[deliverable/linux.git] / net / ipv4 / netfilter / Kconfig

#
# IP netfilter configuration
#

menu "IP: Netfilter Configuration"
	depends on INET && NETFILTER

config NF_CONNTRACK_IPV4
	tristate "IPv4 connection tracking support (required for NAT)"
	depends on NF_CONNTRACK
	---help---
	  Connection tracking keeps a record of what packets have passed
	  through your machine, in order to figure out how they are related
	  into connections.

	  This is IPv4 support on Layer 3 independent connection tracking.
	  Layer 3 independent connection tracking is experimental scheme
	  which generalize ip_conntrack to support other layer 3 protocols.

	  To compile it as a module, choose M here.  If unsure, say N.

config NF_CONNTRACK_PROC_COMPAT
	bool "proc/sysctl compatibility with old connection tracking"
	depends on NF_CONNTRACK_IPV4
	default y
	help
	  This option enables /proc and sysctl compatibility with the old
	  layer 3 dependant connection tracking. This is needed to keep
	  old programs that have not been adapted to the new names working.

	  If unsure, say Y.

config IP_NF_QUEUE
	tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
	help
	  Netfilter has the ability to queue packets to user space: the
	  netlink device can be used to access them using this driver.

	  This option enables the old IPv4-only "ip_queue" implementation
	  which has been obsoleted by the new "nfnetlink_queue" code (see
	  CONFIG_NETFILTER_NETLINK_QUEUE).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_IPTABLES
	tristate "IP tables support (required for filtering/masq/NAT)"
	select NETFILTER_XTABLES
	help
	  iptables is a general, extensible packet identification framework.
	  The packet filtering and full NAT (masquerading, port forwarding,
	  etc) subsystems now use this: say `Y' or `M' here if you want to use
	  either of those.

	  To compile it as a module, choose M here.  If unsure, say N.

# The matches.
config IP_NF_MATCH_IPRANGE
	tristate '"iprange" match support'
	depends on IP_NF_IPTABLES
	help
	  This option makes possible to match IP addresses against IP address
	  ranges.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_MATCH_RECENT
	tristate '"recent" match support'
	depends on IP_NF_IPTABLES
	help
	  This match is used for creating one or many lists of recently
	  used addresses and then matching against that/those list(s).

	  Short options are available by using 'iptables -m recent -h'
	  Official Website: <http://snowman.net/projects/ipt_recent/>

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_MATCH_ECN
	tristate '"ecn" match support'
	depends on IP_NF_IPTABLES
	help
	  This option adds a `ECN' match, which allows you to match against
	  the IPv4 and TCP header ECN fields.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_MATCH_AH
	tristate '"ah" match support'
	depends on IP_NF_IPTABLES
	help
	  This match extension allows you to match a range of SPIs
	  inside AH header of IPSec packets.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_MATCH_TTL
	tristate '"ttl" match support'
	depends on IP_NF_IPTABLES
	help
	  This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
	  to match packets by their TTL value.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_MATCH_ADDRTYPE
	tristate '"addrtype" address type match support'
	depends on IP_NF_IPTABLES
	help
	  This option allows you to match what routing thinks of an address,
	  eg. UNICAST, LOCAL, BROADCAST, ...
	
	  If you want to compile it as a module, say M here and read
	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.

# `filter', generic and specific targets
config IP_NF_FILTER
	tristate "Packet filtering"
	depends on IP_NF_IPTABLES
	help
	  Packet filtering defines a table `filter', which has a series of
	  rules for simple packet filtering at local input, forwarding and
	  local output.  See the man page for iptables(8).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_REJECT
	tristate "REJECT target support"
	depends on IP_NF_FILTER
	help
	  The REJECT target allows a filtering rule to specify that an ICMP
	  error should be issued in response to an incoming packet, rather
	  than silently being dropped.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_LOG
	tristate "LOG target support"
	depends on IP_NF_IPTABLES
	help
	  This option adds a `LOG' target, which allows you to create rules in
	  any iptables table which records the packet header to the syslog.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_ULOG
	tristate "ULOG target support"
	depends on IP_NF_IPTABLES
	---help---

	  This option enables the old IPv4-only "ipt_ULOG" implementation
	  which has been obsoleted by the new "nfnetlink_log" code (see
	  CONFIG_NETFILTER_NETLINK_LOG).

	  This option adds a `ULOG' target, which allows you to create rules in
	  any iptables table. The packet is passed to a userspace logging
	  daemon using netlink multicast sockets; unlike the LOG target
	  which can only be viewed through syslog.

	  The appropriate userspace logging daemon (ulogd) may be obtained from
	  <http://www.gnumonks.org/projects/ulogd/>

	  To compile it as a module, choose M here.  If unsure, say N.

# NAT + specific targets: nf_conntrack
config NF_NAT
	tristate "Full NAT"
	depends on IP_NF_IPTABLES && NF_CONNTRACK_IPV4
	help
	  The Full NAT option allows masquerading, port forwarding and other
	  forms of full Network Address Port Translation.  It is controlled by
	  the `nat' table in iptables: see the man page for iptables(8).

	  To compile it as a module, choose M here.  If unsure, say N.

config NF_NAT_NEEDED
	bool
	depends on NF_NAT
	default y

config IP_NF_TARGET_MASQUERADE
	tristate "MASQUERADE target support"
	depends on NF_NAT
	help
	  Masquerading is a special case of NAT: all outgoing connections are
	  changed to seem to come from a particular interface's address, and
	  if the interface goes down, those connections are lost.  This is
	  only useful for dialup accounts with dynamic IP address (ie. your IP
	  address will be different on next dialup).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_REDIRECT
	tristate "REDIRECT target support"
	depends on NF_NAT
	help
	  REDIRECT is a special case of NAT: all incoming connections are
	  mapped onto the incoming interface's address, causing the packets to
	  come to the local machine instead of passing through.  This is
	  useful for transparent proxies.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_NETMAP
	tristate "NETMAP target support"
	depends on NF_NAT
	help
	  NETMAP is an implementation of static 1:1 NAT mapping of network
	  addresses. It maps the network address part, while keeping the host
	  address part intact. It is similar to Fast NAT, except that
	  Netfilter's connection tracking doesn't work well with Fast NAT.

	  To compile it as a module, choose M here.  If unsure, say N.

config NF_NAT_SNMP_BASIC
	tristate "Basic SNMP-ALG support (EXPERIMENTAL)"
	depends on EXPERIMENTAL && NF_NAT
	---help---

	  This module implements an Application Layer Gateway (ALG) for
	  SNMP payloads.  In conjunction with NAT, it allows a network
	  management system to access multiple private networks with
	  conflicting addresses.  It works by modifying IP addresses
	  inside SNMP payloads to match IP-layer NAT mapping.

	  This is the "basic" form of SNMP-ALG, as described in RFC 2962

	  To compile it as a module, choose M here.  If unsure, say N.

# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
# From kconfig-language.txt:
#
#           <expr> '&&' <expr>                   (6)
#
# (6) Returns the result of min(/expr/, /expr/).
config NF_NAT_PROTO_GRE
	tristate
	depends on NF_NAT && NF_CT_PROTO_GRE

config NF_NAT_FTP
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_FTP

config NF_NAT_IRC
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_IRC

config NF_NAT_TFTP
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_TFTP

config NF_NAT_AMANDA
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_AMANDA

config NF_NAT_PPTP
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_PPTP
	select NF_NAT_PROTO_GRE

config NF_NAT_H323
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_H323

config NF_NAT_SIP
	tristate
	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_SIP

# mangle + specific targets
config IP_NF_MANGLE
	tristate "Packet mangling"
	depends on IP_NF_IPTABLES
	help
	  This option adds a `mangle' table to iptables: see the man page for
	  iptables(8).  This table is used for various packet alterations
	  which can effect how the packet is routed.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_ECN
	tristate "ECN target support"
	depends on IP_NF_MANGLE
	---help---
	  This option adds a `ECN' target, which can be used in the iptables mangle
	  table.  

	  You can use this target to remove the ECN bits from the IPv4 header of
	  an IP packet.  This is particularly useful, if you need to work around
	  existing ECN blackholes on the internet, but don't want to disable
	  ECN support in general.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_TTL
	tristate  'TTL target support'
	depends on IP_NF_MANGLE
	help
	  This option adds a `TTL' target, which enables the user to modify
	  the TTL value of the IP header.

	  While it is safe to decrement/lower the TTL, this target also enables
	  functionality to increment and set the TTL value of the IP header to
	  arbitrary values.  This is EXTREMELY DANGEROUS since you can easily
	  create immortal packets that loop forever on the network.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_CLUSTERIP
	tristate "CLUSTERIP target support (EXPERIMENTAL)"
	depends on IP_NF_MANGLE && EXPERIMENTAL
	depends on NF_CONNTRACK_IPV4
	select NF_CONNTRACK_MARK
	help
	  The CLUSTERIP target allows you to build load-balancing clusters of
	  network servers without having a dedicated load-balancing
	  router/server/switch.
	
	  To compile it as a module, choose M here.  If unsure, say N.

# raw + specific targets
config IP_NF_RAW
	tristate  'raw table support (required for NOTRACK/TRACE)'
	depends on IP_NF_IPTABLES
	help
	  This option adds a `raw' table to iptables. This table is the very
	  first in the netfilter framework and hooks in at the PREROUTING
	  and OUTPUT chains.
	
	  If you want to compile it as a module, say M here and read
	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.

# ARP tables
config IP_NF_ARPTABLES
	tristate "ARP tables support"
	select NETFILTER_XTABLES
	help
	  arptables is a general, extensible packet identification framework.
	  The ARP packet filtering and mangling (manipulation)subsystems
	  use this: say Y or M here if you want to use either of those.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_ARPFILTER
	tristate "ARP packet filtering"
	depends on IP_NF_ARPTABLES
	help
	  ARP packet filtering defines a table `filter', which has a series of
	  rules for simple ARP packet filtering at local input and
	  local output.  On a bridge, you can also specify filtering rules
	  for forwarded ARP packets. See the man page for arptables(8).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_ARP_MANGLE
	tristate "ARP payload mangling"
	depends on IP_NF_ARPTABLES
	help
	  Allows altering the ARP packet payload: source and destination
	  hardware and network addresses.

endmenu
Commit	Line	Data
1da177e4 LT	1	#
	2	# IP netfilter configuration
	3	#
	4
	5	menu "IP: Netfilter Configuration"
	6	depends on INET && NETFILTER
	7
9fb9cbb1	8	config NF_CONNTRACK_IPV4
c9386cfd PM	9	tristate "IPv4 connection tracking support (required for NAT)"
c9386cfd PM	10	depends on NF_CONNTRACK
9fb9cbb1 YK	11	---help---
	12	Connection tracking keeps a record of what packets have passed
	13	through your machine, in order to figure out how they are related
	14	into connections.
	15
	16	This is IPv4 support on Layer 3 independent connection tracking.
	17	Layer 3 independent connection tracking is experimental scheme
	18	which generalize ip_conntrack to support other layer 3 protocols.
	19
	20	To compile it as a module, choose M here. If unsure, say N.
	21
a999e683 PM	22	config NF_CONNTRACK_PROC_COMPAT
a999e683 PM	23	bool "proc/sysctl compatibility with old connection tracking"
0c4ca1bd	24	depends on NF_CONNTRACK_IPV4
a999e683 PM	25	default y
	26	help
	27	This option enables /proc and sysctl compatibility with the old
	28	layer 3 dependant connection tracking. This is needed to keep
	29	old programs that have not been adapted to the new names working.
	30
	31	If unsure, say Y.
	32
1da177e4	33	config IP_NF_QUEUE
7af4cc3f	34	tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
1da177e4 LT	35	help
	36	Netfilter has the ability to queue packets to user space: the
	37	netlink device can be used to access them using this driver.
	38
7af4cc3f HW	39	This option enables the old IPv4-only "ip_queue" implementation
	40	which has been obsoleted by the new "nfnetlink_queue" code (see
	41	CONFIG_NETFILTER_NETLINK_QUEUE).
	42
1da177e4 LT	43	To compile it as a module, choose M here. If unsure, say N.
	44
	45	config IP_NF_IPTABLES
	46	tristate "IP tables support (required for filtering/masq/NAT)"
a3c941b0	47	select NETFILTER_XTABLES
1da177e4 LT	48	help
	49	iptables is a general, extensible packet identification framework.
	50	The packet filtering and full NAT (masquerading, port forwarding,
	51	etc) subsystems now use this: say `Y' or `M' here if you want to use
	52	either of those.
	53
	54	To compile it as a module, choose M here. If unsure, say N.
	55
	56	# The matches.
1da177e4	57	config IP_NF_MATCH_IPRANGE
4c37799c	58	tristate '"iprange" match support'
1da177e4 LT	59	depends on IP_NF_IPTABLES
	60	help
	61	This option makes possible to match IP addresses against IP address
	62	ranges.
	63
	64	To compile it as a module, choose M here. If unsure, say N.
	65
1da177e4	66	config IP_NF_MATCH_RECENT
4c37799c	67	tristate '"recent" match support'
1da177e4 LT	68	depends on IP_NF_IPTABLES
	69	help
	70	This match is used for creating one or many lists of recently
	71	used addresses and then matching against that/those list(s).
	72
	73	Short options are available by using 'iptables -m recent -h'
	74	Official Website: <http://snowman.net/projects/ipt_recent/>
	75
	76	To compile it as a module, choose M here. If unsure, say N.
	77
	78	config IP_NF_MATCH_ECN
4c37799c	79	tristate '"ecn" match support'
1da177e4 LT	80	depends on IP_NF_IPTABLES
	81	help
	82	This option adds a `ECN' match, which allows you to match against
	83	the IPv4 and TCP header ECN fields.
	84
	85	To compile it as a module, choose M here. If unsure, say N.
	86
dc5ab2fa	87	config IP_NF_MATCH_AH
4c37799c	88	tristate '"ah" match support'
1da177e4 LT	89	depends on IP_NF_IPTABLES
1da177e4 LT	90	help
dc5ab2fa YK	91	This match extension allows you to match a range of SPIs
dc5ab2fa YK	92	inside AH header of IPSec packets.
1da177e4 LT	93
	94	To compile it as a module, choose M here. If unsure, say N.
	95
1da177e4	96	config IP_NF_MATCH_TTL
4c37799c	97	tristate '"ttl" match support'
1da177e4 LT	98	depends on IP_NF_IPTABLES
	99	help
	100	This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
	101	to match packets by their TTL value.
	102
	103	To compile it as a module, choose M here. If unsure, say N.
	104
1da177e4	105	config IP_NF_MATCH_ADDRTYPE
4c37799c	106	tristate '"addrtype" address type match support'
1da177e4 LT	107	depends on IP_NF_IPTABLES
	108	help
	109	This option allows you to match what routing thinks of an address,
	110	eg. UNICAST, LOCAL, BROADCAST, ...
	111
	112	If you want to compile it as a module, say M here and read
e403149c	113	<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1da177e4	114
1da177e4 LT	115	# `filter', generic and specific targets
	116	config IP_NF_FILTER
	117	tristate "Packet filtering"
	118	depends on IP_NF_IPTABLES
	119	help
	120	Packet filtering defines a table `filter', which has a series of
	121	rules for simple packet filtering at local input, forwarding and
	122	local output. See the man page for iptables(8).
	123
	124	To compile it as a module, choose M here. If unsure, say N.
	125
	126	config IP_NF_TARGET_REJECT
	127	tristate "REJECT target support"
	128	depends on IP_NF_FILTER
	129	help
	130	The REJECT target allows a filtering rule to specify that an ICMP
	131	error should be issued in response to an incoming packet, rather
	132	than silently being dropped.
	133
	134	To compile it as a module, choose M here. If unsure, say N.
	135
	136	config IP_NF_TARGET_LOG
	137	tristate "LOG target support"
	138	depends on IP_NF_IPTABLES
	139	help
	140	This option adds a `LOG' target, which allows you to create rules in
	141	any iptables table which records the packet header to the syslog.
	142
	143	To compile it as a module, choose M here. If unsure, say N.
	144
	145	config IP_NF_TARGET_ULOG
44adf28f	146	tristate "ULOG target support"
1da177e4 LT	147	depends on IP_NF_IPTABLES
1da177e4 LT	148	---help---
f40863ce HW	149
	150	This option enables the old IPv4-only "ipt_ULOG" implementation
	151	which has been obsoleted by the new "nfnetlink_log" code (see
	152	CONFIG_NETFILTER_NETLINK_LOG).
	153
1da177e4 LT	154	This option adds a `ULOG' target, which allows you to create rules in
	155	any iptables table. The packet is passed to a userspace logging
	156	daemon using netlink multicast sockets; unlike the LOG target
	157	which can only be viewed through syslog.
	158
44c09201	159	The appropriate userspace logging daemon (ulogd) may be obtained from
1da177e4 LT	160	<http://www.gnumonks.org/projects/ulogd/>
	161
	162	To compile it as a module, choose M here. If unsure, say N.
	163
5b1158e9 JK	164	# NAT + specific targets: nf_conntrack
	165	config NF_NAT
	166	tristate "Full NAT"
083e69e9	167	depends on IP_NF_IPTABLES && NF_CONNTRACK_IPV4
5b1158e9 JK	168	help
	169	The Full NAT option allows masquerading, port forwarding and other
	170	forms of full Network Address Port Translation. It is controlled by
	171	the `nat' table in iptables: see the man page for iptables(8).
	172
	173	To compile it as a module, choose M here. If unsure, say N.
	174
5b1158e9 JK	175	config NF_NAT_NEEDED
	176	bool
	177	depends on NF_NAT
1da177e4 LT	178	default y
	179
	180	config IP_NF_TARGET_MASQUERADE
	181	tristate "MASQUERADE target support"
587aa641	182	depends on NF_NAT
1da177e4 LT	183	help
	184	Masquerading is a special case of NAT: all outgoing connections are
	185	changed to seem to come from a particular interface's address, and
	186	if the interface goes down, those connections are lost. This is
	187	only useful for dialup accounts with dynamic IP address (ie. your IP
	188	address will be different on next dialup).
	189
	190	To compile it as a module, choose M here. If unsure, say N.
	191
	192	config IP_NF_TARGET_REDIRECT
	193	tristate "REDIRECT target support"
587aa641	194	depends on NF_NAT
1da177e4 LT	195	help
	196	REDIRECT is a special case of NAT: all incoming connections are
	197	mapped onto the incoming interface's address, causing the packets to
	198	come to the local machine instead of passing through. This is
	199	useful for transparent proxies.
	200
	201	To compile it as a module, choose M here. If unsure, say N.
	202
	203	config IP_NF_TARGET_NETMAP
	204	tristate "NETMAP target support"
587aa641	205	depends on NF_NAT
1da177e4 LT	206	help
	207	NETMAP is an implementation of static 1:1 NAT mapping of network
	208	addresses. It maps the network address part, while keeping the host
	209	address part intact. It is similar to Fast NAT, except that
	210	Netfilter's connection tracking doesn't work well with Fast NAT.
	211
	212	To compile it as a module, choose M here. If unsure, say N.
	213
807467c2 PM	214	config NF_NAT_SNMP_BASIC
	215	tristate "Basic SNMP-ALG support (EXPERIMENTAL)"
	216	depends on EXPERIMENTAL && NF_NAT
	217	---help---
	218
	219	This module implements an Application Layer Gateway (ALG) for
	220	SNMP payloads. In conjunction with NAT, it allows a network
1da177e4 LT	221	management system to access multiple private networks with
	222	conflicting addresses. It works by modifying IP addresses
	223	inside SNMP payloads to match IP-layer NAT mapping.
	224
	225	This is the "basic" form of SNMP-ALG, as described in RFC 2962
	226
	227	To compile it as a module, choose M here. If unsure, say N.
	228
55a73324 JK	229	# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
	230	# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
	231	# From kconfig-language.txt:
	232	#
	233	# <expr> '&&' <expr> (6)
	234	#
	235	# (6) Returns the result of min(/expr/, /expr/).
f09943fe PM	236	config NF_NAT_PROTO_GRE
	237	tristate
	238	depends on NF_NAT && NF_CT_PROTO_GRE
	239
55a73324 JK	240	config NF_NAT_FTP
	241	tristate
	242	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	243	default NF_NAT && NF_CONNTRACK_FTP
	244
869f37d8 PM	245	config NF_NAT_IRC
	246	tristate
	247	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	248	default NF_NAT && NF_CONNTRACK_IRC
	249
a536df35 PM	250	config NF_NAT_TFTP
	251	tristate
	252	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	253	default NF_NAT && NF_CONNTRACK_TFTP
	254
16958900 PM	255	config NF_NAT_AMANDA
	256	tristate
	257	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	258	default NF_NAT && NF_CONNTRACK_AMANDA
	259
f09943fe PM	260	config NF_NAT_PPTP
	261	tristate
	262	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	263	default NF_NAT && NF_CONNTRACK_PPTP
	264	select NF_NAT_PROTO_GRE
	265
f587de0e PM	266	config NF_NAT_H323
	267	tristate
	268	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	269	default NF_NAT && NF_CONNTRACK_H323
	270
9fafcd7b PM	271	config NF_NAT_SIP
	272	tristate
	273	depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
	274	default NF_NAT && NF_CONNTRACK_SIP
	275
1da177e4 LT	276	# mangle + specific targets
	277	config IP_NF_MANGLE
	278	tristate "Packet mangling"
	279	depends on IP_NF_IPTABLES
	280	help
	281	This option adds a `mangle' table to iptables: see the man page for
	282	iptables(8). This table is used for various packet alterations
	283	which can effect how the packet is routed.
	284
	285	To compile it as a module, choose M here. If unsure, say N.
	286
1da177e4 LT	287	config IP_NF_TARGET_ECN
	288	tristate "ECN target support"
	289	depends on IP_NF_MANGLE
	290	---help---
	291	This option adds a `ECN' target, which can be used in the iptables mangle
	292	table.
	293
	294	You can use this target to remove the ECN bits from the IPv4 header of
	295	an IP packet. This is particularly useful, if you need to work around
	296	existing ECN blackholes on the internet, but don't want to disable
	297	ECN support in general.
	298
	299	To compile it as a module, choose M here. If unsure, say N.
	300
5f2c3b91 HW	301	config IP_NF_TARGET_TTL
	302	tristate 'TTL target support'
	303	depends on IP_NF_MANGLE
	304	help
	305	This option adds a `TTL' target, which enables the user to modify
	306	the TTL value of the IP header.
	307
	308	While it is safe to decrement/lower the TTL, this target also enables
	309	functionality to increment and set the TTL value of the IP header to
	310	arbitrary values. This is EXTREMELY DANGEROUS since you can easily
	311	create immortal packets that loop forever on the network.
	312
	313	To compile it as a module, choose M here. If unsure, say N.
	314
1da177e4 LT	315	config IP_NF_TARGET_CLUSTERIP
1da177e4 LT	316	tristate "CLUSTERIP target support (EXPERIMENTAL)"
2b8f2ff6	317	depends on IP_NF_MANGLE && EXPERIMENTAL
587aa641 PM	318	depends on NF_CONNTRACK_IPV4
587aa641 PM	319	select NF_CONNTRACK_MARK
1da177e4 LT	320	help
	321	The CLUSTERIP target allows you to build load-balancing clusters of
	322	network servers without having a dedicated load-balancing
	323	router/server/switch.
	324
	325	To compile it as a module, choose M here. If unsure, say N.
	326
	327	# raw + specific targets
	328	config IP_NF_RAW
	329	tristate 'raw table support (required for NOTRACK/TRACE)'
	330	depends on IP_NF_IPTABLES
	331	help
	332	This option adds a `raw' table to iptables. This table is the very
	333	first in the netfilter framework and hooks in at the PREROUTING
	334	and OUTPUT chains.
	335
	336	If you want to compile it as a module, say M here and read
e403149c	337	<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1da177e4	338
1da177e4 LT	339	# ARP tables
	340	config IP_NF_ARPTABLES
	341	tristate "ARP tables support"
a3c941b0	342	select NETFILTER_XTABLES
1da177e4 LT	343	help
	344	arptables is a general, extensible packet identification framework.
	345	The ARP packet filtering and mangling (manipulation)subsystems
	346	use this: say Y or M here if you want to use either of those.
	347
	348	To compile it as a module, choose M here. If unsure, say N.
	349
	350	config IP_NF_ARPFILTER
	351	tristate "ARP packet filtering"
	352	depends on IP_NF_ARPTABLES
	353	help
	354	ARP packet filtering defines a table `filter', which has a series of
	355	rules for simple ARP packet filtering at local input and
	356	local output. On a bridge, you can also specify filtering rules
	357	for forwarded ARP packets. See the man page for arptables(8).
	358
	359	To compile it as a module, choose M here. If unsure, say N.
	360
	361	config IP_NF_ARP_MANGLE
	362	tristate "ARP payload mangling"
	363	depends on IP_NF_ARPTABLES
	364	help
	365	Allows altering the ARP packet payload: source and destination
	366	hardware and network addresses.
	367
	368	endmenu
	369