the IP header.
 556
 557           While it is safe to decrement/lower the TTL, this target also enables
 558           functionality to increment and set the TTL value of the IP header to
 559           arbitrary values.  This is EXTREMELY DANGEROUS since you can easily
 560           create immortal packets that loop forever on the network.
 561
 562           To compile it as a module, choose M here.  If unsure, say N.
 563
 564 config IP_NF_TARGET_CLUSTERIP
 565         tristate "CLUSTERIP target support (EXPERIMENTAL)"
 566         depends on IP_NF_MANGLE && EXPERIMENTAL
 567         depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK_IPV4)
 568         help
 569           The CLUSTERIP target allows you to build load-balancing clusters of
 570           network servers without having a dedicated load-balancing
 571           router/server/switch.
 572
 573           To compile it as a module, choose M here.  If unsure, say N.
 574
 575 # raw + specific targets
 576 config IP_NF_RAW
 577         tristate  'raw table support (required for NOTRACK/TRACE)'
 578         depends on IP_NF_IPTABLES
 579         help
 580           This option adds a `raw' table to iptables. This table is the very
 581           first in the netfilter framework and hooks in at the PREROUTING
 582           and OUTPUT chains.
 583
 584           If you want to compile it as a module, say M here and read
 585           <file:Documentation/modules.txt>.  If unsure, say `N'.
 586
 587 # ARP tables
 588 config IP_NF_ARPTABLES
 589         tristate "ARP tables support"
 590         depends on NETFILTER_XTABLES
 591         help
 592           arptables is a general, extensible packet identification framework.
 593           The ARP packet filtering and mangling (manipulation)subsystems
 594           use this: say Y or M here if you want to use either of those.
 595
 596           To compile it as a module, choose M here.  If unsure, say N.
 597
 598 config IP_NF_ARPFILTER
 599         tristate "ARP packet filtering"
 600         depends on IP_NF_ARPTABLES
 601         help
 602           ARP packet filtering defines a table `filter', which has a series of
 603           rules for simple ARP packet filtering at local input and
 604           local output.  On a bridge, you can also specify filtering rules
 605           for forwarded ARP packets. See the man page for arptables(8).
 606
 607           To compile it as a module, choose M here.  If unsure, say N.
 608
 609 config IP_NF_ARP_MANGLE
 610         tristate "ARP payload mangling"
 611         depends on IP_NF_ARPTABLES
 612         help
 613           Allows altering the ARP packet payload: source and destination
 614           hardware and network addresses.
 615
 616 endmenu
 617