[deliverable/linux.git] / net / ipv4 / netfilter / Kconfig

#
# IP netfilter configuration
#

menu "IP: Netfilter Configuration"
	depends on INET && NETFILTER

config NF_CONNTRACK_IPV4
	tristate "IPv4 connection tracking support (required for NAT)"
	depends on NF_CONNTRACK
	default m if NETFILTER_ADVANCED=n
	---help---
	  Connection tracking keeps a record of what packets have passed
	  through your machine, in order to figure out how they are related
	  into connections.

	  This is IPv4 support on Layer 3 independent connection tracking.
	  Layer 3 independent connection tracking is experimental scheme
	  which generalize ip_conntrack to support other layer 3 protocols.

	  To compile it as a module, choose M here.  If unsure, say N.

config NF_CONNTRACK_PROC_COMPAT
	bool "proc/sysctl compatibility with old connection tracking"
	depends on NF_CONNTRACK_IPV4
	default y
	help
	  This option enables /proc and sysctl compatibility with the old
	  layer 3 dependant connection tracking. This is needed to keep
	  old programs that have not been adapted to the new names working.

	  If unsure, say Y.

config IP_NF_QUEUE
	tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
	depends on NETFILTER_ADVANCED
	help
	  Netfilter has the ability to queue packets to user space: the
	  netlink device can be used to access them using this driver.

	  This option enables the old IPv4-only "ip_queue" implementation
	  which has been obsoleted by the new "nfnetlink_queue" code (see
	  CONFIG_NETFILTER_NETLINK_QUEUE).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_IPTABLES
	tristate "IP tables support (required for filtering/masq/NAT)"
	default m if NETFILTER_ADVANCED=n
	select NETFILTER_XTABLES
	help
	  iptables is a general, extensible packet identification framework.
	  The packet filtering and full NAT (masquerading, port forwarding,
	  etc) subsystems now use this: say `Y' or `M' here if you want to use
	  either of those.

	  To compile it as a module, choose M here.  If unsure, say N.

# The matches.
config IP_NF_MATCH_RECENT
	tristate '"recent" match support'
	depends on IP_NF_IPTABLES
	depends on NETFILTER_ADVANCED
	help
	  This match is used for creating one or many lists of recently
	  used addresses and then matching against that/those list(s).

	  Short options are available by using 'iptables -m recent -h'
	  Official Website: <http://snowman.net/projects/ipt_recent/>

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_MATCH_ECN
	tristate '"ecn" match support'
	depends on IP_NF_IPTABLES
	depends on NETFILTER_ADVANCED
	help
	  This option adds a `ECN' match, which allows you to match against
	  the IPv4 and TCP header ECN fields.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_MATCH_AH
	tristate '"ah" match support'
	depends on IP_NF_IPTABLES
	depends on NETFILTER_ADVANCED
	help
	  This match extension allows you to match a range of SPIs
	  inside AH header of IPSec packets.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_MATCH_TTL
	tristate '"ttl" match support'
	depends on IP_NF_IPTABLES
	depends on NETFILTER_ADVANCED
	help
	  This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
	  to match packets by their TTL value.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_MATCH_ADDRTYPE
	tristate '"addrtype" address type match support'
	depends on IP_NF_IPTABLES
	depends on NETFILTER_ADVANCED
	help
	  This option allows you to match what routing thinks of an address,
	  eg. UNICAST, LOCAL, BROADCAST, ...

	  If you want to compile it as a module, say M here and read
	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.

# `filter', generic and specific targets
config IP_NF_FILTER
	tristate "Packet filtering"
	depends on IP_NF_IPTABLES
	default m if NETFILTER_ADVANCED=n
	help
	  Packet filtering defines a table `filter', which has a series of
	  rules for simple packet filtering at local input, forwarding and
	  local output.  See the man page for iptables(8).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_REJECT
	tristate "REJECT target support"
	depends on IP_NF_FILTER
	default m if NETFILTER_ADVANCED=n
	help
	  The REJECT target allows a filtering rule to specify that an ICMP
	  error should be issued in response to an incoming packet, rather
	  than silently being dropped.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_LOG
	tristate "LOG target support"
	depends on IP_NF_IPTABLES
	default m if NETFILTER_ADVANCED=n
	help
	  This option adds a `LOG' target, which allows you to create rules in
	  any iptables table which records the packet header to the syslog.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_ULOG
	tristate "ULOG target support"
	depends on IP_NF_IPTABLES
	default m if NETFILTER_ADVANCED=n
	---help---

	  This option enables the old IPv4-only "ipt_ULOG" implementation
	  which has been obsoleted by the new "nfnetlink_log" code (see
	  CONFIG_NETFILTER_NETLINK_LOG).

	  This option adds a `ULOG' target, which allows you to create rules in
	  any iptables table. The packet is passed to a userspace logging
	  daemon using netlink multicast sockets; unlike the LOG target
	  which can only be viewed through syslog.

	  The appropriate userspace logging daemon (ulogd) may be obtained from
	  <http://www.gnumonks.org/projects/ulogd/>

	  To compile it as a module, choose M here.  If unsure, say N.

# NAT + specific targets: nf_conntrack
config NF_NAT
	tristate "Full NAT"
	depends on IP_NF_IPTABLES && NF_CONNTRACK_IPV4
	default m if NETFILTER_ADVANCED=n
	help
	  The Full NAT option allows masquerading, port forwarding and other
	  forms of full Network Address Port Translation.  It is controlled by
	  the `nat' table in iptables: see the man page for iptables(8).

	  To compile it as a module, choose M here.  If unsure, say N.

config NF_NAT_NEEDED
	bool
	depends on NF_NAT
	default y

config IP_NF_TARGET_MASQUERADE
	tristate "MASQUERADE target support"
	depends on NF_NAT
	default m if NETFILTER_ADVANCED=n
	help
	  Masquerading is a special case of NAT: all outgoing connections are
	  changed to seem to come from a particular interface's address, and
	  if the interface goes down, those connections are lost.  This is
	  only useful for dialup accounts with dynamic IP address (ie. your IP
	  address will be different on next dialup).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_REDIRECT
	tristate "REDIRECT target support"
	depends on NF_NAT
	depends on NETFILTER_ADVANCED
	help
	  REDIRECT is a special case of NAT: all incoming connections are
	  mapped onto the incoming interface's address, causing the packets to
	  come to the local machine instead of passing through.  This is
	  useful for transparent proxies.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_NETMAP
	tristate "NETMAP target support"
	depends on NF_NAT
	depends on NETFILTER_ADVANCED
	help
	  NETMAP is an implementation of static 1:1 NAT mapping of network
	  addresses. It maps the network address part, while keeping the host
	  address part intact. It is similar to Fast NAT, except that
	  Netfilter's connection tracking doesn't work well with Fast NAT.

	  To compile it as a module, choose M here.  If unsure, say N.

config NF_NAT_SNMP_BASIC
	tristate "Basic SNMP-ALG support"
	depends on NF_NAT
	depends on NETFILTER_ADVANCED
	---help---

	  This module implements an Application Layer Gateway (ALG) for
	  SNMP payloads.  In conjunction with NAT, it allows a network
	  management system to access multiple private networks with
	  conflicting addresses.  It works by modifying IP addresses
	  inside SNMP payloads to match IP-layer NAT mapping.

	  This is the "basic" form of SNMP-ALG, as described in RFC 2962

	  To compile it as a module, choose M here.  If unsure, say N.

# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
# From kconfig-language.txt:
#
#           <expr> '&&' <expr>                   (6)
#
# (6) Returns the result of min(/expr/, /expr/).
config NF_NAT_PROTO_DCCP
	tristate
	depends on NF_NAT && NF_CT_PROTO_DCCP
	default NF_NAT && NF_CT_PROTO_DCCP

config NF_NAT_PROTO_GRE
	tristate
	depends on NF_NAT && NF_CT_PROTO_GRE

config NF_NAT_PROTO_UDPLITE
	tristate
	depends on NF_NAT && NF_CT_PROTO_UDPLITE
	default NF_NAT && NF_CT_PROTO_UDPLITE

config NF_NAT_PROTO_SCTP
	tristate
	default NF_NAT && NF_CT_PROTO_SCTP
	depends on NF_NAT && NF_CT_PROTO_SCTP

config NF_NAT_FTP
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_FTP

config NF_NAT_IRC
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_IRC

config NF_NAT_TFTP
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_TFTP

config NF_NAT_AMANDA
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_AMANDA

config NF_NAT_PPTP
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_PPTP
	select NF_NAT_PROTO_GRE

config NF_NAT_H323
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_H323

config NF_NAT_SIP
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_SIP

# mangle + specific targets
config IP_NF_MANGLE
	tristate "Packet mangling"
	depends on IP_NF_IPTABLES
	default m if NETFILTER_ADVANCED=n
	help
	  This option adds a `mangle' table to iptables: see the man page for
	  iptables(8).  This table is used for various packet alterations
	  which can effect how the packet is routed.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_ECN
	tristate "ECN target support"
	depends on IP_NF_MANGLE
	depends on NETFILTER_ADVANCED
	---help---
	  This option adds a `ECN' target, which can be used in the iptables mangle
	  table.  

	  You can use this target to remove the ECN bits from the IPv4 header of
	  an IP packet.  This is particularly useful, if you need to work around
	  existing ECN blackholes on the internet, but don't want to disable
	  ECN support in general.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_TTL
	tristate  'TTL target support'
	depends on IP_NF_MANGLE
	depends on NETFILTER_ADVANCED
	help
	  This option adds a `TTL' target, which enables the user to modify
	  the TTL value of the IP header.

	  While it is safe to decrement/lower the TTL, this target also enables
	  functionality to increment and set the TTL value of the IP header to
	  arbitrary values.  This is EXTREMELY DANGEROUS since you can easily
	  create immortal packets that loop forever on the network.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_CLUSTERIP
	tristate "CLUSTERIP target support (EXPERIMENTAL)"
	depends on IP_NF_MANGLE && EXPERIMENTAL
	depends on NF_CONNTRACK_IPV4
	depends on NETFILTER_ADVANCED
	select NF_CONNTRACK_MARK
	help
	  The CLUSTERIP target allows you to build load-balancing clusters of
	  network servers without having a dedicated load-balancing
	  router/server/switch.
	
	  To compile it as a module, choose M here.  If unsure, say N.

# raw + specific targets
config IP_NF_RAW
	tristate  'raw table support (required for NOTRACK/TRACE)'
	depends on IP_NF_IPTABLES
	depends on NETFILTER_ADVANCED
	help
	  This option adds a `raw' table to iptables. This table is the very
	  first in the netfilter framework and hooks in at the PREROUTING
	  and OUTPUT chains.
	
	  If you want to compile it as a module, say M here and read
	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.

# ARP tables
config IP_NF_ARPTABLES
	tristate "ARP tables support"
	select NETFILTER_XTABLES
	depends on NETFILTER_ADVANCED
	help
	  arptables is a general, extensible packet identification framework.
	  The ARP packet filtering and mangling (manipulation)subsystems
	  use this: say Y or M here if you want to use either of those.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_ARPFILTER
	tristate "ARP packet filtering"
	depends on IP_NF_ARPTABLES
	help
	  ARP packet filtering defines a table `filter', which has a series of
	  rules for simple ARP packet filtering at local input and
	  local output.  On a bridge, you can also specify filtering rules
	  for forwarded ARP packets. See the man page for arptables(8).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_ARP_MANGLE
	tristate "ARP payload mangling"
	depends on IP_NF_ARPTABLES
	help
	  Allows altering the ARP packet payload: source and destination
	  hardware and network addresses.

endmenu
Commit	Line	Data
1da177e4 LT	1	#
	2	# IP netfilter configuration
	3	#
	4
	5	menu "IP: Netfilter Configuration"
	6	depends on INET && NETFILTER
	7
9fb9cbb1	8	config NF_CONNTRACK_IPV4
c9386cfd PM	9	tristate "IPv4 connection tracking support (required for NAT)"
c9386cfd PM	10	depends on NF_CONNTRACK
33b8e776	11	default m if NETFILTER_ADVANCED=n
9fb9cbb1 YK	12	---help---
	13	Connection tracking keeps a record of what packets have passed
	14	through your machine, in order to figure out how they are related
	15	into connections.
	16
	17	This is IPv4 support on Layer 3 independent connection tracking.
	18	Layer 3 independent connection tracking is experimental scheme
	19	which generalize ip_conntrack to support other layer 3 protocols.
	20
	21	To compile it as a module, choose M here. If unsure, say N.
	22
a999e683 PM	23	config NF_CONNTRACK_PROC_COMPAT
a999e683 PM	24	bool "proc/sysctl compatibility with old connection tracking"
0c4ca1bd	25	depends on NF_CONNTRACK_IPV4
a999e683 PM	26	default y
	27	help
	28	This option enables /proc and sysctl compatibility with the old
	29	layer 3 dependant connection tracking. This is needed to keep
	30	old programs that have not been adapted to the new names working.
	31
	32	If unsure, say Y.
	33
1da177e4	34	config IP_NF_QUEUE
7af4cc3f	35	tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
33b8e776	36	depends on NETFILTER_ADVANCED
1da177e4 LT	37	help
	38	Netfilter has the ability to queue packets to user space: the
	39	netlink device can be used to access them using this driver.
	40
7af4cc3f HW	41	This option enables the old IPv4-only "ip_queue" implementation
	42	which has been obsoleted by the new "nfnetlink_queue" code (see
	43	CONFIG_NETFILTER_NETLINK_QUEUE).
	44
1da177e4 LT	45	To compile it as a module, choose M here. If unsure, say N.
	46
	47	config IP_NF_IPTABLES
	48	tristate "IP tables support (required for filtering/masq/NAT)"
33b8e776	49	default m if NETFILTER_ADVANCED=n
a3c941b0	50	select NETFILTER_XTABLES
1da177e4 LT	51	help
	52	iptables is a general, extensible packet identification framework.
	53	The packet filtering and full NAT (masquerading, port forwarding,
	54	etc) subsystems now use this: say `Y' or `M' here if you want to use
	55	either of those.
	56
	57	To compile it as a module, choose M here. If unsure, say N.
	58
	59	# The matches.
1da177e4	60	config IP_NF_MATCH_RECENT
4c37799c	61	tristate '"recent" match support'
1da177e4	62	depends on IP_NF_IPTABLES
33b8e776	63	depends on NETFILTER_ADVANCED
1da177e4 LT	64	help
	65	This match is used for creating one or many lists of recently
	66	used addresses and then matching against that/those list(s).
	67
	68	Short options are available by using 'iptables -m recent -h'
	69	Official Website: <http://snowman.net/projects/ipt_recent/>
	70
	71	To compile it as a module, choose M here. If unsure, say N.
	72
	73	config IP_NF_MATCH_ECN
4c37799c	74	tristate '"ecn" match support'
1da177e4	75	depends on IP_NF_IPTABLES
33b8e776	76	depends on NETFILTER_ADVANCED
1da177e4 LT	77	help
	78	This option adds a `ECN' match, which allows you to match against
	79	the IPv4 and TCP header ECN fields.
	80
	81	To compile it as a module, choose M here. If unsure, say N.
	82
dc5ab2fa	83	config IP_NF_MATCH_AH
4c37799c	84	tristate '"ah" match support'
1da177e4	85	depends on IP_NF_IPTABLES
33b8e776	86	depends on NETFILTER_ADVANCED
1da177e4	87	help
dc5ab2fa YK	88	This match extension allows you to match a range of SPIs
dc5ab2fa YK	89	inside AH header of IPSec packets.
1da177e4 LT	90
	91	To compile it as a module, choose M here. If unsure, say N.
	92
1da177e4	93	config IP_NF_MATCH_TTL
4c37799c	94	tristate '"ttl" match support'
1da177e4	95	depends on IP_NF_IPTABLES
33b8e776	96	depends on NETFILTER_ADVANCED
1da177e4 LT	97	help
	98	This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
	99	to match packets by their TTL value.
	100
	101	To compile it as a module, choose M here. If unsure, say N.
	102
1da177e4	103	config IP_NF_MATCH_ADDRTYPE
4c37799c	104	tristate '"addrtype" address type match support'
1da177e4	105	depends on IP_NF_IPTABLES
33b8e776	106	depends on NETFILTER_ADVANCED
1da177e4 LT	107	help
	108	This option allows you to match what routing thinks of an address,
	109	eg. UNICAST, LOCAL, BROADCAST, ...
33b8e776	110
1da177e4	111	If you want to compile it as a module, say M here and read
e403149c	112	<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1da177e4	113
1da177e4 LT	114	# `filter', generic and specific targets
	115	config IP_NF_FILTER
	116	tristate "Packet filtering"
	117	depends on IP_NF_IPTABLES
33b8e776	118	default m if NETFILTER_ADVANCED=n
1da177e4 LT	119	help
	120	Packet filtering defines a table `filter', which has a series of
	121	rules for simple packet filtering at local input, forwarding and
	122	local output. See the man page for iptables(8).
	123
	124	To compile it as a module, choose M here. If unsure, say N.
	125
	126	config IP_NF_TARGET_REJECT
	127	tristate "REJECT target support"
	128	depends on IP_NF_FILTER
33b8e776	129	default m if NETFILTER_ADVANCED=n
1da177e4 LT	130	help
	131	The REJECT target allows a filtering rule to specify that an ICMP
	132	error should be issued in response to an incoming packet, rather
	133	than silently being dropped.
	134
	135	To compile it as a module, choose M here. If unsure, say N.
	136
	137	config IP_NF_TARGET_LOG
	138	tristate "LOG target support"
	139	depends on IP_NF_IPTABLES
33b8e776	140	default m if NETFILTER_ADVANCED=n
1da177e4 LT	141	help
	142	This option adds a `LOG' target, which allows you to create rules in
	143	any iptables table which records the packet header to the syslog.
	144
	145	To compile it as a module, choose M here. If unsure, say N.
	146
	147	config IP_NF_TARGET_ULOG
44adf28f	148	tristate "ULOG target support"
1da177e4	149	depends on IP_NF_IPTABLES
33b8e776	150	default m if NETFILTER_ADVANCED=n
1da177e4	151	---help---
f40863ce HW	152
	153	This option enables the old IPv4-only "ipt_ULOG" implementation
	154	which has been obsoleted by the new "nfnetlink_log" code (see
	155	CONFIG_NETFILTER_NETLINK_LOG).
	156
1da177e4 LT	157	This option adds a `ULOG' target, which allows you to create rules in
	158	any iptables table. The packet is passed to a userspace logging
	159	daemon using netlink multicast sockets; unlike the LOG target
	160	which can only be viewed through syslog.
	161
44c09201	162	The appropriate userspace logging daemon (ulogd) may be obtained from
1da177e4 LT	163	<http://www.gnumonks.org/projects/ulogd/>
	164
	165	To compile it as a module, choose M here. If unsure, say N.
	166
5b1158e9 JK	167	# NAT + specific targets: nf_conntrack
	168	config NF_NAT
	169	tristate "Full NAT"
083e69e9	170	depends on IP_NF_IPTABLES && NF_CONNTRACK_IPV4
33b8e776	171	default m if NETFILTER_ADVANCED=n
5b1158e9 JK	172	help
	173	The Full NAT option allows masquerading, port forwarding and other
	174	forms of full Network Address Port Translation. It is controlled by
	175	the `nat' table in iptables: see the man page for iptables(8).
	176
	177	To compile it as a module, choose M here. If unsure, say N.
	178
5b1158e9 JK	179	config NF_NAT_NEEDED
	180	bool
	181	depends on NF_NAT
1da177e4 LT	182	default y
	183
	184	config IP_NF_TARGET_MASQUERADE
	185	tristate "MASQUERADE target support"
587aa641	186	depends on NF_NAT
33b8e776	187	default m if NETFILTER_ADVANCED=n
1da177e4 LT	188	help
	189	Masquerading is a special case of NAT: all outgoing connections are
	190	changed to seem to come from a particular interface's address, and
	191	if the interface goes down, those connections are lost. This is
	192	only useful for dialup accounts with dynamic IP address (ie. your IP
	193	address will be different on next dialup).
	194
	195	To compile it as a module, choose M here. If unsure, say N.
	196
	197	config IP_NF_TARGET_REDIRECT
	198	tristate "REDIRECT target support"
587aa641	199	depends on NF_NAT
33b8e776	200	depends on NETFILTER_ADVANCED
1da177e4 LT	201	help
	202	REDIRECT is a special case of NAT: all incoming connections are
	203	mapped onto the incoming interface's address, causing the packets to
	204	come to the local machine instead of passing through. This is
	205	useful for transparent proxies.
	206
	207	To compile it as a module, choose M here. If unsure, say N.
	208
	209	config IP_NF_TARGET_NETMAP
	210	tristate "NETMAP target support"
587aa641	211	depends on NF_NAT
33b8e776	212	depends on NETFILTER_ADVANCED
1da177e4 LT	213	help
	214	NETMAP is an implementation of static 1:1 NAT mapping of network
	215	addresses. It maps the network address part, while keeping the host
	216	address part intact. It is similar to Fast NAT, except that
	217	Netfilter's connection tracking doesn't work well with Fast NAT.
	218
	219	To compile it as a module, choose M here. If unsure, say N.
	220
807467c2	221	config NF_NAT_SNMP_BASIC
8ce22fca PM	222	tristate "Basic SNMP-ALG support"
8ce22fca PM	223	depends on NF_NAT
33b8e776	224	depends on NETFILTER_ADVANCED
807467c2 PM	225	---help---
	226
	227	This module implements an Application Layer Gateway (ALG) for
	228	SNMP payloads. In conjunction with NAT, it allows a network
1da177e4 LT	229	management system to access multiple private networks with
	230	conflicting addresses. It works by modifying IP addresses
	231	inside SNMP payloads to match IP-layer NAT mapping.
	232
	233	This is the "basic" form of SNMP-ALG, as described in RFC 2962
	234
	235	To compile it as a module, choose M here. If unsure, say N.
	236
55a73324 JK	237	# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
	238	# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
	239	# From kconfig-language.txt:
	240	#
	241	# <expr> '&&' <expr> (6)
	242	#
	243	# (6) Returns the result of min(/expr/, /expr/).
4910a087 PM	244	config NF_NAT_PROTO_DCCP
	245	tristate
	246	depends on NF_NAT && NF_CT_PROTO_DCCP
	247	default NF_NAT && NF_CT_PROTO_DCCP
	248
f09943fe PM	249	config NF_NAT_PROTO_GRE
	250	tristate
	251	depends on NF_NAT && NF_CT_PROTO_GRE
	252
6185f870 PM	253	config NF_NAT_PROTO_UDPLITE
	254	tristate
	255	depends on NF_NAT && NF_CT_PROTO_UDPLITE
	256	default NF_NAT && NF_CT_PROTO_UDPLITE
	257
9d908a69 PM	258	config NF_NAT_PROTO_SCTP
	259	tristate
	260	default NF_NAT && NF_CT_PROTO_SCTP
	261	depends on NF_NAT && NF_CT_PROTO_SCTP
	262
55a73324 JK	263	config NF_NAT_FTP
	264	tristate
	265	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	266	default NF_NAT && NF_CONNTRACK_FTP
	267
869f37d8 PM	268	config NF_NAT_IRC
	269	tristate
	270	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	271	default NF_NAT && NF_CONNTRACK_IRC
	272
a536df35 PM	273	config NF_NAT_TFTP
	274	tristate
	275	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	276	default NF_NAT && NF_CONNTRACK_TFTP
	277
16958900 PM	278	config NF_NAT_AMANDA
	279	tristate
	280	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	281	default NF_NAT && NF_CONNTRACK_AMANDA
	282
f09943fe PM	283	config NF_NAT_PPTP
	284	tristate
	285	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	286	default NF_NAT && NF_CONNTRACK_PPTP
	287	select NF_NAT_PROTO_GRE
	288
f587de0e PM	289	config NF_NAT_H323
	290	tristate
	291	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	292	default NF_NAT && NF_CONNTRACK_H323
	293
9fafcd7b PM	294	config NF_NAT_SIP
	295	tristate
	296	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	297	default NF_NAT && NF_CONNTRACK_SIP
	298
1da177e4 LT	299	# mangle + specific targets
	300	config IP_NF_MANGLE
	301	tristate "Packet mangling"
	302	depends on IP_NF_IPTABLES
33b8e776	303	default m if NETFILTER_ADVANCED=n
1da177e4 LT	304	help
	305	This option adds a `mangle' table to iptables: see the man page for
	306	iptables(8). This table is used for various packet alterations
	307	which can effect how the packet is routed.
	308
	309	To compile it as a module, choose M here. If unsure, say N.
	310
1da177e4 LT	311	config IP_NF_TARGET_ECN
	312	tristate "ECN target support"
	313	depends on IP_NF_MANGLE
33b8e776	314	depends on NETFILTER_ADVANCED
1da177e4 LT	315	---help---
	316	This option adds a `ECN' target, which can be used in the iptables mangle
	317	table.
	318
	319	You can use this target to remove the ECN bits from the IPv4 header of
	320	an IP packet. This is particularly useful, if you need to work around
	321	existing ECN blackholes on the internet, but don't want to disable
	322	ECN support in general.
	323
	324	To compile it as a module, choose M here. If unsure, say N.
	325
5f2c3b91 HW	326	config IP_NF_TARGET_TTL
	327	tristate 'TTL target support'
	328	depends on IP_NF_MANGLE
33b8e776	329	depends on NETFILTER_ADVANCED
5f2c3b91 HW	330	help
	331	This option adds a `TTL' target, which enables the user to modify
	332	the TTL value of the IP header.
	333
	334	While it is safe to decrement/lower the TTL, this target also enables
	335	functionality to increment and set the TTL value of the IP header to
	336	arbitrary values. This is EXTREMELY DANGEROUS since you can easily
	337	create immortal packets that loop forever on the network.
	338
	339	To compile it as a module, choose M here. If unsure, say N.
	340
1da177e4 LT	341	config IP_NF_TARGET_CLUSTERIP
1da177e4 LT	342	tristate "CLUSTERIP target support (EXPERIMENTAL)"
2b8f2ff6	343	depends on IP_NF_MANGLE && EXPERIMENTAL
587aa641	344	depends on NF_CONNTRACK_IPV4
33b8e776	345	depends on NETFILTER_ADVANCED
587aa641	346	select NF_CONNTRACK_MARK
1da177e4 LT	347	help
	348	The CLUSTERIP target allows you to build load-balancing clusters of
	349	network servers without having a dedicated load-balancing
	350	router/server/switch.
	351
	352	To compile it as a module, choose M here. If unsure, say N.
	353
	354	# raw + specific targets
	355	config IP_NF_RAW
	356	tristate 'raw table support (required for NOTRACK/TRACE)'
	357	depends on IP_NF_IPTABLES
33b8e776	358	depends on NETFILTER_ADVANCED
1da177e4 LT	359	help
	360	This option adds a `raw' table to iptables. This table is the very
	361	first in the netfilter framework and hooks in at the PREROUTING
	362	and OUTPUT chains.
	363
	364	If you want to compile it as a module, say M here and read
e403149c	365	<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1da177e4	366
1da177e4 LT	367	# ARP tables
	368	config IP_NF_ARPTABLES
	369	tristate "ARP tables support"
a3c941b0	370	select NETFILTER_XTABLES
33b8e776	371	depends on NETFILTER_ADVANCED
1da177e4 LT	372	help
	373	arptables is a general, extensible packet identification framework.
	374	The ARP packet filtering and mangling (manipulation)subsystems
	375	use this: say Y or M here if you want to use either of those.
	376
	377	To compile it as a module, choose M here. If unsure, say N.
	378
	379	config IP_NF_ARPFILTER
	380	tristate "ARP packet filtering"
	381	depends on IP_NF_ARPTABLES
	382	help
	383	ARP packet filtering defines a table `filter', which has a series of
	384	rules for simple ARP packet filtering at local input and
	385	local output. On a bridge, you can also specify filtering rules
	386	for forwarded ARP packets. See the man page for arptables(8).
	387
	388	To compile it as a module, choose M here. If unsure, say N.
	389
	390	config IP_NF_ARP_MANGLE
	391	tristate "ARP payload mangling"
	392	depends on IP_NF_ARPTABLES
	393	help
	394	Allows altering the ARP packet payload: source and destination
	395	hardware and network addresses.
	396
	397	endmenu
	398