2 # IP netfilter configuration
5 menu "IP: Netfilter Configuration"
6 depends on INET && NETFILTER
12 config NF_CONNTRACK_IPV4
13 tristate "IPv4 connection tracking support (required for NAT)"
14 depends on NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
22 This is IPv4 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
26 To compile it as a module, choose M here. If unsure, say N.
28 config NF_CONNTRACK_PROC_COMPAT
29 bool "proc/sysctl compatibility with old connection tracking"
30 depends on NF_CONNTRACK_IPV4
33 This option enables /proc and sysctl compatibility with the old
34 layer 3 dependent connection tracking. This is needed to keep
35 old programs that have not been adapted to the new names working.
40 tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
41 depends on NETFILTER_ADVANCED
43 Netfilter has the ability to queue packets to user space: the
44 netlink device can be used to access them using this driver.
46 This option enables the old IPv4-only "ip_queue" implementation
47 which has been obsoleted by the new "nfnetlink_queue" code (see
48 CONFIG_NETFILTER_NETLINK_QUEUE).
50 To compile it as a module, choose M here. If unsure, say N.
53 tristate "IP tables support (required for filtering/masq/NAT)"
54 default m if NETFILTER_ADVANCED=n
55 select NETFILTER_XTABLES
57 iptables is a general, extensible packet identification framework.
58 The packet filtering and full NAT (masquerading, port forwarding,
59 etc) subsystems now use this: say `Y' or `M' here if you want to use
62 To compile it as a module, choose M here. If unsure, say N.
67 config IP_NF_MATCH_ADDRTYPE
68 tristate '"addrtype" address type match support'
69 depends on NETFILTER_ADVANCED
71 This option allows you to match what routing thinks of an address,
72 eg. UNICAST, LOCAL, BROADCAST, ...
74 If you want to compile it as a module, say M here and read
75 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
78 tristate '"ah" match support'
79 depends on NETFILTER_ADVANCED
81 This match extension allows you to match a range of SPIs
82 inside AH header of IPSec packets.
84 To compile it as a module, choose M here. If unsure, say N.
86 config IP_NF_MATCH_ECN
87 tristate '"ecn" match support'
88 depends on NETFILTER_ADVANCED
90 This option adds a `ECN' match, which allows you to match against
91 the IPv4 and TCP header ECN fields.
93 To compile it as a module, choose M here. If unsure, say N.
95 config IP_NF_MATCH_TTL
96 tristate '"ttl" match support'
97 depends on NETFILTER_ADVANCED
98 select NETFILTER_XT_MATCH_HL
100 This is a backwards-compat option for the user's convenience
101 (e.g. when running oldconfig). It selects
102 CONFIG_NETFILTER_XT_MATCH_HL.
104 # `filter', generic and specific targets
106 tristate "Packet filtering"
107 default m if NETFILTER_ADVANCED=n
109 Packet filtering defines a table `filter', which has a series of
110 rules for simple packet filtering at local input, forwarding and
111 local output. See the man page for iptables(8).
113 To compile it as a module, choose M here. If unsure, say N.
115 config IP_NF_TARGET_REJECT
116 tristate "REJECT target support"
117 depends on IP_NF_FILTER
118 default m if NETFILTER_ADVANCED=n
120 The REJECT target allows a filtering rule to specify that an ICMP
121 error should be issued in response to an incoming packet, rather
122 than silently being dropped.
124 To compile it as a module, choose M here. If unsure, say N.
126 config IP_NF_TARGET_LOG
127 tristate "LOG target support"
128 default m if NETFILTER_ADVANCED=n
130 This option adds a `LOG' target, which allows you to create rules in
131 any iptables table which records the packet header to the syslog.
133 To compile it as a module, choose M here. If unsure, say N.
135 config IP_NF_TARGET_ULOG
136 tristate "ULOG target support"
137 default m if NETFILTER_ADVANCED=n
140 This option enables the old IPv4-only "ipt_ULOG" implementation
141 which has been obsoleted by the new "nfnetlink_log" code (see
142 CONFIG_NETFILTER_NETLINK_LOG).
144 This option adds a `ULOG' target, which allows you to create rules in
145 any iptables table. The packet is passed to a userspace logging
146 daemon using netlink multicast sockets; unlike the LOG target
147 which can only be viewed through syslog.
149 The appropriate userspace logging daemon (ulogd) may be obtained from
150 <http://www.gnumonks.org/projects/ulogd/>
152 To compile it as a module, choose M here. If unsure, say N.
154 # NAT + specific targets: nf_conntrack
157 depends on NF_CONNTRACK_IPV4
158 default m if NETFILTER_ADVANCED=n
160 The Full NAT option allows masquerading, port forwarding and other
161 forms of full Network Address Port Translation. It is controlled by
162 the `nat' table in iptables: see the man page for iptables(8).
164 To compile it as a module, choose M here. If unsure, say N.
171 config IP_NF_TARGET_MASQUERADE
172 tristate "MASQUERADE target support"
174 default m if NETFILTER_ADVANCED=n
176 Masquerading is a special case of NAT: all outgoing connections are
177 changed to seem to come from a particular interface's address, and
178 if the interface goes down, those connections are lost. This is
179 only useful for dialup accounts with dynamic IP address (ie. your IP
180 address will be different on next dialup).
182 To compile it as a module, choose M here. If unsure, say N.
184 config IP_NF_TARGET_NETMAP
185 tristate "NETMAP target support"
187 depends on NETFILTER_ADVANCED
189 NETMAP is an implementation of static 1:1 NAT mapping of network
190 addresses. It maps the network address part, while keeping the host
193 To compile it as a module, choose M here. If unsure, say N.
195 config IP_NF_TARGET_REDIRECT
196 tristate "REDIRECT target support"
198 depends on NETFILTER_ADVANCED
200 REDIRECT is a special case of NAT: all incoming connections are
201 mapped onto the incoming interface's address, causing the packets to
202 come to the local machine instead of passing through. This is
203 useful for transparent proxies.
205 To compile it as a module, choose M here. If unsure, say N.
207 config IP_NF_TARGET_IDLETIMER
208 tristate "IDLETIMER target support"
209 depends on IP_NF_IPTABLES
211 This option adds a `IDLETIMER' target. Each matching packet resets
212 the timer associated with input and/or output interfaces. Timer
213 expiry causes kobject uevent. Idle timer can be read via sysfs.
215 To compile it as a module, choose M here. If unsure, say N.
218 To compile it as a module, choose M here. If unsure, say N.
220 config NF_NAT_SNMP_BASIC
221 tristate "Basic SNMP-ALG support"
223 depends on NETFILTER_ADVANCED
226 This module implements an Application Layer Gateway (ALG) for
227 SNMP payloads. In conjunction with NAT, it allows a network
228 management system to access multiple private networks with
229 conflicting addresses. It works by modifying IP addresses
230 inside SNMP payloads to match IP-layer NAT mapping.
232 This is the "basic" form of SNMP-ALG, as described in RFC 2962
234 To compile it as a module, choose M here. If unsure, say N.
236 # If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
237 # or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
238 # From kconfig-language.txt:
240 # <expr> '&&' <expr> (6)
242 # (6) Returns the result of min(/expr/, /expr/).
243 config NF_NAT_PROTO_DCCP
245 depends on NF_NAT && NF_CT_PROTO_DCCP
246 default NF_NAT && NF_CT_PROTO_DCCP
248 config NF_NAT_PROTO_GRE
250 depends on NF_NAT && NF_CT_PROTO_GRE
252 config NF_NAT_PROTO_UDPLITE
254 depends on NF_NAT && NF_CT_PROTO_UDPLITE
255 default NF_NAT && NF_CT_PROTO_UDPLITE
257 config NF_NAT_PROTO_SCTP
259 default NF_NAT && NF_CT_PROTO_SCTP
260 depends on NF_NAT && NF_CT_PROTO_SCTP
265 depends on NF_CONNTRACK && NF_NAT
266 default NF_NAT && NF_CONNTRACK_FTP
270 depends on NF_CONNTRACK && NF_NAT
271 default NF_NAT && NF_CONNTRACK_IRC
275 depends on NF_CONNTRACK && NF_NAT
276 default NF_NAT && NF_CONNTRACK_TFTP
280 depends on NF_CONNTRACK && NF_NAT
281 default NF_NAT && NF_CONNTRACK_AMANDA
285 depends on NF_CONNTRACK && NF_NAT
286 default NF_NAT && NF_CONNTRACK_PPTP
287 select NF_NAT_PROTO_GRE
291 depends on NF_CONNTRACK && NF_NAT
292 default NF_NAT && NF_CONNTRACK_H323
296 depends on NF_CONNTRACK && NF_NAT
297 default NF_NAT && NF_CONNTRACK_SIP
299 # mangle + specific targets
301 tristate "Packet mangling"
302 default m if NETFILTER_ADVANCED=n
304 This option adds a `mangle' table to iptables: see the man page for
305 iptables(8). This table is used for various packet alterations
306 which can effect how the packet is routed.
308 To compile it as a module, choose M here. If unsure, say N.
310 config IP_NF_TARGET_CLUSTERIP
311 tristate "CLUSTERIP target support (EXPERIMENTAL)"
312 depends on IP_NF_MANGLE && EXPERIMENTAL
313 depends on NF_CONNTRACK_IPV4
314 depends on NETFILTER_ADVANCED
315 select NF_CONNTRACK_MARK
317 The CLUSTERIP target allows you to build load-balancing clusters of
318 network servers without having a dedicated load-balancing
319 router/server/switch.
321 To compile it as a module, choose M here. If unsure, say N.
323 config IP_NF_TARGET_ECN
324 tristate "ECN target support"
325 depends on IP_NF_MANGLE
326 depends on NETFILTER_ADVANCED
328 This option adds a `ECN' target, which can be used in the iptables mangle
331 You can use this target to remove the ECN bits from the IPv4 header of
332 an IP packet. This is particularly useful, if you need to work around
333 existing ECN blackholes on the internet, but don't want to disable
334 ECN support in general.
336 To compile it as a module, choose M here. If unsure, say N.
338 config IP_NF_TARGET_TTL
339 tristate '"TTL" target support'
340 depends on NETFILTER_ADVANCED
341 select NETFILTER_XT_TARGET_HL
343 This is a backwards-compat option for the user's convenience
344 (e.g. when running oldconfig). It selects
345 CONFIG_NETFILTER_XT_TARGET_HL.
347 # raw + specific targets
349 tristate 'raw table support (required for NOTRACK/TRACE)'
350 depends on NETFILTER_ADVANCED
352 This option adds a `raw' table to iptables. This table is the very
353 first in the netfilter framework and hooks in at the PREROUTING
356 If you want to compile it as a module, say M here and read
357 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
359 # security table for MAC policy
360 config IP_NF_SECURITY
361 tristate "Security table"
363 depends on NETFILTER_ADVANCED
365 This option adds a `security' table to iptables, for use
366 with Mandatory Access Control (MAC) policy.
370 endif # IP_NF_IPTABLES
373 config IP_NF_ARPTABLES
374 tristate "ARP tables support"
375 select NETFILTER_XTABLES
376 depends on NETFILTER_ADVANCED
378 arptables is a general, extensible packet identification framework.
379 The ARP packet filtering and mangling (manipulation)subsystems
380 use this: say Y or M here if you want to use either of those.
382 To compile it as a module, choose M here. If unsure, say N.
386 config IP_NF_ARPFILTER
387 tristate "ARP packet filtering"
389 ARP packet filtering defines a table `filter', which has a series of
390 rules for simple ARP packet filtering at local input and
391 local output. On a bridge, you can also specify filtering rules
392 for forwarded ARP packets. See the man page for arptables(8).
394 To compile it as a module, choose M here. If unsure, say N.
396 config IP_NF_ARP_MANGLE
397 tristate "ARP payload mangling"
399 Allows altering the ARP packet payload: source and destination
400 hardware and network addresses.
402 endif # IP_NF_ARPTABLES