2 # IP netfilter configuration
5 menu "IPv6: Netfilter Configuration"
6 depends on INET && IPV6 && NETFILTER
8 config NF_CONNTRACK_IPV6
9 tristate "IPv6 connection tracking support"
10 depends on INET && IPV6 && NF_CONNTRACK
11 default m if NETFILTER_ADVANCED=n
13 Connection tracking keeps a record of what packets have passed
14 through your machine, in order to figure out how they are related
17 This is IPv6 support on Layer 3 independent connection tracking.
18 Layer 3 independent connection tracking is experimental scheme
19 which generalize ip_conntrack to support other layer 3 protocols.
21 To compile it as a module, choose M here. If unsure, say N.
24 tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
25 depends on INET && IPV6 && NETFILTER
26 depends on NETFILTER_ADVANCED
29 This option adds a queue handler to the kernel for IPv6
30 packets which enables users to receive the filtered packets
31 with QUEUE target using libipq.
33 This option enables the old IPv6-only "ip6_queue" implementation
34 which has been obsoleted by the new "nfnetlink_queue" code (see
35 CONFIG_NETFILTER_NETLINK_QUEUE).
37 (C) Fernando Anton 2001
38 IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
39 Universidad Carlos III de Madrid
40 Universidad Politecnica de Alcala de Henares
41 email: <fanton@it.uc3m.es>.
43 To compile it as a module, choose M here. If unsure, say N.
45 config IP6_NF_IPTABLES
46 tristate "IP6 tables support (required for filtering)"
47 depends on INET && IPV6
48 select NETFILTER_XTABLES
49 default m if NETFILTER_ADVANCED=n
51 ip6tables is a general, extensible packet identification framework.
52 Currently only the packet filtering and packet mangling subsystem
53 for IPv6 use this, but connection tracking is going to follow.
54 Say 'Y' or 'M' here if you want to use either of those.
56 To compile it as a module, choose M here. If unsure, say N.
59 config IP6_NF_MATCH_AH
60 tristate '"ah" match support'
61 depends on IP6_NF_IPTABLES
62 depends on NETFILTER_ADVANCED
64 This module allows one to match AH packets.
66 To compile it as a module, choose M here. If unsure, say N.
68 config IP6_NF_MATCH_EUI64
69 tristate '"eui64" address check'
70 depends on IP6_NF_IPTABLES
71 depends on NETFILTER_ADVANCED
73 This module performs checking on the IPv6 source address
74 Compares the last 64 bits with the EUI64 (delivered
75 from the MAC address) address
77 To compile it as a module, choose M here. If unsure, say N.
79 config IP6_NF_MATCH_FRAG
80 tristate '"frag" Fragmentation header match support'
81 depends on IP6_NF_IPTABLES
82 depends on NETFILTER_ADVANCED
84 frag matching allows you to match packets based on the fragmentation
87 To compile it as a module, choose M here. If unsure, say N.
89 config IP6_NF_MATCH_OPTS
90 tristate '"hbh" hop-by-hop and "dst" opts header match support'
91 depends on IP6_NF_IPTABLES
92 depends on NETFILTER_ADVANCED
94 This allows one to match packets based on the hop-by-hop
95 and destination options headers of a packet.
97 To compile it as a module, choose M here. If unsure, say N.
99 config IP6_NF_MATCH_HL
100 tristate '"hl" match support'
101 depends on IP6_NF_IPTABLES
102 depends on NETFILTER_ADVANCED
104 HL matching allows you to match packets based on the hop
107 To compile it as a module, choose M here. If unsure, say N.
109 config IP6_NF_MATCH_IPV6HEADER
110 tristate '"ipv6header" IPv6 Extension Headers Match'
111 depends on IP6_NF_IPTABLES
112 default m if NETFILTER_ADVANCED=n
114 This module allows one to match packets based upon
115 the ipv6 extension headers.
117 To compile it as a module, choose M here. If unsure, say N.
119 config IP6_NF_MATCH_MH
120 tristate '"mh" match support'
121 depends on IP6_NF_IPTABLES
122 depends on NETFILTER_ADVANCED
124 This module allows one to match MH packets.
126 To compile it as a module, choose M here. If unsure, say N.
128 config IP6_NF_MATCH_RT
129 tristate '"rt" Routing header match support'
130 depends on IP6_NF_IPTABLES
131 depends on NETFILTER_ADVANCED
133 rt matching allows you to match packets based on the routing
134 header of the packet.
136 To compile it as a module, choose M here. If unsure, say N.
139 config IP6_NF_TARGET_LOG
140 tristate "LOG target support"
141 depends on IP6_NF_IPTABLES
142 default m if NETFILTER_ADVANCED=n
144 This option adds a `LOG' target, which allows you to create rules in
145 any iptables table which records the packet header to the syslog.
147 To compile it as a module, choose M here. If unsure, say N.
150 tristate "Packet filtering"
151 depends on IP6_NF_IPTABLES
152 default m if NETFILTER_ADVANCED=n
154 Packet filtering defines a table `filter', which has a series of
155 rules for simple packet filtering at local input, forwarding and
156 local output. See the man page for iptables(8).
158 To compile it as a module, choose M here. If unsure, say N.
160 config IP6_NF_TARGET_REJECT
161 tristate "REJECT target support"
162 depends on IP6_NF_FILTER
163 default m if NETFILTER_ADVANCED=n
165 The REJECT target allows a filtering rule to specify that an ICMPv6
166 error should be issued in response to an incoming packet, rather
167 than silently being dropped.
169 To compile it as a module, choose M here. If unsure, say N.
172 tristate "Packet mangling"
173 depends on IP6_NF_IPTABLES
174 default m if NETFILTER_ADVANCED=n
176 This option adds a `mangle' table to iptables: see the man page for
177 iptables(8). This table is used for various packet alterations
178 which can effect how the packet is routed.
180 To compile it as a module, choose M here. If unsure, say N.
182 config IP6_NF_TARGET_HL
183 tristate 'HL (hoplimit) target support'
184 depends on IP6_NF_MANGLE
185 depends on NETFILTER_ADVANCED
187 This option adds a `HL' target, which enables the user to decrement
188 the hoplimit value of the IPv6 header or set it to a given (lower)
191 While it is safe to decrement the hoplimit value, this option also
192 enables functionality to increment and set the hoplimit value of the
193 IPv6 header to arbitrary values. This is EXTREMELY DANGEROUS since
194 you can easily create immortal packets that loop forever on the
197 To compile it as a module, choose M here. If unsure, say N.
200 tristate 'raw table support (required for TRACE)'
201 depends on IP6_NF_IPTABLES
202 depends on NETFILTER_ADVANCED
204 This option adds a `raw' table to ip6tables. This table is the very
205 first in the netfilter framework and hooks in at the PREROUTING
208 If you want to compile it as a module, say M here and read
209 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
211 # security table for MAC policy
212 config IP6_NF_SECURITY
213 tristate "Security table"
214 depends on IP6_NF_IPTABLES
216 depends on NETFILTER_ADVANCED
218 This option adds a `security' table to iptables, for use
219 with Mandatory Access Control (MAC) policy.