Loading...
1#
2# IP netfilter configuration
3#
4
5menu "IPv6: Netfilter Configuration"
6 depends on INET && IPV6 && NETFILTER
7
8config NF_DEFRAG_IPV6
9 tristate
10 default n
11
12config NF_CONNTRACK_IPV6
13 tristate "IPv6 connection tracking support"
14 depends on INET && IPV6 && NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
16 select NF_DEFRAG_IPV6
17 ---help---
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
20 into connections.
21
22 This is IPv6 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
25
26 To compile it as a module, choose M here. If unsure, say N.
27
28config NF_TABLES_IPV6
29 depends on NF_TABLES
30 tristate "IPv6 nf_tables support"
31 help
32 This option enables the IPv6 support for nf_tables.
33
34config NFT_CHAIN_ROUTE_IPV6
35 depends on NF_TABLES_IPV6
36 tristate "IPv6 nf_tables route chain support"
37 help
38 This option enables the "route" chain for IPv6 in nf_tables. This
39 chain type is used to force packet re-routing after mangling header
40 fields such as the source, destination, flowlabel, hop-limit and
41 the packet mark.
42
43config NFT_CHAIN_NAT_IPV6
44 depends on NF_TABLES_IPV6
45 depends on NF_NAT_IPV6 && NFT_NAT
46 tristate "IPv6 nf_tables nat chain support"
47 help
48 This option enables the "nat" chain for IPv6 in nf_tables. This
49 chain type is used to perform Network Address Translation (NAT)
50 packet transformations such as the source, destination address and
51 source and destination ports.
52
53config NFT_REJECT_IPV6
54 depends on NF_TABLES_IPV6
55 default NFT_REJECT
56 tristate
57
58config IP6_NF_IPTABLES
59 tristate "IP6 tables support (required for filtering)"
60 depends on INET && IPV6
61 select NETFILTER_XTABLES
62 default m if NETFILTER_ADVANCED=n
63 help
64 ip6tables is a general, extensible packet identification framework.
65 Currently only the packet filtering and packet mangling subsystem
66 for IPv6 use this, but connection tracking is going to follow.
67 Say 'Y' or 'M' here if you want to use either of those.
68
69 To compile it as a module, choose M here. If unsure, say N.
70
71if IP6_NF_IPTABLES
72
73# The simple matches.
74config IP6_NF_MATCH_AH
75 tristate '"ah" match support'
76 depends on NETFILTER_ADVANCED
77 help
78 This module allows one to match AH packets.
79
80 To compile it as a module, choose M here. If unsure, say N.
81
82config IP6_NF_MATCH_EUI64
83 tristate '"eui64" address check'
84 depends on NETFILTER_ADVANCED
85 help
86 This module performs checking on the IPv6 source address
87 Compares the last 64 bits with the EUI64 (delivered
88 from the MAC address) address
89
90 To compile it as a module, choose M here. If unsure, say N.
91
92config IP6_NF_MATCH_FRAG
93 tristate '"frag" Fragmentation header match support'
94 depends on NETFILTER_ADVANCED
95 help
96 frag matching allows you to match packets based on the fragmentation
97 header of the packet.
98
99 To compile it as a module, choose M here. If unsure, say N.
100
101config IP6_NF_MATCH_OPTS
102 tristate '"hbh" hop-by-hop and "dst" opts header match support'
103 depends on NETFILTER_ADVANCED
104 help
105 This allows one to match packets based on the hop-by-hop
106 and destination options headers of a packet.
107
108 To compile it as a module, choose M here. If unsure, say N.
109
110config IP6_NF_MATCH_HL
111 tristate '"hl" hoplimit match support'
112 depends on NETFILTER_ADVANCED
113 select NETFILTER_XT_MATCH_HL
114 ---help---
115 This is a backwards-compat option for the user's convenience
116 (e.g. when running oldconfig). It selects
117 CONFIG_NETFILTER_XT_MATCH_HL.
118
119config IP6_NF_MATCH_IPV6HEADER
120 tristate '"ipv6header" IPv6 Extension Headers Match'
121 default m if NETFILTER_ADVANCED=n
122 help
123 This module allows one to match packets based upon
124 the ipv6 extension headers.
125
126 To compile it as a module, choose M here. If unsure, say N.
127
128config IP6_NF_MATCH_MH
129 tristate '"mh" match support'
130 depends on NETFILTER_ADVANCED
131 help
132 This module allows one to match MH packets.
133
134 To compile it as a module, choose M here. If unsure, say N.
135
136config IP6_NF_MATCH_RPFILTER
137 tristate '"rpfilter" reverse path filter match support'
138 depends on NETFILTER_ADVANCED && (IP6_NF_MANGLE || IP6_NF_RAW)
139 ---help---
140 This option allows you to match packets whose replies would
141 go out via the interface the packet came in.
142
143 To compile it as a module, choose M here. If unsure, say N.
144 The module will be called ip6t_rpfilter.
145
146config IP6_NF_MATCH_RT
147 tristate '"rt" Routing header match support'
148 depends on NETFILTER_ADVANCED
149 help
150 rt matching allows you to match packets based on the routing
151 header of the packet.
152
153 To compile it as a module, choose M here. If unsure, say N.
154
155# The targets
156config IP6_NF_TARGET_HL
157 tristate '"HL" hoplimit target support'
158 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
159 select NETFILTER_XT_TARGET_HL
160 ---help---
161 This is a backwards-compatible option for the user's convenience
162 (e.g. when running oldconfig). It selects
163 CONFIG_NETFILTER_XT_TARGET_HL.
164
165config IP6_NF_FILTER
166 tristate "Packet filtering"
167 default m if NETFILTER_ADVANCED=n
168 help
169 Packet filtering defines a table `filter', which has a series of
170 rules for simple packet filtering at local input, forwarding and
171 local output. See the man page for iptables(8).
172
173 To compile it as a module, choose M here. If unsure, say N.
174
175config IP6_NF_TARGET_REJECT
176 tristate "REJECT target support"
177 depends on IP6_NF_FILTER
178 default m if NETFILTER_ADVANCED=n
179 help
180 The REJECT target allows a filtering rule to specify that an ICMPv6
181 error should be issued in response to an incoming packet, rather
182 than silently being dropped.
183
184 To compile it as a module, choose M here. If unsure, say N.
185
186config IP6_NF_TARGET_SYNPROXY
187 tristate "SYNPROXY target support"
188 depends on NF_CONNTRACK && NETFILTER_ADVANCED
189 select NETFILTER_SYNPROXY
190 select SYN_COOKIES
191 help
192 The SYNPROXY target allows you to intercept TCP connections and
193 establish them using syncookies before they are passed on to the
194 server. This allows to avoid conntrack and server resource usage
195 during SYN-flood attacks.
196
197 To compile it as a module, choose M here. If unsure, say N.
198
199config IP6_NF_MANGLE
200 tristate "Packet mangling"
201 default m if NETFILTER_ADVANCED=n
202 help
203 This option adds a `mangle' table to iptables: see the man page for
204 iptables(8). This table is used for various packet alterations
205 which can effect how the packet is routed.
206
207 To compile it as a module, choose M here. If unsure, say N.
208
209config IP6_NF_RAW
210 tristate 'raw table support (required for TRACE)'
211 help
212 This option adds a `raw' table to ip6tables. This table is the very
213 first in the netfilter framework and hooks in at the PREROUTING
214 and OUTPUT chains.
215
216 If you want to compile it as a module, say M here and read
217 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
218
219# security table for MAC policy
220config IP6_NF_SECURITY
221 tristate "Security table"
222 depends on SECURITY
223 depends on NETFILTER_ADVANCED
224 help
225 This option adds a `security' table to iptables, for use
226 with Mandatory Access Control (MAC) policy.
227
228 If unsure, say N.
229
230config NF_NAT_IPV6
231 tristate "IPv6 NAT"
232 depends on NF_CONNTRACK_IPV6
233 depends on NETFILTER_ADVANCED
234 select NF_NAT
235 help
236 The IPv6 NAT option allows masquerading, port forwarding and other
237 forms of full Network Address Port Translation. It is controlled by
238 the `nat' table in ip6tables, see the man page for ip6tables(8).
239
240 To compile it as a module, choose M here. If unsure, say N.
241
242if NF_NAT_IPV6
243
244config IP6_NF_TARGET_MASQUERADE
245 tristate "MASQUERADE target support"
246 help
247 Masquerading is a special case of NAT: all outgoing connections are
248 changed to seem to come from a particular interface's address, and
249 if the interface goes down, those connections are lost. This is
250 only useful for dialup accounts with dynamic IP address (ie. your IP
251 address will be different on next dialup).
252
253 To compile it as a module, choose M here. If unsure, say N.
254
255config IP6_NF_TARGET_NPT
256 tristate "NPT (Network Prefix translation) target support"
257 help
258 This option adds the `SNPT' and `DNPT' target, which perform
259 stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
260
261 To compile it as a module, choose M here. If unsure, say N.
262
263endif # NF_NAT_IPV6
264
265endif # IP6_NF_IPTABLES
266
267endmenu
268
1# SPDX-License-Identifier: GPL-2.0-only
2#
3# IP netfilter configuration
4#
5
6menu "IPv6: Netfilter Configuration"
7 depends on INET && IPV6 && NETFILTER
8
9# old sockopt interface and eval loop
10config IP6_NF_IPTABLES_LEGACY
11 tristate
12
13config NF_SOCKET_IPV6
14 tristate "IPv6 socket lookup support"
15 help
16 This option enables the IPv6 socket lookup infrastructure. This
17 is used by the {ip6,nf}tables socket match.
18
19config NF_TPROXY_IPV6
20 tristate "IPv6 tproxy support"
21
22if NF_TABLES
23
24config NF_TABLES_IPV6
25 bool "IPv6 nf_tables support"
26 help
27 This option enables the IPv6 support for nf_tables.
28
29if NF_TABLES_IPV6
30
31config NFT_REJECT_IPV6
32 select NF_REJECT_IPV6
33 default NFT_REJECT
34 tristate
35
36config NFT_DUP_IPV6
37 tristate "IPv6 nf_tables packet duplication support"
38 depends on !NF_CONNTRACK || NF_CONNTRACK
39 select NF_DUP_IPV6
40 help
41 This module enables IPv6 packet duplication support for nf_tables.
42
43config NFT_FIB_IPV6
44 tristate "nf_tables fib / ipv6 route lookup support"
45 select NFT_FIB
46 help
47 This module enables IPv6 FIB lookups, e.g. for reverse path filtering.
48 It also allows query of the FIB for the route type, e.g. local, unicast,
49 multicast or blackhole.
50
51endif # NF_TABLES_IPV6
52endif # NF_TABLES
53
54config NF_DUP_IPV6
55 tristate "Netfilter IPv6 packet duplication to alternate destination"
56 depends on !NF_CONNTRACK || NF_CONNTRACK
57 help
58 This option enables the nf_dup_ipv6 core, which duplicates an IPv6
59 packet to be rerouted to another destination.
60
61config NF_REJECT_IPV6
62 tristate "IPv6 packet rejection"
63 default m if NETFILTER_ADVANCED=n
64
65config NF_LOG_IPV6
66 tristate "IPv6 packet logging"
67 default m if NETFILTER_ADVANCED=n
68 select NF_LOG_SYSLOG
69 help
70 This is a backwards-compat option for the user's convenience
71 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG.
72
73config IP6_NF_IPTABLES
74 tristate "IP6 tables support (required for filtering)"
75 depends on INET && IPV6
76 select NETFILTER_XTABLES
77 default m if NETFILTER_ADVANCED=n
78 help
79 ip6tables is a general, extensible packet identification framework.
80 Currently only the packet filtering and packet mangling subsystem
81 for IPv6 use this, but connection tracking is going to follow.
82 Say 'Y' or 'M' here if you want to use either of those.
83
84 To compile it as a module, choose M here. If unsure, say N.
85
86if IP6_NF_IPTABLES
87
88# The simple matches.
89config IP6_NF_MATCH_AH
90 tristate '"ah" match support'
91 depends on NETFILTER_ADVANCED
92 help
93 This module allows one to match AH packets.
94
95 To compile it as a module, choose M here. If unsure, say N.
96
97config IP6_NF_MATCH_EUI64
98 tristate '"eui64" address check'
99 depends on NETFILTER_ADVANCED
100 help
101 This module performs checking on the IPv6 source address
102 Compares the last 64 bits with the EUI64 (delivered
103 from the MAC address) address
104
105 To compile it as a module, choose M here. If unsure, say N.
106
107config IP6_NF_MATCH_FRAG
108 tristate '"frag" Fragmentation header match support'
109 depends on NETFILTER_ADVANCED
110 help
111 frag matching allows you to match packets based on the fragmentation
112 header of the packet.
113
114 To compile it as a module, choose M here. If unsure, say N.
115
116config IP6_NF_MATCH_OPTS
117 tristate '"hbh" hop-by-hop and "dst" opts header match support'
118 depends on NETFILTER_ADVANCED
119 help
120 This allows one to match packets based on the hop-by-hop
121 and destination options headers of a packet.
122
123 To compile it as a module, choose M here. If unsure, say N.
124
125config IP6_NF_MATCH_HL
126 tristate '"hl" hoplimit match support'
127 depends on NETFILTER_ADVANCED
128 select NETFILTER_XT_MATCH_HL
129 help
130 This is a backwards-compat option for the user's convenience
131 (e.g. when running oldconfig). It selects
132 CONFIG_NETFILTER_XT_MATCH_HL.
133
134config IP6_NF_MATCH_IPV6HEADER
135 tristate '"ipv6header" IPv6 Extension Headers Match'
136 default m if NETFILTER_ADVANCED=n
137 help
138 This module allows one to match packets based upon
139 the ipv6 extension headers.
140
141 To compile it as a module, choose M here. If unsure, say N.
142
143config IP6_NF_MATCH_MH
144 tristate '"mh" match support'
145 depends on NETFILTER_ADVANCED
146 help
147 This module allows one to match MH packets.
148
149 To compile it as a module, choose M here. If unsure, say N.
150
151config IP6_NF_MATCH_RPFILTER
152 tristate '"rpfilter" reverse path filter match support'
153 depends on NETFILTER_ADVANCED
154 depends on IP6_NF_MANGLE || IP6_NF_RAW || NFT_COMPAT
155 help
156 This option allows you to match packets whose replies would
157 go out via the interface the packet came in.
158
159 To compile it as a module, choose M here. If unsure, say N.
160 The module will be called ip6t_rpfilter.
161
162config IP6_NF_MATCH_RT
163 tristate '"rt" Routing header match support'
164 depends on NETFILTER_ADVANCED
165 help
166 rt matching allows you to match packets based on the routing
167 header of the packet.
168
169 To compile it as a module, choose M here. If unsure, say N.
170
171config IP6_NF_MATCH_SRH
172 tristate '"srh" Segment Routing header match support'
173 depends on NETFILTER_ADVANCED
174 help
175 srh matching allows you to match packets based on the segment
176 routing header of the packet.
177
178 To compile it as a module, choose M here. If unsure, say N.
179
180# The targets
181config IP6_NF_TARGET_HL
182 tristate '"HL" hoplimit target support'
183 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
184 select NETFILTER_XT_TARGET_HL
185 help
186 This is a backwards-compatible option for the user's convenience
187 (e.g. when running oldconfig). It selects
188 CONFIG_NETFILTER_XT_TARGET_HL.
189
190config IP6_NF_FILTER
191 tristate "Packet filtering"
192 default m if NETFILTER_ADVANCED=n
193 select IP6_NF_IPTABLES_LEGACY
194 tristate
195 help
196 Packet filtering defines a table `filter', which has a series of
197 rules for simple packet filtering at local input, forwarding and
198 local output. See the man page for iptables(8).
199
200 To compile it as a module, choose M here. If unsure, say N.
201
202config IP6_NF_TARGET_REJECT
203 tristate "REJECT target support"
204 depends on IP6_NF_FILTER || NFT_COMPAT
205 select NF_REJECT_IPV6
206 default m if NETFILTER_ADVANCED=n
207 help
208 The REJECT target allows a filtering rule to specify that an ICMPv6
209 error should be issued in response to an incoming packet, rather
210 than silently being dropped.
211
212 To compile it as a module, choose M here. If unsure, say N.
213
214config IP6_NF_TARGET_SYNPROXY
215 tristate "SYNPROXY target support"
216 depends on NF_CONNTRACK && NETFILTER_ADVANCED
217 select NETFILTER_SYNPROXY
218 select SYN_COOKIES
219 help
220 The SYNPROXY target allows you to intercept TCP connections and
221 establish them using syncookies before they are passed on to the
222 server. This allows to avoid conntrack and server resource usage
223 during SYN-flood attacks.
224
225 To compile it as a module, choose M here. If unsure, say N.
226
227config IP6_NF_MANGLE
228 tristate "Packet mangling"
229 default m if NETFILTER_ADVANCED=n
230 select IP6_NF_IPTABLES_LEGACY
231 help
232 This option adds a `mangle' table to iptables: see the man page for
233 iptables(8). This table is used for various packet alterations
234 which can effect how the packet is routed.
235
236 To compile it as a module, choose M here. If unsure, say N.
237
238config IP6_NF_RAW
239 tristate 'raw table support (required for TRACE)'
240 select IP6_NF_IPTABLES_LEGACY
241 help
242 This option adds a `raw' table to ip6tables. This table is the very
243 first in the netfilter framework and hooks in at the PREROUTING
244 and OUTPUT chains.
245
246 If you want to compile it as a module, say M here and read
247 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
248
249# security table for MAC policy
250config IP6_NF_SECURITY
251 tristate "Security table"
252 depends on SECURITY
253 depends on NETFILTER_ADVANCED
254 select IP6_NF_IPTABLES_LEGACY
255 help
256 This option adds a `security' table to iptables, for use
257 with Mandatory Access Control (MAC) policy.
258
259 If unsure, say N.
260
261config IP6_NF_NAT
262 tristate "ip6tables NAT support"
263 depends on NF_CONNTRACK
264 depends on NETFILTER_ADVANCED
265 select NF_NAT
266 select IP6_NF_IPTABLES_LEGACY
267 select NETFILTER_XT_NAT
268 help
269 This enables the `nat' table in ip6tables. This allows masquerading,
270 port forwarding and other forms of full Network Address Port
271 Translation.
272
273 To compile it as a module, choose M here. If unsure, say N.
274
275config IP6_NF_TARGET_MASQUERADE
276 tristate "MASQUERADE target support"
277 select NETFILTER_XT_TARGET_MASQUERADE
278 depends on IP6_NF_NAT
279 help
280 This is a backwards-compat option for the user's convenience
281 (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE.
282
283config IP6_NF_TARGET_NPT
284 tristate "NPT (Network Prefix translation) target support"
285 depends on IP6_NF_NAT || NFT_COMPAT
286 help
287 This option adds the `SNPT' and `DNPT' target, which perform
288 stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
289
290 To compile it as a module, choose M here. If unsure, say N.
291
292endif # IP6_NF_IPTABLES
293endmenu
294
295config NF_DEFRAG_IPV6
296 tristate