2 # IP netfilter configuration
5 menu "IP: Netfilter Configuration"
6 depends on INET && NETFILTER
12 config NF_CONNTRACK_IPV4
13 tristate "IPv4 connection tracking support (required for NAT)"
14 depends on NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
22 This is IPv4 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
26 To compile it as a module, choose M here. If unsure, say N.
31 tristate "IPv4 nf_tables support"
33 This option enables the IPv4 support for nf_tables.
37 config NFT_CHAIN_ROUTE_IPV4
38 tristate "IPv4 nf_tables route chain support"
40 This option enables the "route" chain for IPv4 in nf_tables. This
41 chain type is used to force packet re-routing after mangling header
42 fields such as the source, destination, type of service and
45 config NFT_REJECT_IPV4
51 tristate "IPv4 nf_tables packet duplication support"
52 depends on !NF_CONNTRACK || NF_CONNTRACK
55 This module enables IPv4 packet duplication support for nf_tables.
57 endif # NF_TABLES_IPV4
60 tristate "ARP nf_tables support"
62 This option enables the ARP support for nf_tables.
67 tristate "Netfilter IPv4 packet duplication to alternate destination"
68 depends on !NF_CONNTRACK || NF_CONNTRACK
70 This option enables the nf_dup_ipv4 core, which duplicates an IPv4
71 packet to be rerouted to another destination.
74 tristate "ARP packet logging"
75 default m if NETFILTER_ADVANCED=n
79 tristate "IPv4 packet logging"
80 default m if NETFILTER_ADVANCED=n
84 tristate "IPv4 packet rejection"
85 default m if NETFILTER_ADVANCED=n
89 depends on NF_CONNTRACK_IPV4
90 default m if NETFILTER_ADVANCED=n
93 The IPv4 NAT option allows masquerading, port forwarding and other
94 forms of full Network Address Port Translation. This can be
95 controlled by iptables or nft.
99 config NFT_CHAIN_NAT_IPV4
100 depends on NF_TABLES_IPV4
101 tristate "IPv4 nf_tables nat chain support"
103 This option enables the "nat" chain for IPv4 in nf_tables. This
104 chain type is used to perform Network Address Translation (NAT)
105 packet transformations such as the source, destination address and
106 source and destination ports.
108 config NF_NAT_MASQUERADE_IPV4
109 tristate "IPv4 masquerade support"
111 This is the kernel functionality to provide NAT in the masquerade
112 flavour (automatic source address selection).
115 tristate "IPv4 masquerading support for nf_tables"
116 depends on NF_TABLES_IPV4
118 select NF_NAT_MASQUERADE_IPV4
120 This is the expression that provides IPv4 masquerading support for
123 config NFT_REDIR_IPV4
124 tristate "IPv4 redirect support for nf_tables"
125 depends on NF_TABLES_IPV4
127 select NF_NAT_REDIRECT
129 This is the expression that provides IPv4 redirect support for
132 config NF_NAT_SNMP_BASIC
133 tristate "Basic SNMP-ALG support"
134 depends on NF_CONNTRACK_SNMP
135 depends on NETFILTER_ADVANCED
136 default NF_NAT && NF_CONNTRACK_SNMP
139 This module implements an Application Layer Gateway (ALG) for
140 SNMP payloads. In conjunction with NAT, it allows a network
141 management system to access multiple private networks with
142 conflicting addresses. It works by modifying IP addresses
143 inside SNMP payloads to match IP-layer NAT mapping.
145 This is the "basic" form of SNMP-ALG, as described in RFC 2962
147 To compile it as a module, choose M here. If unsure, say N.
149 config NF_NAT_PROTO_GRE
151 depends on NF_CT_PROTO_GRE
155 depends on NF_CONNTRACK
156 default NF_CONNTRACK_PPTP
157 select NF_NAT_PROTO_GRE
161 depends on NF_CONNTRACK
162 default NF_CONNTRACK_H323
166 config IP_NF_IPTABLES
167 tristate "IP tables support (required for filtering/masq/NAT)"
168 default m if NETFILTER_ADVANCED=n
169 select NETFILTER_XTABLES
171 iptables is a general, extensible packet identification framework.
172 The packet filtering and full NAT (masquerading, port forwarding,
173 etc) subsystems now use this: say `Y' or `M' here if you want to use
176 To compile it as a module, choose M here. If unsure, say N.
181 config IP_NF_MATCH_AH
182 tristate '"ah" match support'
183 depends on NETFILTER_ADVANCED
185 This match extension allows you to match a range of SPIs
186 inside AH header of IPSec packets.
188 To compile it as a module, choose M here. If unsure, say N.
190 config IP_NF_MATCH_ECN
191 tristate '"ecn" match support'
192 depends on NETFILTER_ADVANCED
193 select NETFILTER_XT_MATCH_ECN
195 This is a backwards-compat option for the user's convenience
196 (e.g. when running oldconfig). It selects
197 CONFIG_NETFILTER_XT_MATCH_ECN.
199 config IP_NF_MATCH_RPFILTER
200 tristate '"rpfilter" reverse path filter match support'
201 depends on NETFILTER_ADVANCED
202 depends on IP_NF_MANGLE || IP_NF_RAW
204 This option allows you to match packets whose replies would
205 go out via the interface the packet came in.
207 To compile it as a module, choose M here. If unsure, say N.
208 The module will be called ipt_rpfilter.
210 config IP_NF_MATCH_TTL
211 tristate '"ttl" match support'
212 depends on NETFILTER_ADVANCED
213 select NETFILTER_XT_MATCH_HL
215 This is a backwards-compat option for the user's convenience
216 (e.g. when running oldconfig). It selects
217 CONFIG_NETFILTER_XT_MATCH_HL.
219 # `filter', generic and specific targets
221 tristate "Packet filtering"
222 default m if NETFILTER_ADVANCED=n
224 Packet filtering defines a table `filter', which has a series of
225 rules for simple packet filtering at local input, forwarding and
226 local output. See the man page for iptables(8).
228 To compile it as a module, choose M here. If unsure, say N.
230 config IP_NF_TARGET_REJECT
231 tristate "REJECT target support"
232 depends on IP_NF_FILTER
233 select NF_REJECT_IPV4
234 default m if NETFILTER_ADVANCED=n
236 The REJECT target allows a filtering rule to specify that an ICMP
237 error should be issued in response to an incoming packet, rather
238 than silently being dropped.
240 To compile it as a module, choose M here. If unsure, say N.
242 config IP_NF_TARGET_SYNPROXY
243 tristate "SYNPROXY target support"
244 depends on NF_CONNTRACK && NETFILTER_ADVANCED
245 select NETFILTER_SYNPROXY
248 The SYNPROXY target allows you to intercept TCP connections and
249 establish them using syncookies before they are passed on to the
250 server. This allows to avoid conntrack and server resource usage
251 during SYN-flood attacks.
253 To compile it as a module, choose M here. If unsure, say N.
255 # NAT + specific targets: nf_conntrack
257 tristate "iptables NAT support"
258 depends on NF_CONNTRACK_IPV4
259 default m if NETFILTER_ADVANCED=n
262 select NETFILTER_XT_NAT
264 This enables the `nat' table in iptables. This allows masquerading,
265 port forwarding and other forms of full Network Address Port
268 To compile it as a module, choose M here. If unsure, say N.
272 config IP_NF_TARGET_MASQUERADE
273 tristate "MASQUERADE target support"
274 select NF_NAT_MASQUERADE_IPV4
275 default m if NETFILTER_ADVANCED=n
277 Masquerading is a special case of NAT: all outgoing connections are
278 changed to seem to come from a particular interface's address, and
279 if the interface goes down, those connections are lost. This is
280 only useful for dialup accounts with dynamic IP address (ie. your IP
281 address will be different on next dialup).
283 To compile it as a module, choose M here. If unsure, say N.
285 config IP_NF_TARGET_NETMAP
286 tristate "NETMAP target support"
287 depends on NETFILTER_ADVANCED
288 select NETFILTER_XT_TARGET_NETMAP
290 This is a backwards-compat option for the user's convenience
291 (e.g. when running oldconfig). It selects
292 CONFIG_NETFILTER_XT_TARGET_NETMAP.
294 config IP_NF_TARGET_REDIRECT
295 tristate "REDIRECT target support"
296 depends on NETFILTER_ADVANCED
297 select NETFILTER_XT_TARGET_REDIRECT
299 This is a backwards-compat option for the user's convenience
300 (e.g. when running oldconfig). It selects
301 CONFIG_NETFILTER_XT_TARGET_REDIRECT.
305 # mangle + specific targets
307 tristate "Packet mangling"
308 default m if NETFILTER_ADVANCED=n
310 This option adds a `mangle' table to iptables: see the man page for
311 iptables(8). This table is used for various packet alterations
312 which can effect how the packet is routed.
314 To compile it as a module, choose M here. If unsure, say N.
316 config IP_NF_TARGET_CLUSTERIP
317 tristate "CLUSTERIP target support"
318 depends on IP_NF_MANGLE
319 depends on NF_CONNTRACK_IPV4
320 depends on NETFILTER_ADVANCED
321 select NF_CONNTRACK_MARK
323 The CLUSTERIP target allows you to build load-balancing clusters of
324 network servers without having a dedicated load-balancing
325 router/server/switch.
327 To compile it as a module, choose M here. If unsure, say N.
329 config IP_NF_TARGET_ECN
330 tristate "ECN target support"
331 depends on IP_NF_MANGLE
332 depends on NETFILTER_ADVANCED
334 This option adds a `ECN' target, which can be used in the iptables mangle
337 You can use this target to remove the ECN bits from the IPv4 header of
338 an IP packet. This is particularly useful, if you need to work around
339 existing ECN blackholes on the internet, but don't want to disable
340 ECN support in general.
342 To compile it as a module, choose M here. If unsure, say N.
344 config IP_NF_TARGET_TTL
345 tristate '"TTL" target support'
346 depends on NETFILTER_ADVANCED && IP_NF_MANGLE
347 select NETFILTER_XT_TARGET_HL
349 This is a backwards-compatible option for the user's convenience
350 (e.g. when running oldconfig). It selects
351 CONFIG_NETFILTER_XT_TARGET_HL.
353 # raw + specific targets
355 tristate 'raw table support (required for NOTRACK/TRACE)'
357 This option adds a `raw' table to iptables. This table is the very
358 first in the netfilter framework and hooks in at the PREROUTING
361 If you want to compile it as a module, say M here and read
362 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
364 # security table for MAC policy
365 config IP_NF_SECURITY
366 tristate "Security table"
368 depends on NETFILTER_ADVANCED
370 This option adds a `security' table to iptables, for use
371 with Mandatory Access Control (MAC) policy.
375 endif # IP_NF_IPTABLES
378 config IP_NF_ARPTABLES
379 tristate "ARP tables support"
380 select NETFILTER_XTABLES
381 depends on NETFILTER_ADVANCED
383 arptables is a general, extensible packet identification framework.
384 The ARP packet filtering and mangling (manipulation)subsystems
385 use this: say Y or M here if you want to use either of those.
387 To compile it as a module, choose M here. If unsure, say N.
391 config IP_NF_ARPFILTER
392 tristate "ARP packet filtering"
394 ARP packet filtering defines a table `filter', which has a series of
395 rules for simple ARP packet filtering at local input and
396 local output. On a bridge, you can also specify filtering rules
397 for forwarded ARP packets. See the man page for arptables(8).
399 To compile it as a module, choose M here. If unsure, say N.
401 config IP_NF_ARP_MANGLE
402 tristate "ARP payload mangling"
404 Allows altering the ARP packet payload: source and destination
405 hardware and network addresses.
407 endif # IP_NF_ARPTABLES