Loading...
1#
2# IP netfilter configuration
3#
4
5menu "IPv6: Netfilter Configuration"
6 depends on INET && IPV6 && NETFILTER
7
8config NF_DEFRAG_IPV6
9 tristate
10 default n
11
12config NF_CONNTRACK_IPV6
13 tristate "IPv6 connection tracking support"
14 depends on INET && IPV6 && NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
16 select NF_DEFRAG_IPV6
17 ---help---
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
20 into connections.
21
22 This is IPv6 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
25
26 To compile it as a module, choose M here. If unsure, say N.
27
28config IP6_NF_QUEUE
29 tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
30 depends on INET && IPV6 && NETFILTER
31 depends on NETFILTER_ADVANCED
32 ---help---
33
34 This option adds a queue handler to the kernel for IPv6
35 packets which enables users to receive the filtered packets
36 with QUEUE target using libipq.
37
38 This option enables the old IPv6-only "ip6_queue" implementation
39 which has been obsoleted by the new "nfnetlink_queue" code (see
40 CONFIG_NETFILTER_NETLINK_QUEUE).
41
42 (C) Fernando Anton 2001
43 IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
44 Universidad Carlos III de Madrid
45 Universidad Politecnica de Alcala de Henares
46 email: <fanton@it.uc3m.es>.
47
48 To compile it as a module, choose M here. If unsure, say N.
49
50config IP6_NF_IPTABLES
51 tristate "IP6 tables support (required for filtering)"
52 depends on INET && IPV6
53 select NETFILTER_XTABLES
54 default m if NETFILTER_ADVANCED=n
55 help
56 ip6tables is a general, extensible packet identification framework.
57 Currently only the packet filtering and packet mangling subsystem
58 for IPv6 use this, but connection tracking is going to follow.
59 Say 'Y' or 'M' here if you want to use either of those.
60
61 To compile it as a module, choose M here. If unsure, say N.
62
63if IP6_NF_IPTABLES
64
65# The simple matches.
66config IP6_NF_MATCH_AH
67 tristate '"ah" match support'
68 depends on NETFILTER_ADVANCED
69 help
70 This module allows one to match AH packets.
71
72 To compile it as a module, choose M here. If unsure, say N.
73
74config IP6_NF_MATCH_EUI64
75 tristate '"eui64" address check'
76 depends on NETFILTER_ADVANCED
77 help
78 This module performs checking on the IPv6 source address
79 Compares the last 64 bits with the EUI64 (delivered
80 from the MAC address) address
81
82 To compile it as a module, choose M here. If unsure, say N.
83
84config IP6_NF_MATCH_FRAG
85 tristate '"frag" Fragmentation header match support'
86 depends on NETFILTER_ADVANCED
87 help
88 frag matching allows you to match packets based on the fragmentation
89 header of the packet.
90
91 To compile it as a module, choose M here. If unsure, say N.
92
93config IP6_NF_MATCH_OPTS
94 tristate '"hbh" hop-by-hop and "dst" opts header match support'
95 depends on NETFILTER_ADVANCED
96 help
97 This allows one to match packets based on the hop-by-hop
98 and destination options headers of a packet.
99
100 To compile it as a module, choose M here. If unsure, say N.
101
102config IP6_NF_MATCH_HL
103 tristate '"hl" hoplimit match support'
104 depends on NETFILTER_ADVANCED
105 select NETFILTER_XT_MATCH_HL
106 ---help---
107 This is a backwards-compat option for the user's convenience
108 (e.g. when running oldconfig). It selects
109 CONFIG_NETFILTER_XT_MATCH_HL.
110
111config IP6_NF_MATCH_IPV6HEADER
112 tristate '"ipv6header" IPv6 Extension Headers Match'
113 default m if NETFILTER_ADVANCED=n
114 help
115 This module allows one to match packets based upon
116 the ipv6 extension headers.
117
118 To compile it as a module, choose M here. If unsure, say N.
119
120config IP6_NF_MATCH_MH
121 tristate '"mh" match support'
122 depends on NETFILTER_ADVANCED
123 help
124 This module allows one to match MH packets.
125
126 To compile it as a module, choose M here. If unsure, say N.
127
128config IP6_NF_MATCH_RT
129 tristate '"rt" Routing header match support'
130 depends on NETFILTER_ADVANCED
131 help
132 rt matching allows you to match packets based on the routing
133 header of the packet.
134
135 To compile it as a module, choose M here. If unsure, say N.
136
137# The targets
138config IP6_NF_TARGET_HL
139 tristate '"HL" hoplimit target support'
140 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
141 select NETFILTER_XT_TARGET_HL
142 ---help---
143 This is a backwards-compatible option for the user's convenience
144 (e.g. when running oldconfig). It selects
145 CONFIG_NETFILTER_XT_TARGET_HL.
146
147config IP6_NF_TARGET_LOG
148 tristate "LOG target support"
149 default m if NETFILTER_ADVANCED=n
150 help
151 This option adds a `LOG' target, which allows you to create rules in
152 any iptables table which records the packet header to the syslog.
153
154 To compile it as a module, choose M here. If unsure, say N.
155
156config IP6_NF_FILTER
157 tristate "Packet filtering"
158 default m if NETFILTER_ADVANCED=n
159 help
160 Packet filtering defines a table `filter', which has a series of
161 rules for simple packet filtering at local input, forwarding and
162 local output. See the man page for iptables(8).
163
164 To compile it as a module, choose M here. If unsure, say N.
165
166config IP6_NF_TARGET_REJECT
167 tristate "REJECT target support"
168 depends on IP6_NF_FILTER
169 default m if NETFILTER_ADVANCED=n
170 help
171 The REJECT target allows a filtering rule to specify that an ICMPv6
172 error should be issued in response to an incoming packet, rather
173 than silently being dropped.
174
175 To compile it as a module, choose M here. If unsure, say N.
176
177config IP6_NF_MANGLE
178 tristate "Packet mangling"
179 default m if NETFILTER_ADVANCED=n
180 help
181 This option adds a `mangle' table to iptables: see the man page for
182 iptables(8). This table is used for various packet alterations
183 which can effect how the packet is routed.
184
185 To compile it as a module, choose M here. If unsure, say N.
186
187config IP6_NF_RAW
188 tristate 'raw table support (required for TRACE)'
189 depends on NETFILTER_ADVANCED
190 help
191 This option adds a `raw' table to ip6tables. This table is the very
192 first in the netfilter framework and hooks in at the PREROUTING
193 and OUTPUT chains.
194
195 If you want to compile it as a module, say M here and read
196 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
197
198# security table for MAC policy
199config IP6_NF_SECURITY
200 tristate "Security table"
201 depends on SECURITY
202 depends on NETFILTER_ADVANCED
203 help
204 This option adds a `security' table to iptables, for use
205 with Mandatory Access Control (MAC) policy.
206
207 If unsure, say N.
208
209endif # IP6_NF_IPTABLES
210
211endmenu
212
1# SPDX-License-Identifier: GPL-2.0-only
2#
3# IP netfilter configuration
4#
5
6menu "IPv6: Netfilter Configuration"
7 depends on INET && IPV6 && NETFILTER
8
9config NF_SOCKET_IPV6
10 tristate "IPv6 socket lookup support"
11 help
12 This option enables the IPv6 socket lookup infrastructure. This
13 is used by the {ip6,nf}tables socket match.
14
15config NF_TPROXY_IPV6
16 tristate "IPv6 tproxy support"
17
18if NF_TABLES
19
20config NF_TABLES_IPV6
21 bool "IPv6 nf_tables support"
22 help
23 This option enables the IPv6 support for nf_tables.
24
25if NF_TABLES_IPV6
26
27config NFT_REJECT_IPV6
28 select NF_REJECT_IPV6
29 default NFT_REJECT
30 tristate
31
32config NFT_DUP_IPV6
33 tristate "IPv6 nf_tables packet duplication support"
34 depends on !NF_CONNTRACK || NF_CONNTRACK
35 select NF_DUP_IPV6
36 help
37 This module enables IPv6 packet duplication support for nf_tables.
38
39config NFT_FIB_IPV6
40 tristate "nf_tables fib / ipv6 route lookup support"
41 select NFT_FIB
42 help
43 This module enables IPv6 FIB lookups, e.g. for reverse path filtering.
44 It also allows query of the FIB for the route type, e.g. local, unicast,
45 multicast or blackhole.
46
47endif # NF_TABLES_IPV6
48endif # NF_TABLES
49
50config NF_DUP_IPV6
51 tristate "Netfilter IPv6 packet duplication to alternate destination"
52 depends on !NF_CONNTRACK || NF_CONNTRACK
53 help
54 This option enables the nf_dup_ipv6 core, which duplicates an IPv6
55 packet to be rerouted to another destination.
56
57config NF_REJECT_IPV6
58 tristate "IPv6 packet rejection"
59 default m if NETFILTER_ADVANCED=n
60
61config NF_LOG_IPV6
62 tristate "IPv6 packet logging"
63 default m if NETFILTER_ADVANCED=n
64 select NF_LOG_SYSLOG
65 help
66 This is a backwards-compat option for the user's convenience
67 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG.
68
69config IP6_NF_IPTABLES
70 tristate "IP6 tables support (required for filtering)"
71 depends on INET && IPV6
72 select NETFILTER_XTABLES
73 default m if NETFILTER_ADVANCED=n
74 help
75 ip6tables is a general, extensible packet identification framework.
76 Currently only the packet filtering and packet mangling subsystem
77 for IPv6 use this, but connection tracking is going to follow.
78 Say 'Y' or 'M' here if you want to use either of those.
79
80 To compile it as a module, choose M here. If unsure, say N.
81
82if IP6_NF_IPTABLES
83
84# The simple matches.
85config IP6_NF_MATCH_AH
86 tristate '"ah" match support'
87 depends on NETFILTER_ADVANCED
88 help
89 This module allows one to match AH packets.
90
91 To compile it as a module, choose M here. If unsure, say N.
92
93config IP6_NF_MATCH_EUI64
94 tristate '"eui64" address check'
95 depends on NETFILTER_ADVANCED
96 help
97 This module performs checking on the IPv6 source address
98 Compares the last 64 bits with the EUI64 (delivered
99 from the MAC address) address
100
101 To compile it as a module, choose M here. If unsure, say N.
102
103config IP6_NF_MATCH_FRAG
104 tristate '"frag" Fragmentation header match support'
105 depends on NETFILTER_ADVANCED
106 help
107 frag matching allows you to match packets based on the fragmentation
108 header of the packet.
109
110 To compile it as a module, choose M here. If unsure, say N.
111
112config IP6_NF_MATCH_OPTS
113 tristate '"hbh" hop-by-hop and "dst" opts header match support'
114 depends on NETFILTER_ADVANCED
115 help
116 This allows one to match packets based on the hop-by-hop
117 and destination options headers of a packet.
118
119 To compile it as a module, choose M here. If unsure, say N.
120
121config IP6_NF_MATCH_HL
122 tristate '"hl" hoplimit match support'
123 depends on NETFILTER_ADVANCED
124 select NETFILTER_XT_MATCH_HL
125 help
126 This is a backwards-compat option for the user's convenience
127 (e.g. when running oldconfig). It selects
128 CONFIG_NETFILTER_XT_MATCH_HL.
129
130config IP6_NF_MATCH_IPV6HEADER
131 tristate '"ipv6header" IPv6 Extension Headers Match'
132 default m if NETFILTER_ADVANCED=n
133 help
134 This module allows one to match packets based upon
135 the ipv6 extension headers.
136
137 To compile it as a module, choose M here. If unsure, say N.
138
139config IP6_NF_MATCH_MH
140 tristate '"mh" match support'
141 depends on NETFILTER_ADVANCED
142 help
143 This module allows one to match MH packets.
144
145 To compile it as a module, choose M here. If unsure, say N.
146
147config IP6_NF_MATCH_RPFILTER
148 tristate '"rpfilter" reverse path filter match support'
149 depends on NETFILTER_ADVANCED
150 depends on IP6_NF_MANGLE || IP6_NF_RAW
151 help
152 This option allows you to match packets whose replies would
153 go out via the interface the packet came in.
154
155 To compile it as a module, choose M here. If unsure, say N.
156 The module will be called ip6t_rpfilter.
157
158config IP6_NF_MATCH_RT
159 tristate '"rt" Routing header match support'
160 depends on NETFILTER_ADVANCED
161 help
162 rt matching allows you to match packets based on the routing
163 header of the packet.
164
165 To compile it as a module, choose M here. If unsure, say N.
166
167config IP6_NF_MATCH_SRH
168 tristate '"srh" Segment Routing header match support'
169 depends on NETFILTER_ADVANCED
170 help
171 srh matching allows you to match packets based on the segment
172 routing header of the packet.
173
174 To compile it as a module, choose M here. If unsure, say N.
175
176# The targets
177config IP6_NF_TARGET_HL
178 tristate '"HL" hoplimit target support'
179 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
180 select NETFILTER_XT_TARGET_HL
181 help
182 This is a backwards-compatible option for the user's convenience
183 (e.g. when running oldconfig). It selects
184 CONFIG_NETFILTER_XT_TARGET_HL.
185
186config IP6_NF_FILTER
187 tristate "Packet filtering"
188 default m if NETFILTER_ADVANCED=n
189 help
190 Packet filtering defines a table `filter', which has a series of
191 rules for simple packet filtering at local input, forwarding and
192 local output. See the man page for iptables(8).
193
194 To compile it as a module, choose M here. If unsure, say N.
195
196config IP6_NF_TARGET_REJECT
197 tristate "REJECT target support"
198 depends on IP6_NF_FILTER
199 select NF_REJECT_IPV6
200 default m if NETFILTER_ADVANCED=n
201 help
202 The REJECT target allows a filtering rule to specify that an ICMPv6
203 error should be issued in response to an incoming packet, rather
204 than silently being dropped.
205
206 To compile it as a module, choose M here. If unsure, say N.
207
208config IP6_NF_TARGET_SYNPROXY
209 tristate "SYNPROXY target support"
210 depends on NF_CONNTRACK && NETFILTER_ADVANCED
211 select NETFILTER_SYNPROXY
212 select SYN_COOKIES
213 help
214 The SYNPROXY target allows you to intercept TCP connections and
215 establish them using syncookies before they are passed on to the
216 server. This allows to avoid conntrack and server resource usage
217 during SYN-flood attacks.
218
219 To compile it as a module, choose M here. If unsure, say N.
220
221config IP6_NF_MANGLE
222 tristate "Packet mangling"
223 default m if NETFILTER_ADVANCED=n
224 help
225 This option adds a `mangle' table to iptables: see the man page for
226 iptables(8). This table is used for various packet alterations
227 which can effect how the packet is routed.
228
229 To compile it as a module, choose M here. If unsure, say N.
230
231config IP6_NF_RAW
232 tristate 'raw table support (required for TRACE)'
233 help
234 This option adds a `raw' table to ip6tables. This table is the very
235 first in the netfilter framework and hooks in at the PREROUTING
236 and OUTPUT chains.
237
238 If you want to compile it as a module, say M here and read
239 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
240
241# security table for MAC policy
242config IP6_NF_SECURITY
243 tristate "Security table"
244 depends on SECURITY
245 depends on NETFILTER_ADVANCED
246 help
247 This option adds a `security' table to iptables, for use
248 with Mandatory Access Control (MAC) policy.
249
250 If unsure, say N.
251
252config IP6_NF_NAT
253 tristate "ip6tables NAT support"
254 depends on NF_CONNTRACK
255 depends on NETFILTER_ADVANCED
256 select NF_NAT
257 select NETFILTER_XT_NAT
258 help
259 This enables the `nat' table in ip6tables. This allows masquerading,
260 port forwarding and other forms of full Network Address Port
261 Translation.
262
263 To compile it as a module, choose M here. If unsure, say N.
264
265if IP6_NF_NAT
266
267config IP6_NF_TARGET_MASQUERADE
268 tristate "MASQUERADE target support"
269 select NETFILTER_XT_TARGET_MASQUERADE
270 help
271 This is a backwards-compat option for the user's convenience
272 (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE.
273
274config IP6_NF_TARGET_NPT
275 tristate "NPT (Network Prefix translation) target support"
276 help
277 This option adds the `SNPT' and `DNPT' target, which perform
278 stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
279
280 To compile it as a module, choose M here. If unsure, say N.
281
282endif # IP6_NF_NAT
283
284endif # IP6_NF_IPTABLES
285endmenu
286
287config NF_DEFRAG_IPV6
288 tristate