net/ipv4/netfilter/Kconfig

   1 #
   2 # IP netfilter configuration
   3 #
   4
   5 menu "IP: Netfilter Configuration"
   6         depends on INET && NETFILTER
   7
   8 config NF_DEFRAG_IPV4
   9         tristate
  10         default n
  11
  12 config NF_CONNTRACK_IPV4
  13         tristate "IPv4 connection tracking support (required for NAT)"
  14         depends on NF_CONNTRACK
  15         default m if NETFILTER_ADVANCED=n
  16         select NF_DEFRAG_IPV4
  17         ---help---
  18           Connection tracking keeps a record of what packets have passed
  19           through your machine, in order to figure out how they are related
  20           into connections.
  21
  22           This is IPv4 support on Layer 3 independent connection tracking.
  23           Layer 3 independent connection tracking is experimental scheme
  24           which generalize ip_conntrack to support other layer 3 protocols.
  25
  26           To compile it as a module, choose M here.  If unsure, say N.
  27
  28 config NF_CONNTRACK_PROC_COMPAT
  29         bool "proc/sysctl compatibility with old connection tracking"
  30         depends on NF_CONNTRACK_PROCFS && NF_CONNTRACK_IPV4
  31         default y
  32         help
  33           This option enables /proc and sysctl compatibility with the old
  34           layer 3 dependent connection tracking. This is needed to keep
  35           old programs that have not been adapted to the new names working.
  36
  37           If unsure, say Y.
  38
  39 config IP_NF_QUEUE
  40         tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
  41         depends on NETFILTER_ADVANCED
  42         help
  43           Netfilter has the ability to queue packets to user space: the
  44           netlink device can be used to access them using this driver.
  45
  46           This option enables the old IPv4-only "ip_queue" implementation
  47           which has been obsoleted by the new "nfnetlink_queue" code (see
  48           CONFIG_NETFILTER_NETLINK_QUEUE).
  49
  50           To compile it as a module, choose M here.  If unsure, say N.
  51
  52 config IP_NF_IPTABLES
  53         tristate "IP tables support (required for filtering/masq/NAT)"
  54         default m if NETFILTER_ADVANCED=n
  55         select NETFILTER_XTABLES
  56         help
  57           iptables is a general, extensible packet identification framework.
  58           The packet filtering and full NAT (masquerading, port forwarding,
  59           etc) subsystems now use this: say `Y' or `M' here if you want to use
  60           either of those.
  61
  62           To compile it as a module, choose M here.  If unsure, say N.
  63
  64 if IP_NF_IPTABLES
  65
  66 # The matches.
  67 config IP_NF_MATCH_AH
  68         tristate '"ah" match support'
  69         depends on NETFILTER_ADVANCED
  70         help
  71           This match extension allows you to match a range of SPIs
  72           inside AH header of IPSec packets.
  73
  74           To compile it as a module, choose M here.  If unsure, say N.
  75
  76 config IP_NF_MATCH_ECN
  77         tristate '"ecn" match support'
  78         depends on NETFILTER_ADVANCED
  79         select NETFILTER_XT_MATCH_ECN
  80         ---help---
  81         This is a backwards-compat option for the user's convenience
  82         (e.g. when running oldconfig). It selects
  83         CONFIG_NETFILTER_XT_MATCH_ECN.
  84
  85 config IP_NF_MATCH_RPFILTER
  86         tristate '"rpfilter" reverse path filter match support'
  87         depends on NETFILTER_ADVANCED
  88         ---help---
  89           This option allows you to match packets whose replies would
  90           go out via the interface the packet came in.
  91
  92           To compile it as a module, choose M here.  If unsure, say N.
  93           The module will be called ipt_rpfilter.
  94
  95 config IP_NF_MATCH_TTL
  96         tristate '"ttl" match support'
  97         depends on NETFILTER_ADVANCED
  98         select NETFILTER_XT_MATCH_HL
  99         ---help---
 100         This is a backwards-compat option for the user's convenience
 101         (e.g. when running oldconfig). It selects
 102         CONFIG_NETFILTER_XT_MATCH_HL.
 103
 104 # `filter', generic and specific targets
 105 config IP_NF_FILTER
 106         tristate "Packet filtering"
 107         default m if NETFILTER_ADVANCED=n
 108         help
 109           Packet filtering defines a table `filter', which has a series of
 110           rules for simple packet filtering at local input, forwarding and
 111           local output.  See the man page for iptables(8).
 112
 113           To compile it as a module, choose M here.  If unsure, say N.
 114
 115 config IP_NF_TARGET_REJECT
 116         tristate "REJECT target support"
 117         depends on IP_NF_FILTER
 118         default m if NETFILTER_ADVANCED=n
 119         help
 120           The REJECT target allows a filtering rule to specify that an ICMP
 121           error should be issued in response to an incoming packet, rather
 122           than silently being dropped.
 123
 124           To compile it as a module, choose M here.  If unsure, say N.
 125
 126 config IP_NF_TARGET_ULOG
 127         tristate "ULOG target support"
 128         default m if NETFILTER_ADVANCED=n
 129         ---help---
 130
 131           This option enables the old IPv4-only "ipt_ULOG" implementation
 132           which has been obsoleted by the new "nfnetlink_log" code (see
 133           CONFIG_NETFILTER_NETLINK_LOG).
 134
 135           This option adds a `ULOG' target, which allows you to create rules in
 136           any iptables table. The packet is passed to a userspace logging
 137           daemon using netlink multicast sockets; unlike the LOG target
 138           which can only be viewed through syslog.
 139
 140           The appropriate userspace logging daemon (ulogd) may be obtained from
 141           <http://www.netfilter.org/projects/ulogd/index.html>
 142
 143           To compile it as a module, choose M here.  If unsure, say N.
 144
 145 # NAT + specific targets: nf_conntrack
 146 config NF_NAT_IPV4
 147         tristate "IPv4 NAT"
 148         depends on NF_CONNTRACK_IPV4
 149         default m if NETFILTER_ADVANCED=n
 150         select NF_NAT
 151         help
 152           The IPv4 NAT option allows masquerading, port forwarding and other
 153           forms of full Network Address Port Translation.  It is controlled by
 154           the `nat' table in iptables: see the man page for iptables(8).
 155
 156           To compile it as a module, choose M here.  If unsure, say N.
 157
 158 if NF_NAT_IPV4
 159
 160 config IP_NF_TARGET_MASQUERADE
 161         tristate "MASQUERADE target support"
 162         default m if NETFILTER_ADVANCED=n
 163         help
 164           Masquerading is a special case of NAT: all outgoing connections are
 165           changed to seem to come from a particular interface's address, and
 166           if the interface goes down, those connections are lost.  This is
 167           only useful for dialup accounts with dynamic IP address (ie. your IP
 168           address will be different on next dialup).
 169
 170           To compile it as a module, choose M here.  If unsure, say N.
 171
 172 config IP_NF_TARGET_NETMAP
 173         tristate "NETMAP target support"
 174         depends on NETFILTER_ADVANCED
 175         help
 176           NETMAP is an implementation of static 1:1 NAT mapping of network
 177           addresses. It maps the network address part, while keeping the host
 178           address part intact.
 179
 180           To compile it as a module, choose M here.  If unsure, say N.
 181
 182 config IP_NF_TARGET_REDIRECT
 183         tristate "REDIRECT target support"
 184         depends on NETFILTER_ADVANCED
 185         help
 186           REDIRECT is a special case of NAT: all incoming connections are
 187           mapped onto the incoming interface's address, causing the packets to
 188           come to the local machine instead of passing through.  This is
 189           useful for transparent proxies.
 190
 191           To compile it as a module, choose M here.  If unsure, say N.
 192
 193 endif
 194
 195 config NF_NAT_SNMP_BASIC
 196         tristate "Basic SNMP-ALG support"
 197         depends on NF_CONNTRACK_SNMP && NF_NAT_IPV4
 198         depends on NETFILTER_ADVANCED
 199         default NF_NAT && NF_CONNTRACK_SNMP
 200         ---help---
 201
 202           This module implements an Application Layer Gateway (ALG) for
 203           SNMP payloads.  In conjunction with NAT, it allows a network
 204           management system to access multiple private networks with
 205           conflicting addresses.  It works by modifying IP addresses
 206           inside SNMP payloads to match IP-layer NAT mapping.
 207
 208           This is the "basic" form of SNMP-ALG, as described in RFC 2962
 209
 210           To compile it as a module, choose M here.  If unsure, say N.
 211
 212 # If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
 213 # or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
 214 # From kconfig-language.txt:
 215 #
 216 #           <expr> '&&' <expr>                   (6)
 217 #
 218 # (6) Returns the result of min(/expr/, /expr/).
 219
 220 config NF_NAT_PROTO_GRE
 221         tristate
 222         depends on NF_NAT_IPV4 && NF_CT_PROTO_GRE
 223
 224 config NF_NAT_FTP
 225         tristate
 226         depends on NF_CONNTRACK && NF_NAT_IPV4
 227         default NF_NAT_IPV4 && NF_CONNTRACK_FTP
 228
 229 config NF_NAT_IRC
 230         tristate
 231         depends on NF_CONNTRACK && NF_NAT_IPV4
 232         default NF_NAT_IPV4 && NF_CONNTRACK_IRC
 233
 234 config NF_NAT_TFTP
 235         tristate
 236         depends on NF_CONNTRACK && NF_NAT_IPV4
 237         default NF_NAT_IPV4 && NF_CONNTRACK_TFTP
 238
 239 config NF_NAT_AMANDA
 240         tristate
 241         depends on NF_CONNTRACK && NF_NAT_IPV4
 242         default NF_NAT_IPV4 && NF_CONNTRACK_AMANDA
 243
 244 config NF_NAT_PPTP
 245         tristate
 246         depends on NF_CONNTRACK && NF_NAT_IPV4
 247         default NF_NAT_IPV4 && NF_CONNTRACK_PPTP
 248         select NF_NAT_PROTO_GRE
 249
 250 config NF_NAT_H323
 251         tristate
 252         depends on NF_CONNTRACK && NF_NAT_IPV4
 253         default NF_NAT_IPV4 && NF_CONNTRACK_H323
 254
 255 config NF_NAT_SIP
 256         tristate
 257         depends on NF_CONNTRACK && NF_NAT_IPV4
 258         default NF_NAT_IPV4 && NF_CONNTRACK_SIP
 259
 260 # mangle + specific targets
 261 config IP_NF_MANGLE
 262         tristate "Packet mangling"
 263         default m if NETFILTER_ADVANCED=n
 264         help
 265           This option adds a `mangle' table to iptables: see the man page for
 266           iptables(8).  This table is used for various packet alterations
 267           which can effect how the packet is routed.
 268
 269           To compile it as a module, choose M here.  If unsure, say N.
 270
 271 config IP_NF_TARGET_CLUSTERIP
 272         tristate "CLUSTERIP target support (EXPERIMENTAL)"
 273         depends on IP_NF_MANGLE && EXPERIMENTAL
 274         depends on NF_CONNTRACK_IPV4
 275         depends on NETFILTER_ADVANCED
 276         select NF_CONNTRACK_MARK
 277         help
 278           The CLUSTERIP target allows you to build load-balancing clusters of
 279           network servers without having a dedicated load-balancing
 280           router/server/switch.
 281
 282           To compile it as a module, choose M here.  If unsure, say N.
 283
 284 config IP_NF_TARGET_ECN
 285         tristate "ECN target support"
 286         depends on IP_NF_MANGLE
 287         depends on NETFILTER_ADVANCED
 288         ---help---
 289           This option adds a `ECN' target, which can be used in the iptables mangle
 290           table.
 291
 292           You can use this target to remove the ECN bits from the IPv4 header of
 293           an IP packet.  This is particularly useful, if you need to work around
 294           existing ECN blackholes on the internet, but don't want to disable
 295           ECN support in general.
 296
 297           To compile it as a module, choose M here.  If unsure, say N.
 298
 299 config IP_NF_TARGET_TTL
 300         tristate '"TTL" target support'
 301         depends on NETFILTER_ADVANCED && IP_NF_MANGLE
 302         select NETFILTER_XT_TARGET_HL
 303         ---help---
 304         This is a backwards-compatible option for the user's convenience
 305         (e.g. when running oldconfig). It selects
 306         CONFIG_NETFILTER_XT_TARGET_HL.
 307
 308 # raw + specific targets
 309 config IP_NF_RAW
 310         tristate  'raw table support (required for NOTRACK/TRACE)'
 311         help
 312           This option adds a `raw' table to iptables. This table is the very
 313           first in the netfilter framework and hooks in at the PREROUTING
 314           and OUTPUT chains.
 315
 316           If you want to compile it as a module, say M here and read
 317           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 318
 319 # security table for MAC policy
 320 config IP_NF_SECURITY
 321         tristate "Security table"
 322         depends on SECURITY
 323         depends on NETFILTER_ADVANCED
 324         help
 325           This option adds a `security' table to iptables, for use
 326           with Mandatory Access Control (MAC) policy.
 327
 328           If unsure, say N.
 329
 330 endif # IP_NF_IPTABLES
 331
 332 # ARP tables
 333 config IP_NF_ARPTABLES
 334         tristate "ARP tables support"
 335         select NETFILTER_XTABLES
 336         depends on NETFILTER_ADVANCED
 337         help
 338           arptables is a general, extensible packet identification framework.
 339           The ARP packet filtering and mangling (manipulation)subsystems
 340           use this: say Y or M here if you want to use either of those.
 341
 342           To compile it as a module, choose M here.  If unsure, say N.
 343
 344 if IP_NF_ARPTABLES
 345
 346 config IP_NF_ARPFILTER
 347         tristate "ARP packet filtering"
 348         help
 349           ARP packet filtering defines a table `filter', which has a series of
 350           rules for simple ARP packet filtering at local input and
 351           local output.  On a bridge, you can also specify filtering rules
 352           for forwarded ARP packets. See the man page for arptables(8).
 353
 354           To compile it as a module, choose M here.  If unsure, say N.
 355
 356 config IP_NF_ARP_MANGLE
 357         tristate "ARP payload mangling"
 358         help
 359           Allows altering the ARP packet payload: source and destination
 360           hardware and network addresses.
 361
 362 endif # IP_NF_ARPTABLES
 363
 364 endmenu
 365