[deliverable/linux.git] / net / ipv4 / netfilter / Kconfig

#
# IP netfilter configuration
#

menu "IP: Netfilter Configuration"
	depends on INET && NETFILTER

config NF_DEFRAG_IPV4
	tristate
	default n

config NF_CONNTRACK_IPV4
	tristate "IPv4 connection tracking support (required for NAT)"
	depends on NF_CONNTRACK
	default m if NETFILTER_ADVANCED=n
	select NF_DEFRAG_IPV4
	---help---
	  Connection tracking keeps a record of what packets have passed
	  through your machine, in order to figure out how they are related
	  into connections.

	  This is IPv4 support on Layer 3 independent connection tracking.
	  Layer 3 independent connection tracking is experimental scheme
	  which generalize ip_conntrack to support other layer 3 protocols.

	  To compile it as a module, choose M here.  If unsure, say N.

config NF_CONNTRACK_PROC_COMPAT
	bool "proc/sysctl compatibility with old connection tracking"
	depends on NF_CONNTRACK_IPV4
	default y
	help
	  This option enables /proc and sysctl compatibility with the old
	  layer 3 dependent connection tracking. This is needed to keep
	  old programs that have not been adapted to the new names working.

	  If unsure, say Y.

config IP_NF_QUEUE
	tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
	depends on NETFILTER_ADVANCED
	help
	  Netfilter has the ability to queue packets to user space: the
	  netlink device can be used to access them using this driver.

	  This option enables the old IPv4-only "ip_queue" implementation
	  which has been obsoleted by the new "nfnetlink_queue" code (see
	  CONFIG_NETFILTER_NETLINK_QUEUE).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_IPTABLES
	tristate "IP tables support (required for filtering/masq/NAT)"
	default m if NETFILTER_ADVANCED=n
	select NETFILTER_XTABLES
	help
	  iptables is a general, extensible packet identification framework.
	  The packet filtering and full NAT (masquerading, port forwarding,
	  etc) subsystems now use this: say `Y' or `M' here if you want to use
	  either of those.

	  To compile it as a module, choose M here.  If unsure, say N.

if IP_NF_IPTABLES

# The matches.
config IP_NF_MATCH_ADDRTYPE
	tristate '"addrtype" address type match support'
	depends on NETFILTER_ADVANCED
	help
	  This option allows you to match what routing thinks of an address,
	  eg. UNICAST, LOCAL, BROADCAST, ...

	  If you want to compile it as a module, say M here and read
	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.

config IP_NF_MATCH_AH
	tristate '"ah" match support'
	depends on NETFILTER_ADVANCED
	help
	  This match extension allows you to match a range of SPIs
	  inside AH header of IPSec packets.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_MATCH_ECN
	tristate '"ecn" match support'
	depends on NETFILTER_ADVANCED
	help
	  This option adds a `ECN' match, which allows you to match against
	  the IPv4 and TCP header ECN fields.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_MATCH_TTL
	tristate '"ttl" match support'
	depends on NETFILTER_ADVANCED
	select NETFILTER_XT_MATCH_HL
	---help---
	This is a backwards-compat option for the user's convenience
	(e.g. when running oldconfig). It selects
	CONFIG_NETFILTER_XT_MATCH_HL.

# `filter', generic and specific targets
config IP_NF_FILTER
	tristate "Packet filtering"
	default m if NETFILTER_ADVANCED=n
	help
	  Packet filtering defines a table `filter', which has a series of
	  rules for simple packet filtering at local input, forwarding and
	  local output.  See the man page for iptables(8).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_REJECT
	tristate "REJECT target support"
	depends on IP_NF_FILTER
	default m if NETFILTER_ADVANCED=n
	help
	  The REJECT target allows a filtering rule to specify that an ICMP
	  error should be issued in response to an incoming packet, rather
	  than silently being dropped.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_LOG
	tristate "LOG target support"
	default m if NETFILTER_ADVANCED=n
	help
	  This option adds a `LOG' target, which allows you to create rules in
	  any iptables table which records the packet header to the syslog.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_ULOG
	tristate "ULOG target support"
	default m if NETFILTER_ADVANCED=n
	---help---

	  This option enables the old IPv4-only "ipt_ULOG" implementation
	  which has been obsoleted by the new "nfnetlink_log" code (see
	  CONFIG_NETFILTER_NETLINK_LOG).

	  This option adds a `ULOG' target, which allows you to create rules in
	  any iptables table. The packet is passed to a userspace logging
	  daemon using netlink multicast sockets; unlike the LOG target
	  which can only be viewed through syslog.

	  The appropriate userspace logging daemon (ulogd) may be obtained from
	  <http://www.netfilter.org/projects/ulogd/index.html>

	  To compile it as a module, choose M here.  If unsure, say N.

# NAT + specific targets: nf_conntrack
config NF_NAT
	tristate "Full NAT"
	depends on NF_CONNTRACK_IPV4
	default m if NETFILTER_ADVANCED=n
	help
	  The Full NAT option allows masquerading, port forwarding and other
	  forms of full Network Address Port Translation.  It is controlled by
	  the `nat' table in iptables: see the man page for iptables(8).

	  To compile it as a module, choose M here.  If unsure, say N.

config NF_NAT_NEEDED
	bool
	depends on NF_NAT
	default y

config IP_NF_TARGET_MASQUERADE
	tristate "MASQUERADE target support"
	depends on NF_NAT
	default m if NETFILTER_ADVANCED=n
	help
	  Masquerading is a special case of NAT: all outgoing connections are
	  changed to seem to come from a particular interface's address, and
	  if the interface goes down, those connections are lost.  This is
	  only useful for dialup accounts with dynamic IP address (ie. your IP
	  address will be different on next dialup).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_NETMAP
	tristate "NETMAP target support"
	depends on NF_NAT
	depends on NETFILTER_ADVANCED
	help
	  NETMAP is an implementation of static 1:1 NAT mapping of network
	  addresses. It maps the network address part, while keeping the host
	  address part intact.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_REDIRECT
	tristate "REDIRECT target support"
	depends on NF_NAT
	depends on NETFILTER_ADVANCED
	help
	  REDIRECT is a special case of NAT: all incoming connections are
	  mapped onto the incoming interface's address, causing the packets to
	  come to the local machine instead of passing through.  This is
	  useful for transparent proxies.

	  To compile it as a module, choose M here.  If unsure, say N.

config NF_NAT_SNMP_BASIC
	tristate "Basic SNMP-ALG support"
	depends on NF_NAT
	depends on NETFILTER_ADVANCED
	---help---

	  This module implements an Application Layer Gateway (ALG) for
	  SNMP payloads.  In conjunction with NAT, it allows a network
	  management system to access multiple private networks with
	  conflicting addresses.  It works by modifying IP addresses
	  inside SNMP payloads to match IP-layer NAT mapping.

	  This is the "basic" form of SNMP-ALG, as described in RFC 2962

	  To compile it as a module, choose M here.  If unsure, say N.

# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
# From kconfig-language.txt:
#
#           <expr> '&&' <expr>                   (6)
#
# (6) Returns the result of min(/expr/, /expr/).
config NF_NAT_PROTO_DCCP
	tristate
	depends on NF_NAT && NF_CT_PROTO_DCCP
	default NF_NAT && NF_CT_PROTO_DCCP

config NF_NAT_PROTO_GRE
	tristate
	depends on NF_NAT && NF_CT_PROTO_GRE

config NF_NAT_PROTO_UDPLITE
	tristate
	depends on NF_NAT && NF_CT_PROTO_UDPLITE
	default NF_NAT && NF_CT_PROTO_UDPLITE

config NF_NAT_PROTO_SCTP
	tristate
	default NF_NAT && NF_CT_PROTO_SCTP
	depends on NF_NAT && NF_CT_PROTO_SCTP
	select LIBCRC32C

config NF_NAT_FTP
	tristate
	depends on NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_FTP

config NF_NAT_IRC
	tristate
	depends on NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_IRC

config NF_NAT_TFTP
	tristate
	depends on NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_TFTP

config NF_NAT_AMANDA
	tristate
	depends on NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_AMANDA

config NF_NAT_PPTP
	tristate
	depends on NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_PPTP
	select NF_NAT_PROTO_GRE

config NF_NAT_H323
	tristate
	depends on NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_H323

config NF_NAT_SIP
	tristate
	depends on NF_CONNTRACK && NF_NAT
	default NF_NAT && NF_CONNTRACK_SIP

# mangle + specific targets
config IP_NF_MANGLE
	tristate "Packet mangling"
	default m if NETFILTER_ADVANCED=n
	help
	  This option adds a `mangle' table to iptables: see the man page for
	  iptables(8).  This table is used for various packet alterations
	  which can effect how the packet is routed.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_CLUSTERIP
	tristate "CLUSTERIP target support (EXPERIMENTAL)"
	depends on IP_NF_MANGLE && EXPERIMENTAL
	depends on NF_CONNTRACK_IPV4
	depends on NETFILTER_ADVANCED
	select NF_CONNTRACK_MARK
	help
	  The CLUSTERIP target allows you to build load-balancing clusters of
	  network servers without having a dedicated load-balancing
	  router/server/switch.
	
	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_ECN
	tristate "ECN target support"
	depends on IP_NF_MANGLE
	depends on NETFILTER_ADVANCED
	---help---
	  This option adds a `ECN' target, which can be used in the iptables mangle
	  table.  

	  You can use this target to remove the ECN bits from the IPv4 header of
	  an IP packet.  This is particularly useful, if you need to work around
	  existing ECN blackholes on the internet, but don't want to disable
	  ECN support in general.

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_TARGET_TTL
	tristate '"TTL" target support'
	depends on NETFILTER_ADVANCED
	select NETFILTER_XT_TARGET_HL
	---help---
	This is a backwards-compat option for the user's convenience
	(e.g. when running oldconfig). It selects
	CONFIG_NETFILTER_XT_TARGET_HL.

# raw + specific targets
config IP_NF_RAW
	tristate  'raw table support (required for NOTRACK/TRACE)'
	depends on NETFILTER_ADVANCED
	help
	  This option adds a `raw' table to iptables. This table is the very
	  first in the netfilter framework and hooks in at the PREROUTING
	  and OUTPUT chains.
	
	  If you want to compile it as a module, say M here and read
	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.

# security table for MAC policy
config IP_NF_SECURITY
	tristate "Security table"
	depends on SECURITY
	depends on NETFILTER_ADVANCED
	help
	  This option adds a `security' table to iptables, for use
	  with Mandatory Access Control (MAC) policy.
	 
	  If unsure, say N.

endif # IP_NF_IPTABLES

# ARP tables
config IP_NF_ARPTABLES
	tristate "ARP tables support"
	select NETFILTER_XTABLES
	depends on NETFILTER_ADVANCED
	help
	  arptables is a general, extensible packet identification framework.
	  The ARP packet filtering and mangling (manipulation)subsystems
	  use this: say Y or M here if you want to use either of those.

	  To compile it as a module, choose M here.  If unsure, say N.

if IP_NF_ARPTABLES

config IP_NF_ARPFILTER
	tristate "ARP packet filtering"
	help
	  ARP packet filtering defines a table `filter', which has a series of
	  rules for simple ARP packet filtering at local input and
	  local output.  On a bridge, you can also specify filtering rules
	  for forwarded ARP packets. See the man page for arptables(8).

	  To compile it as a module, choose M here.  If unsure, say N.

config IP_NF_ARP_MANGLE
	tristate "ARP payload mangling"
	help
	  Allows altering the ARP packet payload: source and destination
	  hardware and network addresses.

endif # IP_NF_ARPTABLES

endmenu
Commit	Line	Data
1da177e4 LT	1	#
	2	# IP netfilter configuration
	3	#
	4
	5	menu "IP: Netfilter Configuration"
	6	depends on INET && NETFILTER
	7
73e4022f KK	8	config NF_DEFRAG_IPV4
	9	tristate
	10	default n
	11
9fb9cbb1	12	config NF_CONNTRACK_IPV4
c9386cfd PM	13	tristate "IPv4 connection tracking support (required for NAT)"
c9386cfd PM	14	depends on NF_CONNTRACK
33b8e776	15	default m if NETFILTER_ADVANCED=n
73e4022f	16	select NF_DEFRAG_IPV4
9fb9cbb1 YK	17	---help---
	18	Connection tracking keeps a record of what packets have passed
	19	through your machine, in order to figure out how they are related
	20	into connections.
	21
	22	This is IPv4 support on Layer 3 independent connection tracking.
	23	Layer 3 independent connection tracking is experimental scheme
	24	which generalize ip_conntrack to support other layer 3 protocols.
	25
	26	To compile it as a module, choose M here. If unsure, say N.
	27
a999e683 PM	28	config NF_CONNTRACK_PROC_COMPAT
a999e683 PM	29	bool "proc/sysctl compatibility with old connection tracking"
0c4ca1bd	30	depends on NF_CONNTRACK_IPV4
a999e683 PM	31	default y
	32	help
	33	This option enables /proc and sysctl compatibility with the old
67c0d579	34	layer 3 dependent connection tracking. This is needed to keep
a999e683 PM	35	old programs that have not been adapted to the new names working.
	36
	37	If unsure, say Y.
	38
1da177e4	39	config IP_NF_QUEUE
7af4cc3f	40	tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
33b8e776	41	depends on NETFILTER_ADVANCED
1da177e4 LT	42	help
	43	Netfilter has the ability to queue packets to user space: the
	44	netlink device can be used to access them using this driver.
	45
7af4cc3f HW	46	This option enables the old IPv4-only "ip_queue" implementation
	47	which has been obsoleted by the new "nfnetlink_queue" code (see
	48	CONFIG_NETFILTER_NETLINK_QUEUE).
	49
1da177e4 LT	50	To compile it as a module, choose M here. If unsure, say N.
	51
	52	config IP_NF_IPTABLES
	53	tristate "IP tables support (required for filtering/masq/NAT)"
33b8e776	54	default m if NETFILTER_ADVANCED=n
a3c941b0	55	select NETFILTER_XTABLES
1da177e4 LT	56	help
	57	iptables is a general, extensible packet identification framework.
	58	The packet filtering and full NAT (masquerading, port forwarding,
	59	etc) subsystems now use this: say `Y' or `M' here if you want to use
	60	either of those.
	61
	62	To compile it as a module, choose M here. If unsure, say N.
	63
c2df73de JE	64	if IP_NF_IPTABLES
c2df73de JE	65
1da177e4	66	# The matches.
aba0d348 JE	67	config IP_NF_MATCH_ADDRTYPE
aba0d348 JE	68	tristate '"addrtype" address type match support'
33b8e776	69	depends on NETFILTER_ADVANCED
1da177e4	70	help
aba0d348 JE	71	This option allows you to match what routing thinks of an address,
aba0d348 JE	72	eg. UNICAST, LOCAL, BROADCAST, ...
1da177e4	73
aba0d348 JE	74	If you want to compile it as a module, say M here and read
aba0d348 JE	75	<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1da177e4	76
dc5ab2fa	77	config IP_NF_MATCH_AH
4c37799c	78	tristate '"ah" match support'
33b8e776	79	depends on NETFILTER_ADVANCED
1da177e4	80	help
dc5ab2fa YK	81	This match extension allows you to match a range of SPIs
dc5ab2fa YK	82	inside AH header of IPSec packets.
1da177e4 LT	83
	84	To compile it as a module, choose M here. If unsure, say N.
	85
aba0d348 JE	86	config IP_NF_MATCH_ECN
aba0d348 JE	87	tristate '"ecn" match support'
33b8e776	88	depends on NETFILTER_ADVANCED
1da177e4	89	help
aba0d348 JE	90	This option adds a `ECN' match, which allows you to match against
aba0d348 JE	91	the IPv4 and TCP header ECN fields.
1da177e4 LT	92
	93	To compile it as a module, choose M here. If unsure, say N.
	94
4323362e JE	95	config IP_NF_MATCH_TTL
	96	tristate '"ttl" match support'
	97	depends on NETFILTER_ADVANCED
	98	select NETFILTER_XT_MATCH_HL
	99	---help---
	100	This is a backwards-compat option for the user's convenience
	101	(e.g. when running oldconfig). It selects
67c0d579	102	CONFIG_NETFILTER_XT_MATCH_HL.
4323362e	103
1da177e4 LT	104	# `filter', generic and specific targets
	105	config IP_NF_FILTER
	106	tristate "Packet filtering"
33b8e776	107	default m if NETFILTER_ADVANCED=n
1da177e4 LT	108	help
	109	Packet filtering defines a table `filter', which has a series of
	110	rules for simple packet filtering at local input, forwarding and
	111	local output. See the man page for iptables(8).
	112
	113	To compile it as a module, choose M here. If unsure, say N.
	114
	115	config IP_NF_TARGET_REJECT
	116	tristate "REJECT target support"
	117	depends on IP_NF_FILTER
33b8e776	118	default m if NETFILTER_ADVANCED=n
1da177e4 LT	119	help
	120	The REJECT target allows a filtering rule to specify that an ICMP
	121	error should be issued in response to an incoming packet, rather
	122	than silently being dropped.
	123
	124	To compile it as a module, choose M here. If unsure, say N.
	125
	126	config IP_NF_TARGET_LOG
	127	tristate "LOG target support"
33b8e776	128	default m if NETFILTER_ADVANCED=n
1da177e4 LT	129	help
	130	This option adds a `LOG' target, which allows you to create rules in
	131	any iptables table which records the packet header to the syslog.
	132
	133	To compile it as a module, choose M here. If unsure, say N.
	134
	135	config IP_NF_TARGET_ULOG
44adf28f	136	tristate "ULOG target support"
33b8e776	137	default m if NETFILTER_ADVANCED=n
1da177e4	138	---help---
f40863ce HW	139
	140	This option enables the old IPv4-only "ipt_ULOG" implementation
	141	which has been obsoleted by the new "nfnetlink_log" code (see
	142	CONFIG_NETFILTER_NETLINK_LOG).
	143
1da177e4 LT	144	This option adds a `ULOG' target, which allows you to create rules in
	145	any iptables table. The packet is passed to a userspace logging
	146	daemon using netlink multicast sockets; unlike the LOG target
	147	which can only be viewed through syslog.
	148
44c09201	149	The appropriate userspace logging daemon (ulogd) may be obtained from
631dd1a8	150	<http://www.netfilter.org/projects/ulogd/index.html>
1da177e4 LT	151
	152	To compile it as a module, choose M here. If unsure, say N.
	153
5b1158e9 JK	154	# NAT + specific targets: nf_conntrack
	155	config NF_NAT
	156	tristate "Full NAT"
c2df73de	157	depends on NF_CONNTRACK_IPV4
33b8e776	158	default m if NETFILTER_ADVANCED=n
5b1158e9 JK	159	help
	160	The Full NAT option allows masquerading, port forwarding and other
	161	forms of full Network Address Port Translation. It is controlled by
	162	the `nat' table in iptables: see the man page for iptables(8).
	163
	164	To compile it as a module, choose M here. If unsure, say N.
	165
5b1158e9 JK	166	config NF_NAT_NEEDED
	167	bool
	168	depends on NF_NAT
1da177e4 LT	169	default y
	170
	171	config IP_NF_TARGET_MASQUERADE
	172	tristate "MASQUERADE target support"
587aa641	173	depends on NF_NAT
33b8e776	174	default m if NETFILTER_ADVANCED=n
1da177e4 LT	175	help
	176	Masquerading is a special case of NAT: all outgoing connections are
	177	changed to seem to come from a particular interface's address, and
	178	if the interface goes down, those connections are lost. This is
	179	only useful for dialup accounts with dynamic IP address (ie. your IP
	180	address will be different on next dialup).
	181
	182	To compile it as a module, choose M here. If unsure, say N.
	183
aba0d348 JE	184	config IP_NF_TARGET_NETMAP
aba0d348 JE	185	tristate "NETMAP target support"
587aa641	186	depends on NF_NAT
33b8e776	187	depends on NETFILTER_ADVANCED
1da177e4	188	help
aba0d348 JE	189	NETMAP is an implementation of static 1:1 NAT mapping of network
	190	addresses. It maps the network address part, while keeping the host
	191	address part intact.
1da177e4 LT	192
	193	To compile it as a module, choose M here. If unsure, say N.
	194
aba0d348 JE	195	config IP_NF_TARGET_REDIRECT
aba0d348 JE	196	tristate "REDIRECT target support"
587aa641	197	depends on NF_NAT
33b8e776	198	depends on NETFILTER_ADVANCED
1da177e4	199	help
aba0d348 JE	200	REDIRECT is a special case of NAT: all incoming connections are
	201	mapped onto the incoming interface's address, causing the packets to
	202	come to the local machine instead of passing through. This is
	203	useful for transparent proxies.
1da177e4 LT	204
	205	To compile it as a module, choose M here. If unsure, say N.
	206
807467c2	207	config NF_NAT_SNMP_BASIC
8ce22fca PM	208	tristate "Basic SNMP-ALG support"
8ce22fca PM	209	depends on NF_NAT
33b8e776	210	depends on NETFILTER_ADVANCED
807467c2 PM	211	---help---
	212
	213	This module implements an Application Layer Gateway (ALG) for
	214	SNMP payloads. In conjunction with NAT, it allows a network
1da177e4 LT	215	management system to access multiple private networks with
	216	conflicting addresses. It works by modifying IP addresses
	217	inside SNMP payloads to match IP-layer NAT mapping.
	218
	219	This is the "basic" form of SNMP-ALG, as described in RFC 2962
	220
	221	To compile it as a module, choose M here. If unsure, say N.
	222
55a73324 JK	223	# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
	224	# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
	225	# From kconfig-language.txt:
	226	#
	227	# <expr> '&&' <expr> (6)
	228	#
	229	# (6) Returns the result of min(/expr/, /expr/).
4910a087 PM	230	config NF_NAT_PROTO_DCCP
	231	tristate
	232	depends on NF_NAT && NF_CT_PROTO_DCCP
	233	default NF_NAT && NF_CT_PROTO_DCCP
	234
f09943fe PM	235	config NF_NAT_PROTO_GRE
	236	tristate
	237	depends on NF_NAT && NF_CT_PROTO_GRE
	238
6185f870 PM	239	config NF_NAT_PROTO_UDPLITE
	240	tristate
	241	depends on NF_NAT && NF_CT_PROTO_UDPLITE
	242	default NF_NAT && NF_CT_PROTO_UDPLITE
	243
9d908a69 PM	244	config NF_NAT_PROTO_SCTP
	245	tristate
	246	default NF_NAT && NF_CT_PROTO_SCTP
	247	depends on NF_NAT && NF_CT_PROTO_SCTP
4e9d8a70	248	select LIBCRC32C
9d908a69	249
55a73324 JK	250	config NF_NAT_FTP
55a73324 JK	251	tristate
c2df73de	252	depends on NF_CONNTRACK && NF_NAT
55a73324 JK	253	default NF_NAT && NF_CONNTRACK_FTP
55a73324 JK	254
869f37d8 PM	255	config NF_NAT_IRC
869f37d8 PM	256	tristate
c2df73de	257	depends on NF_CONNTRACK && NF_NAT
869f37d8 PM	258	default NF_NAT && NF_CONNTRACK_IRC
869f37d8 PM	259
a536df35 PM	260	config NF_NAT_TFTP
a536df35 PM	261	tristate
c2df73de	262	depends on NF_CONNTRACK && NF_NAT
a536df35 PM	263	default NF_NAT && NF_CONNTRACK_TFTP
a536df35 PM	264
16958900 PM	265	config NF_NAT_AMANDA
16958900 PM	266	tristate
c2df73de	267	depends on NF_CONNTRACK && NF_NAT
16958900 PM	268	default NF_NAT && NF_CONNTRACK_AMANDA
16958900 PM	269
f09943fe PM	270	config NF_NAT_PPTP
f09943fe PM	271	tristate
c2df73de	272	depends on NF_CONNTRACK && NF_NAT
f09943fe PM	273	default NF_NAT && NF_CONNTRACK_PPTP
	274	select NF_NAT_PROTO_GRE
	275
f587de0e PM	276	config NF_NAT_H323
f587de0e PM	277	tristate
c2df73de	278	depends on NF_CONNTRACK && NF_NAT
f587de0e PM	279	default NF_NAT && NF_CONNTRACK_H323
f587de0e PM	280
9fafcd7b PM	281	config NF_NAT_SIP
9fafcd7b PM	282	tristate
c2df73de	283	depends on NF_CONNTRACK && NF_NAT
9fafcd7b PM	284	default NF_NAT && NF_CONNTRACK_SIP
9fafcd7b PM	285
1da177e4 LT	286	# mangle + specific targets
	287	config IP_NF_MANGLE
	288	tristate "Packet mangling"
33b8e776	289	default m if NETFILTER_ADVANCED=n
1da177e4 LT	290	help
	291	This option adds a `mangle' table to iptables: see the man page for
	292	iptables(8). This table is used for various packet alterations
	293	which can effect how the packet is routed.
	294
	295	To compile it as a module, choose M here. If unsure, say N.
	296
aba0d348 JE	297	config IP_NF_TARGET_CLUSTERIP
	298	tristate "CLUSTERIP target support (EXPERIMENTAL)"
	299	depends on IP_NF_MANGLE && EXPERIMENTAL
	300	depends on NF_CONNTRACK_IPV4
	301	depends on NETFILTER_ADVANCED
	302	select NF_CONNTRACK_MARK
	303	help
	304	The CLUSTERIP target allows you to build load-balancing clusters of
	305	network servers without having a dedicated load-balancing
	306	router/server/switch.
	307
	308	To compile it as a module, choose M here. If unsure, say N.
	309
1da177e4 LT	310	config IP_NF_TARGET_ECN
	311	tristate "ECN target support"
	312	depends on IP_NF_MANGLE
33b8e776	313	depends on NETFILTER_ADVANCED
1da177e4 LT	314	---help---
	315	This option adds a `ECN' target, which can be used in the iptables mangle
	316	table.
	317
	318	You can use this target to remove the ECN bits from the IPv4 header of
	319	an IP packet. This is particularly useful, if you need to work around
	320	existing ECN blackholes on the internet, but don't want to disable
	321	ECN support in general.
	322
	323	To compile it as a module, choose M here. If unsure, say N.
	324
4323362e JE	325	config IP_NF_TARGET_TTL
	326	tristate '"TTL" target support'
	327	depends on NETFILTER_ADVANCED
	328	select NETFILTER_XT_TARGET_HL
	329	---help---
	330	This is a backwards-compat option for the user's convenience
	331	(e.g. when running oldconfig). It selects
67c0d579	332	CONFIG_NETFILTER_XT_TARGET_HL.
4323362e	333
1da177e4 LT	334	# raw + specific targets
	335	config IP_NF_RAW
	336	tristate 'raw table support (required for NOTRACK/TRACE)'
33b8e776	337	depends on NETFILTER_ADVANCED
1da177e4 LT	338	help
	339	This option adds a `raw' table to iptables. This table is the very
	340	first in the netfilter framework and hooks in at the PREROUTING
	341	and OUTPUT chains.
	342
	343	If you want to compile it as a module, say M here and read
e403149c	344	<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
560ee653 JM	345
	346	# security table for MAC policy
	347	config IP_NF_SECURITY
	348	tristate "Security table"
560ee653	349	depends on SECURITY
70eed75d	350	depends on NETFILTER_ADVANCED
560ee653 JM	351	help
	352	This option adds a `security' table to iptables, for use
	353	with Mandatory Access Control (MAC) policy.
	354
	355	If unsure, say N.
1da177e4	356
c2df73de JE	357	endif # IP_NF_IPTABLES
c2df73de JE	358
1da177e4 LT	359	# ARP tables
	360	config IP_NF_ARPTABLES
	361	tristate "ARP tables support"
a3c941b0	362	select NETFILTER_XTABLES
33b8e776	363	depends on NETFILTER_ADVANCED
1da177e4 LT	364	help
	365	arptables is a general, extensible packet identification framework.
	366	The ARP packet filtering and mangling (manipulation)subsystems
	367	use this: say Y or M here if you want to use either of those.
	368
	369	To compile it as a module, choose M here. If unsure, say N.
	370
c2df73de JE	371	if IP_NF_ARPTABLES
c2df73de JE	372
1da177e4 LT	373	config IP_NF_ARPFILTER
1da177e4 LT	374	tristate "ARP packet filtering"
1da177e4 LT	375	help
	376	ARP packet filtering defines a table `filter', which has a series of
	377	rules for simple ARP packet filtering at local input and
	378	local output. On a bridge, you can also specify filtering rules
	379	for forwarded ARP packets. See the man page for arptables(8).
	380
	381	To compile it as a module, choose M here. If unsure, say N.
	382
	383	config IP_NF_ARP_MANGLE
	384	tristate "ARP payload mangling"
1da177e4 LT	385	help
	386	Allows altering the ARP packet payload: source and destination
	387	hardware and network addresses.
	388
c2df73de JE	389	endif # IP_NF_ARPTABLES
c2df73de JE	390
1da177e4 LT	391	endmenu
1da177e4 LT	392