2 # IP netfilter configuration
5 menu "IPv6: Netfilter Configuration (EXPERIMENTAL)"
6 depends on INET && IPV6 && NETFILTER && EXPERIMENTAL
8 config NF_CONNTRACK_IPV6
9 tristate "IPv6 connection tracking support (EXPERIMENTAL)"
10 depends on INET && IPV6 && EXPERIMENTAL && NF_CONNTRACK
12 Connection tracking keeps a record of what packets have passed
13 through your machine, in order to figure out how they are related
16 This is IPv6 support on Layer 3 independent connection tracking.
17 Layer 3 independent connection tracking is experimental scheme
18 which generalize ip_conntrack to support other layer 3 protocols.
20 To compile it as a module, choose M here. If unsure, say N.
23 tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
24 depends on INET && IPV6 && NETFILTER && EXPERIMENTAL
27 This option adds a queue handler to the kernel for IPv6
28 packets which enables users to receive the filtered packets
29 with QUEUE target using libipq.
31 THis option enables the old IPv6-only "ip6_queue" implementation
32 which has been obsoleted by the new "nfnetlink_queue" code (see
33 CONFIG_NETFILTER_NETLINK_QUEUE).
35 (C) Fernando Anton 2001
36 IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
37 Universidad Carlos III de Madrid
38 Universidad Politecnica de Alcala de Henares
39 email: <fanton@it.uc3m.es>.
41 To compile it as a module, choose M here. If unsure, say N.
43 config IP6_NF_IPTABLES
44 tristate "IP6 tables support (required for filtering)"
45 depends on INET && IPV6 && EXPERIMENTAL && NETFILTER_XTABLES
47 ip6tables is a general, extensible packet identification framework.
48 Currently only the packet filtering and packet mangling subsystem
49 for IPv6 use this, but connection tracking is going to follow.
50 Say 'Y' or 'M' here if you want to use either of those.
52 To compile it as a module, choose M here. If unsure, say N.
55 config IP6_NF_MATCH_RT
56 tristate "Routing header match support"
57 depends on IP6_NF_IPTABLES
59 rt matching allows you to match packets based on the routing
62 To compile it as a module, choose M here. If unsure, say N.
64 config IP6_NF_MATCH_OPTS
65 tristate "Hop-by-hop and Dst opts header match support"
66 depends on IP6_NF_IPTABLES
68 This allows one to match packets based on the hop-by-hop
69 and destination options headers of a packet.
71 To compile it as a module, choose M here. If unsure, say N.
73 config IP6_NF_MATCH_FRAG
74 tristate "Fragmentation header match support"
75 depends on IP6_NF_IPTABLES
77 frag matching allows you to match packets based on the fragmentation
80 To compile it as a module, choose M here. If unsure, say N.
82 config IP6_NF_MATCH_HL
83 tristate "HL match support"
84 depends on IP6_NF_IPTABLES
86 HL matching allows you to match packets based on the hop
89 To compile it as a module, choose M here. If unsure, say N.
91 config IP6_NF_MATCH_OWNER
92 tristate "Owner match support"
93 depends on IP6_NF_IPTABLES
95 Packet owner matching allows you to match locally-generated packets
96 based on who created them: the user, group, process or session.
98 To compile it as a module, choose M here. If unsure, say N.
100 config IP6_NF_MATCH_IPV6HEADER
101 tristate "IPv6 Extension Headers Match"
102 depends on IP6_NF_IPTABLES
104 This module allows one to match packets based upon
105 the ipv6 extension headers.
107 To compile it as a module, choose M here. If unsure, say N.
109 config IP6_NF_MATCH_AH
110 tristate "AH match support"
111 depends on IP6_NF_IPTABLES
113 This module allows one to match AH packets.
115 To compile it as a module, choose M here. If unsure, say N.
117 config IP6_NF_MATCH_MH
118 tristate "MH match support"
119 depends on IP6_NF_IPTABLES
121 This module allows one to match MH packets.
123 To compile it as a module, choose M here. If unsure, say N.
125 config IP6_NF_MATCH_EUI64
126 tristate "EUI64 address check"
127 depends on IP6_NF_IPTABLES
129 This module performs checking on the IPv6 source address
130 Compares the last 64 bits with the EUI64 (delivered
131 from the MAC address) address
133 To compile it as a module, choose M here. If unsure, say N.
137 tristate "Packet filtering"
138 depends on IP6_NF_IPTABLES
140 Packet filtering defines a table `filter', which has a series of
141 rules for simple packet filtering at local input, forwarding and
142 local output. See the man page for iptables(8).
144 To compile it as a module, choose M here. If unsure, say N.
146 config IP6_NF_TARGET_LOG
147 tristate "LOG target support"
148 depends on IP6_NF_FILTER
150 This option adds a `LOG' target, which allows you to create rules in
151 any iptables table which records the packet header to the syslog.
153 To compile it as a module, choose M here. If unsure, say N.
155 config IP6_NF_TARGET_REJECT
156 tristate "REJECT target support"
157 depends on IP6_NF_FILTER
159 The REJECT target allows a filtering rule to specify that an ICMPv6
160 error should be issued in response to an incoming packet, rather
161 than silently being dropped.
163 To compile it as a module, choose M here. If unsure, say N.
166 tristate "Packet mangling"
167 depends on IP6_NF_IPTABLES
169 This option adds a `mangle' table to iptables: see the man page for
170 iptables(8). This table is used for various packet alterations
171 which can effect how the packet is routed.
173 To compile it as a module, choose M here. If unsure, say N.
175 config IP6_NF_TARGET_HL
176 tristate 'HL (hoplimit) target support'
177 depends on IP6_NF_MANGLE
179 This option adds a `HL' target, which enables the user to decrement
180 the hoplimit value of the IPv6 header or set it to a given (lower)
183 While it is safe to decrement the hoplimit value, this option also
184 enables functionality to increment and set the hoplimit value of the
185 IPv6 header to arbitrary values. This is EXTREMELY DANGEROUS since
186 you can easily create immortal packets that loop forever on the
189 To compile it as a module, choose M here. If unsure, say N.
192 tristate 'raw table support (required for TRACE)'
193 depends on IP6_NF_IPTABLES
195 This option adds a `raw' table to ip6tables. This table is the very
196 first in the netfilter framework and hooks in at the PREROUTING
199 If you want to compile it as a module, say M here and read
200 <file:Documentation/modules.txt>. If unsure, say `N'.