net/ipv4/netfilter/Kconfig

   1 #
   2 # IP netfilter configuration
   3 #
   4
   5 menu "IP: Netfilter Configuration"
   6         depends on INET && NETFILTER
   7
   8 config NF_DEFRAG_IPV4
   9         tristate
  10         default n
  11
  12 config NF_CONNTRACK_IPV4
  13         tristate "IPv4 connection tracking support (required for NAT)"
  14         depends on NF_CONNTRACK
  15         default m if NETFILTER_ADVANCED=n
  16         select NF_DEFRAG_IPV4
  17         ---help---
  18           Connection tracking keeps a record of what packets have passed
  19           through your machine, in order to figure out how they are related
  20           into connections.
  21
  22           This is IPv4 support on Layer 3 independent connection tracking.
  23           Layer 3 independent connection tracking is experimental scheme
  24           which generalize ip_conntrack to support other layer 3 protocols.
  25
  26           To compile it as a module, choose M here.  If unsure, say N.
  27
  28 config NF_CONNTRACK_PROC_COMPAT
  29         bool "proc/sysctl compatibility with old connection tracking"
  30         depends on NF_CONNTRACK_PROCFS && NF_CONNTRACK_IPV4
  31         default y
  32         help
  33           This option enables /proc and sysctl compatibility with the old
  34           layer 3 dependent connection tracking. This is needed to keep
  35           old programs that have not been adapted to the new names working.
  36
  37           If unsure, say Y.
  38
  39 config NF_LOG_ARP
  40         tristate "ARP packet logging"
  41         default m if NETFILTER_ADVANCED=n
  42         select NF_LOG_COMMON
  43
  44 config NF_LOG_IPV4
  45         tristate "IPv4 packet logging"
  46         default m if NETFILTER_ADVANCED=n
  47         select NF_LOG_COMMON
  48
  49 config NF_TABLES_IPV4
  50         depends on NF_TABLES
  51         tristate "IPv4 nf_tables support"
  52         help
  53           This option enables the IPv4 support for nf_tables.
  54
  55 config NFT_CHAIN_ROUTE_IPV4
  56         depends on NF_TABLES_IPV4
  57         tristate "IPv4 nf_tables route chain support"
  58         help
  59           This option enables the "route" chain for IPv4 in nf_tables. This
  60           chain type is used to force packet re-routing after mangling header
  61           fields such as the source, destination, type of service and
  62           the packet mark.
  63
  64 config NFT_REJECT_IPV4
  65         depends on NF_TABLES_IPV4
  66         default NFT_REJECT
  67         tristate
  68
  69 config NF_TABLES_ARP
  70         depends on NF_TABLES
  71         tristate "ARP nf_tables support"
  72         help
  73           This option enables the ARP support for nf_tables.
  74
  75 config NF_NAT_IPV4
  76         tristate "IPv4 NAT"
  77         depends on NF_CONNTRACK_IPV4
  78         default m if NETFILTER_ADVANCED=n
  79         select NF_NAT
  80         help
  81           The IPv4 NAT option allows masquerading, port forwarding and other
  82           forms of full Network Address Port Translation. This can be
  83           controlled by iptables or nft.
  84
  85 if NF_NAT_IPV4
  86
  87 config NFT_CHAIN_NAT_IPV4
  88         depends on NF_TABLES_IPV4
  89         tristate "IPv4 nf_tables nat chain support"
  90         help
  91           This option enables the "nat" chain for IPv4 in nf_tables. This
  92           chain type is used to perform Network Address Translation (NAT)
  93           packet transformations such as the source, destination address and
  94           source and destination ports.
  95
  96 config NF_NAT_SNMP_BASIC
  97         tristate "Basic SNMP-ALG support"
  98         depends on NF_CONNTRACK_SNMP
  99         depends on NETFILTER_ADVANCED
 100         default NF_NAT && NF_CONNTRACK_SNMP
 101         ---help---
 102
 103           This module implements an Application Layer Gateway (ALG) for
 104           SNMP payloads.  In conjunction with NAT, it allows a network
 105           management system to access multiple private networks with
 106           conflicting addresses.  It works by modifying IP addresses
 107           inside SNMP payloads to match IP-layer NAT mapping.
 108
 109           This is the "basic" form of SNMP-ALG, as described in RFC 2962
 110
 111           To compile it as a module, choose M here.  If unsure, say N.
 112
 113 config NF_NAT_PROTO_GRE
 114         tristate
 115         depends on NF_CT_PROTO_GRE
 116
 117 config NF_NAT_PPTP
 118         tristate
 119         depends on NF_CONNTRACK
 120         default NF_CONNTRACK_PPTP
 121         select NF_NAT_PROTO_GRE
 122
 123 config NF_NAT_H323
 124         tristate
 125         depends on NF_CONNTRACK
 126         default NF_CONNTRACK_H323
 127
 128 endif # NF_NAT_IPV4
 129
 130 config IP_NF_IPTABLES
 131         tristate "IP tables support (required for filtering/masq/NAT)"
 132         default m if NETFILTER_ADVANCED=n
 133         select NETFILTER_XTABLES
 134         help
 135           iptables is a general, extensible packet identification framework.
 136           The packet filtering and full NAT (masquerading, port forwarding,
 137           etc) subsystems now use this: say `Y' or `M' here if you want to use
 138           either of those.
 139
 140           To compile it as a module, choose M here.  If unsure, say N.
 141
 142 if IP_NF_IPTABLES
 143
 144 # The matches.
 145 config IP_NF_MATCH_AH
 146         tristate '"ah" match support'
 147         depends on NETFILTER_ADVANCED
 148         help
 149           This match extension allows you to match a range of SPIs
 150           inside AH header of IPSec packets.
 151
 152           To compile it as a module, choose M here.  If unsure, say N.
 153
 154 config IP_NF_MATCH_ECN
 155         tristate '"ecn" match support'
 156         depends on NETFILTER_ADVANCED
 157         select NETFILTER_XT_MATCH_ECN
 158         ---help---
 159         This is a backwards-compat option for the user's convenience
 160         (e.g. when running oldconfig). It selects
 161         CONFIG_NETFILTER_XT_MATCH_ECN.
 162
 163 config IP_NF_MATCH_RPFILTER
 164         tristate '"rpfilter" reverse path filter match support'
 165         depends on NETFILTER_ADVANCED && (IP_NF_MANGLE || IP_NF_RAW)
 166         ---help---
 167           This option allows you to match packets whose replies would
 168           go out via the interface the packet came in.
 169
 170           To compile it as a module, choose M here.  If unsure, say N.
 171           The module will be called ipt_rpfilter.
 172
 173 config IP_NF_MATCH_TTL
 174         tristate '"ttl" match support'
 175         depends on NETFILTER_ADVANCED
 176         select NETFILTER_XT_MATCH_HL
 177         ---help---
 178         This is a backwards-compat option for the user's convenience
 179         (e.g. when running oldconfig). It selects
 180         CONFIG_NETFILTER_XT_MATCH_HL.
 181
 182 # `filter', generic and specific targets
 183 config IP_NF_FILTER
 184         tristate "Packet filtering"
 185         default m if NETFILTER_ADVANCED=n
 186         help
 187           Packet filtering defines a table `filter', which has a series of
 188           rules for simple packet filtering at local input, forwarding and
 189           local output.  See the man page for iptables(8).
 190
 191           To compile it as a module, choose M here.  If unsure, say N.
 192
 193 config IP_NF_TARGET_REJECT
 194         tristate "REJECT target support"
 195         depends on IP_NF_FILTER
 196         default m if NETFILTER_ADVANCED=n
 197         help
 198           The REJECT target allows a filtering rule to specify that an ICMP
 199           error should be issued in response to an incoming packet, rather
 200           than silently being dropped.
 201
 202           To compile it as a module, choose M here.  If unsure, say N.
 203
 204 config IP_NF_TARGET_SYNPROXY
 205         tristate "SYNPROXY target support"
 206         depends on NF_CONNTRACK && NETFILTER_ADVANCED
 207         select NETFILTER_SYNPROXY
 208         select SYN_COOKIES
 209         help
 210           The SYNPROXY target allows you to intercept TCP connections and
 211           establish them using syncookies before they are passed on to the
 212           server. This allows to avoid conntrack and server resource usage
 213           during SYN-flood attacks.
 214
 215           To compile it as a module, choose M here. If unsure, say N.
 216
 217 # NAT + specific targets: nf_conntrack
 218 config IP_NF_NAT
 219         tristate "iptables NAT support"
 220         depends on NF_CONNTRACK_IPV4
 221         default m if NETFILTER_ADVANCED=n
 222         select NF_NAT
 223         select NF_NAT_IPV4
 224         select NETFILTER_XT_NAT
 225         help
 226           This enables the `nat' table in iptables. This allows masquerading,
 227           port forwarding and other forms of full Network Address Port
 228           Translation.
 229
 230           To compile it as a module, choose M here.  If unsure, say N.
 231
 232 if IP_NF_NAT
 233
 234 config NF_NAT_MASQUERADE_IPV4
 235         tristate "IPv4 masquerade support"
 236         help
 237         This is the kernel functionality to provide NAT in the masquerade
 238         flavour (automatic source address selection).
 239
 240 config NFT_MASQ_IPV4
 241         tristate "IPv4 masquerading support for nf_tables"
 242         depends on NF_TABLES_IPV4
 243         depends on NFT_MASQ
 244         select NF_NAT_MASQUERADE_IPV4
 245
 246 config IP_NF_TARGET_MASQUERADE
 247         tristate "MASQUERADE target support"
 248         select NF_NAT_MASQUERADE_IPV4
 249         default m if NETFILTER_ADVANCED=n
 250         help
 251           Masquerading is a special case of NAT: all outgoing connections are
 252           changed to seem to come from a particular interface's address, and
 253           if the interface goes down, those connections are lost.  This is
 254           only useful for dialup accounts with dynamic IP address (ie. your IP
 255           address will be different on next dialup).
 256
 257           To compile it as a module, choose M here.  If unsure, say N.
 258
 259 config IP_NF_TARGET_NETMAP
 260         tristate "NETMAP target support"
 261         depends on NETFILTER_ADVANCED
 262         select NETFILTER_XT_TARGET_NETMAP
 263         ---help---
 264         This is a backwards-compat option for the user's convenience
 265         (e.g. when running oldconfig). It selects
 266         CONFIG_NETFILTER_XT_TARGET_NETMAP.
 267
 268 config IP_NF_TARGET_REDIRECT
 269         tristate "REDIRECT target support"
 270         depends on NETFILTER_ADVANCED
 271         select NETFILTER_XT_TARGET_REDIRECT
 272         ---help---
 273         This is a backwards-compat option for the user's convenience
 274         (e.g. when running oldconfig). It selects
 275         CONFIG_NETFILTER_XT_TARGET_REDIRECT.
 276
 277 endif # IP_NF_NAT
 278
 279 # mangle + specific targets
 280 config IP_NF_MANGLE
 281         tristate "Packet mangling"
 282         default m if NETFILTER_ADVANCED=n
 283         help
 284           This option adds a `mangle' table to iptables: see the man page for
 285           iptables(8).  This table is used for various packet alterations
 286           which can effect how the packet is routed.
 287
 288           To compile it as a module, choose M here.  If unsure, say N.
 289
 290 config IP_NF_TARGET_CLUSTERIP
 291         tristate "CLUSTERIP target support"
 292         depends on IP_NF_MANGLE
 293         depends on NF_CONNTRACK_IPV4
 294         depends on NETFILTER_ADVANCED
 295         select NF_CONNTRACK_MARK
 296         help
 297           The CLUSTERIP target allows you to build load-balancing clusters of
 298           network servers without having a dedicated load-balancing
 299           router/server/switch.
 300
 301           To compile it as a module, choose M here.  If unsure, say N.
 302
 303 config IP_NF_TARGET_ECN
 304         tristate "ECN target support"
 305         depends on IP_NF_MANGLE
 306         depends on NETFILTER_ADVANCED
 307         ---help---
 308           This option adds a `ECN' target, which can be used in the iptables mangle
 309           table.
 310
 311           You can use this target to remove the ECN bits from the IPv4 header of
 312           an IP packet.  This is particularly useful, if you need to work around
 313           existing ECN blackholes on the internet, but don't want to disable
 314           ECN support in general.
 315
 316           To compile it as a module, choose M here.  If unsure, say N.
 317
 318 config IP_NF_TARGET_TTL
 319         tristate '"TTL" target support'
 320         depends on NETFILTER_ADVANCED && IP_NF_MANGLE
 321         select NETFILTER_XT_TARGET_HL
 322         ---help---
 323         This is a backwards-compatible option for the user's convenience
 324         (e.g. when running oldconfig). It selects
 325         CONFIG_NETFILTER_XT_TARGET_HL.
 326
 327 # raw + specific targets
 328 config IP_NF_RAW
 329         tristate  'raw table support (required for NOTRACK/TRACE)'
 330         help
 331           This option adds a `raw' table to iptables. This table is the very
 332           first in the netfilter framework and hooks in at the PREROUTING
 333           and OUTPUT chains.
 334
 335           If you want to compile it as a module, say M here and read
 336           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 337
 338 # security table for MAC policy
 339 config IP_NF_SECURITY
 340         tristate "Security table"
 341         depends on SECURITY
 342         depends on NETFILTER_ADVANCED
 343         help
 344           This option adds a `security' table to iptables, for use
 345           with Mandatory Access Control (MAC) policy.
 346
 347           If unsure, say N.
 348
 349 endif # IP_NF_IPTABLES
 350
 351 # ARP tables
 352 config IP_NF_ARPTABLES
 353         tristate "ARP tables support"
 354         select NETFILTER_XTABLES
 355         depends on NETFILTER_ADVANCED
 356         help
 357           arptables is a general, extensible packet identification framework.
 358           The ARP packet filtering and mangling (manipulation)subsystems
 359           use this: say Y or M here if you want to use either of those.
 360
 361           To compile it as a module, choose M here.  If unsure, say N.
 362
 363 if IP_NF_ARPTABLES
 364
 365 config IP_NF_ARPFILTER
 366         tristate "ARP packet filtering"
 367         help
 368           ARP packet filtering defines a table `filter', which has a series of
 369           rules for simple ARP packet filtering at local input and
 370           local output.  On a bridge, you can also specify filtering rules
 371           for forwarded ARP packets. See the man page for arptables(8).
 372
 373           To compile it as a module, choose M here.  If unsure, say N.
 374
 375 config IP_NF_ARP_MANGLE
 376         tristate "ARP payload mangling"
 377         help
 378           Allows altering the ARP packet payload: source and destination
 379           hardware and network addresses.
 380
 381 endif # IP_NF_ARPTABLES
 382
 383 endmenu
 384