Loading...
1#
2# IP netfilter configuration
3#
4
5menu "IP: Netfilter Configuration"
6 depends on INET && NETFILTER
7
8config NF_DEFRAG_IPV4
9 tristate
10 default n
11
12config NF_CONNTRACK_IPV4
13 tristate "IPv4 connection tracking support (required for NAT)"
14 depends on NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
16 select NF_DEFRAG_IPV4
17 ---help---
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
20 into connections.
21
22 This is IPv4 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
25
26 To compile it as a module, choose M here. If unsure, say N.
27
28config NF_SOCKET_IPV4
29 tristate "IPv4 socket lookup support"
30 help
31 This option enables the IPv4 socket lookup infrastructure. This is
32 is required by the iptables socket match.
33
34if NF_TABLES
35
36config NF_TABLES_IPV4
37 bool "IPv4 nf_tables support"
38 help
39 This option enables the IPv4 support for nf_tables.
40
41if NF_TABLES_IPV4
42
43config NFT_CHAIN_ROUTE_IPV4
44 tristate "IPv4 nf_tables route chain support"
45 help
46 This option enables the "route" chain for IPv4 in nf_tables. This
47 chain type is used to force packet re-routing after mangling header
48 fields such as the source, destination, type of service and
49 the packet mark.
50
51config NFT_REJECT_IPV4
52 select NF_REJECT_IPV4
53 default NFT_REJECT
54 tristate
55
56config NFT_DUP_IPV4
57 tristate "IPv4 nf_tables packet duplication support"
58 depends on !NF_CONNTRACK || NF_CONNTRACK
59 select NF_DUP_IPV4
60 help
61 This module enables IPv4 packet duplication support for nf_tables.
62
63config NFT_FIB_IPV4
64 select NFT_FIB
65 tristate "nf_tables fib / ip route lookup support"
66 help
67 This module enables IPv4 FIB lookups, e.g. for reverse path filtering.
68 It also allows query of the FIB for the route type, e.g. local, unicast,
69 multicast or blackhole.
70
71endif # NF_TABLES_IPV4
72
73config NF_TABLES_ARP
74 bool "ARP nf_tables support"
75 select NETFILTER_FAMILY_ARP
76 help
77 This option enables the ARP support for nf_tables.
78
79endif # NF_TABLES
80
81config NF_FLOW_TABLE_IPV4
82 tristate "Netfilter flow table IPv4 module"
83 depends on NF_FLOW_TABLE
84 help
85 This option adds the flow table IPv4 support.
86
87 To compile it as a module, choose M here.
88
89config NF_DUP_IPV4
90 tristate "Netfilter IPv4 packet duplication to alternate destination"
91 depends on !NF_CONNTRACK || NF_CONNTRACK
92 help
93 This option enables the nf_dup_ipv4 core, which duplicates an IPv4
94 packet to be rerouted to another destination.
95
96config NF_LOG_ARP
97 tristate "ARP packet logging"
98 default m if NETFILTER_ADVANCED=n
99 select NF_LOG_COMMON
100
101config NF_LOG_IPV4
102 tristate "IPv4 packet logging"
103 default m if NETFILTER_ADVANCED=n
104 select NF_LOG_COMMON
105
106config NF_REJECT_IPV4
107 tristate "IPv4 packet rejection"
108 default m if NETFILTER_ADVANCED=n
109
110config NF_NAT_IPV4
111 tristate "IPv4 NAT"
112 depends on NF_CONNTRACK_IPV4
113 default m if NETFILTER_ADVANCED=n
114 select NF_NAT
115 help
116 The IPv4 NAT option allows masquerading, port forwarding and other
117 forms of full Network Address Port Translation. This can be
118 controlled by iptables or nft.
119
120if NF_NAT_IPV4
121
122config NFT_CHAIN_NAT_IPV4
123 depends on NF_TABLES_IPV4
124 tristate "IPv4 nf_tables nat chain support"
125 help
126 This option enables the "nat" chain for IPv4 in nf_tables. This
127 chain type is used to perform Network Address Translation (NAT)
128 packet transformations such as the source, destination address and
129 source and destination ports.
130
131config NF_NAT_MASQUERADE_IPV4
132 tristate "IPv4 masquerade support"
133 help
134 This is the kernel functionality to provide NAT in the masquerade
135 flavour (automatic source address selection).
136
137config NFT_MASQ_IPV4
138 tristate "IPv4 masquerading support for nf_tables"
139 depends on NF_TABLES_IPV4
140 depends on NFT_MASQ
141 select NF_NAT_MASQUERADE_IPV4
142 help
143 This is the expression that provides IPv4 masquerading support for
144 nf_tables.
145
146config NFT_REDIR_IPV4
147 tristate "IPv4 redirect support for nf_tables"
148 depends on NF_TABLES_IPV4
149 depends on NFT_REDIR
150 select NF_NAT_REDIRECT
151 help
152 This is the expression that provides IPv4 redirect support for
153 nf_tables.
154
155config NF_NAT_SNMP_BASIC
156 tristate "Basic SNMP-ALG support"
157 depends on NF_CONNTRACK_SNMP
158 depends on NETFILTER_ADVANCED
159 default NF_NAT && NF_CONNTRACK_SNMP
160 select ASN1
161 ---help---
162
163 This module implements an Application Layer Gateway (ALG) for
164 SNMP payloads. In conjunction with NAT, it allows a network
165 management system to access multiple private networks with
166 conflicting addresses. It works by modifying IP addresses
167 inside SNMP payloads to match IP-layer NAT mapping.
168
169 This is the "basic" form of SNMP-ALG, as described in RFC 2962
170
171 To compile it as a module, choose M here. If unsure, say N.
172
173config NF_NAT_PROTO_GRE
174 tristate
175 depends on NF_CT_PROTO_GRE
176
177config NF_NAT_PPTP
178 tristate
179 depends on NF_CONNTRACK
180 default NF_CONNTRACK_PPTP
181 select NF_NAT_PROTO_GRE
182
183config NF_NAT_H323
184 tristate
185 depends on NF_CONNTRACK
186 default NF_CONNTRACK_H323
187
188endif # NF_NAT_IPV4
189
190config IP_NF_IPTABLES
191 tristate "IP tables support (required for filtering/masq/NAT)"
192 default m if NETFILTER_ADVANCED=n
193 select NETFILTER_XTABLES
194 help
195 iptables is a general, extensible packet identification framework.
196 The packet filtering and full NAT (masquerading, port forwarding,
197 etc) subsystems now use this: say `Y' or `M' here if you want to use
198 either of those.
199
200 To compile it as a module, choose M here. If unsure, say N.
201
202if IP_NF_IPTABLES
203
204# The matches.
205config IP_NF_MATCH_AH
206 tristate '"ah" match support'
207 depends on NETFILTER_ADVANCED
208 help
209 This match extension allows you to match a range of SPIs
210 inside AH header of IPSec packets.
211
212 To compile it as a module, choose M here. If unsure, say N.
213
214config IP_NF_MATCH_ECN
215 tristate '"ecn" match support'
216 depends on NETFILTER_ADVANCED
217 select NETFILTER_XT_MATCH_ECN
218 ---help---
219 This is a backwards-compat option for the user's convenience
220 (e.g. when running oldconfig). It selects
221 CONFIG_NETFILTER_XT_MATCH_ECN.
222
223config IP_NF_MATCH_RPFILTER
224 tristate '"rpfilter" reverse path filter match support'
225 depends on NETFILTER_ADVANCED
226 depends on IP_NF_MANGLE || IP_NF_RAW
227 ---help---
228 This option allows you to match packets whose replies would
229 go out via the interface the packet came in.
230
231 To compile it as a module, choose M here. If unsure, say N.
232 The module will be called ipt_rpfilter.
233
234config IP_NF_MATCH_TTL
235 tristate '"ttl" match support'
236 depends on NETFILTER_ADVANCED
237 select NETFILTER_XT_MATCH_HL
238 ---help---
239 This is a backwards-compat option for the user's convenience
240 (e.g. when running oldconfig). It selects
241 CONFIG_NETFILTER_XT_MATCH_HL.
242
243# `filter', generic and specific targets
244config IP_NF_FILTER
245 tristate "Packet filtering"
246 default m if NETFILTER_ADVANCED=n
247 help
248 Packet filtering defines a table `filter', which has a series of
249 rules for simple packet filtering at local input, forwarding and
250 local output. See the man page for iptables(8).
251
252 To compile it as a module, choose M here. If unsure, say N.
253
254config IP_NF_TARGET_REJECT
255 tristate "REJECT target support"
256 depends on IP_NF_FILTER
257 select NF_REJECT_IPV4
258 default m if NETFILTER_ADVANCED=n
259 help
260 The REJECT target allows a filtering rule to specify that an ICMP
261 error should be issued in response to an incoming packet, rather
262 than silently being dropped.
263
264 To compile it as a module, choose M here. If unsure, say N.
265
266config IP_NF_TARGET_SYNPROXY
267 tristate "SYNPROXY target support"
268 depends on NF_CONNTRACK && NETFILTER_ADVANCED
269 select NETFILTER_SYNPROXY
270 select SYN_COOKIES
271 help
272 The SYNPROXY target allows you to intercept TCP connections and
273 establish them using syncookies before they are passed on to the
274 server. This allows to avoid conntrack and server resource usage
275 during SYN-flood attacks.
276
277 To compile it as a module, choose M here. If unsure, say N.
278
279# NAT + specific targets: nf_conntrack
280config IP_NF_NAT
281 tristate "iptables NAT support"
282 depends on NF_CONNTRACK_IPV4
283 default m if NETFILTER_ADVANCED=n
284 select NF_NAT
285 select NF_NAT_IPV4
286 select NETFILTER_XT_NAT
287 help
288 This enables the `nat' table in iptables. This allows masquerading,
289 port forwarding and other forms of full Network Address Port
290 Translation.
291
292 To compile it as a module, choose M here. If unsure, say N.
293
294if IP_NF_NAT
295
296config IP_NF_TARGET_MASQUERADE
297 tristate "MASQUERADE target support"
298 select NF_NAT_MASQUERADE_IPV4
299 default m if NETFILTER_ADVANCED=n
300 help
301 Masquerading is a special case of NAT: all outgoing connections are
302 changed to seem to come from a particular interface's address, and
303 if the interface goes down, those connections are lost. This is
304 only useful for dialup accounts with dynamic IP address (ie. your IP
305 address will be different on next dialup).
306
307 To compile it as a module, choose M here. If unsure, say N.
308
309config IP_NF_TARGET_NETMAP
310 tristate "NETMAP target support"
311 depends on NETFILTER_ADVANCED
312 select NETFILTER_XT_TARGET_NETMAP
313 ---help---
314 This is a backwards-compat option for the user's convenience
315 (e.g. when running oldconfig). It selects
316 CONFIG_NETFILTER_XT_TARGET_NETMAP.
317
318config IP_NF_TARGET_REDIRECT
319 tristate "REDIRECT target support"
320 depends on NETFILTER_ADVANCED
321 select NETFILTER_XT_TARGET_REDIRECT
322 ---help---
323 This is a backwards-compat option for the user's convenience
324 (e.g. when running oldconfig). It selects
325 CONFIG_NETFILTER_XT_TARGET_REDIRECT.
326
327endif # IP_NF_NAT
328
329# mangle + specific targets
330config IP_NF_MANGLE
331 tristate "Packet mangling"
332 default m if NETFILTER_ADVANCED=n
333 help
334 This option adds a `mangle' table to iptables: see the man page for
335 iptables(8). This table is used for various packet alterations
336 which can effect how the packet is routed.
337
338 To compile it as a module, choose M here. If unsure, say N.
339
340config IP_NF_TARGET_CLUSTERIP
341 tristate "CLUSTERIP target support"
342 depends on IP_NF_MANGLE
343 depends on NF_CONNTRACK_IPV4
344 depends on NETFILTER_ADVANCED
345 select NF_CONNTRACK_MARK
346 select NETFILTER_FAMILY_ARP
347 help
348 The CLUSTERIP target allows you to build load-balancing clusters of
349 network servers without having a dedicated load-balancing
350 router/server/switch.
351
352 To compile it as a module, choose M here. If unsure, say N.
353
354config IP_NF_TARGET_ECN
355 tristate "ECN target support"
356 depends on IP_NF_MANGLE
357 depends on NETFILTER_ADVANCED
358 ---help---
359 This option adds a `ECN' target, which can be used in the iptables mangle
360 table.
361
362 You can use this target to remove the ECN bits from the IPv4 header of
363 an IP packet. This is particularly useful, if you need to work around
364 existing ECN blackholes on the internet, but don't want to disable
365 ECN support in general.
366
367 To compile it as a module, choose M here. If unsure, say N.
368
369config IP_NF_TARGET_TTL
370 tristate '"TTL" target support'
371 depends on NETFILTER_ADVANCED && IP_NF_MANGLE
372 select NETFILTER_XT_TARGET_HL
373 ---help---
374 This is a backwards-compatible option for the user's convenience
375 (e.g. when running oldconfig). It selects
376 CONFIG_NETFILTER_XT_TARGET_HL.
377
378# raw + specific targets
379config IP_NF_RAW
380 tristate 'raw table support (required for NOTRACK/TRACE)'
381 help
382 This option adds a `raw' table to iptables. This table is the very
383 first in the netfilter framework and hooks in at the PREROUTING
384 and OUTPUT chains.
385
386 If you want to compile it as a module, say M here and read
387 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
388
389# security table for MAC policy
390config IP_NF_SECURITY
391 tristate "Security table"
392 depends on SECURITY
393 depends on NETFILTER_ADVANCED
394 help
395 This option adds a `security' table to iptables, for use
396 with Mandatory Access Control (MAC) policy.
397
398 If unsure, say N.
399
400endif # IP_NF_IPTABLES
401
402# ARP tables
403config IP_NF_ARPTABLES
404 tristate "ARP tables support"
405 select NETFILTER_XTABLES
406 select NETFILTER_FAMILY_ARP
407 depends on NETFILTER_ADVANCED
408 help
409 arptables is a general, extensible packet identification framework.
410 The ARP packet filtering and mangling (manipulation)subsystems
411 use this: say Y or M here if you want to use either of those.
412
413 To compile it as a module, choose M here. If unsure, say N.
414
415if IP_NF_ARPTABLES
416
417config IP_NF_ARPFILTER
418 tristate "ARP packet filtering"
419 help
420 ARP packet filtering defines a table `filter', which has a series of
421 rules for simple ARP packet filtering at local input and
422 local output. On a bridge, you can also specify filtering rules
423 for forwarded ARP packets. See the man page for arptables(8).
424
425 To compile it as a module, choose M here. If unsure, say N.
426
427config IP_NF_ARP_MANGLE
428 tristate "ARP payload mangling"
429 help
430 Allows altering the ARP packet payload: source and destination
431 hardware and network addresses.
432
433endif # IP_NF_ARPTABLES
434
435endmenu
436
1#
2# IP netfilter configuration
3#
4
5menu "IP: Netfilter Configuration"
6 depends on INET && NETFILTER
7
8config NF_DEFRAG_IPV4
9 tristate
10 default n
11
12config NF_CONNTRACK_IPV4
13 tristate "IPv4 connection tracking support (required for NAT)"
14 depends on NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
16 select NF_DEFRAG_IPV4
17 ---help---
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
20 into connections.
21
22 This is IPv4 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
25
26 To compile it as a module, choose M here. If unsure, say N.
27
28config NF_CONNTRACK_PROC_COMPAT
29 bool "proc/sysctl compatibility with old connection tracking"
30 depends on NF_CONNTRACK_IPV4
31 default y
32 help
33 This option enables /proc and sysctl compatibility with the old
34 layer 3 dependent connection tracking. This is needed to keep
35 old programs that have not been adapted to the new names working.
36
37 If unsure, say Y.
38
39config IP_NF_QUEUE
40 tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
41 depends on NETFILTER_ADVANCED
42 help
43 Netfilter has the ability to queue packets to user space: the
44 netlink device can be used to access them using this driver.
45
46 This option enables the old IPv4-only "ip_queue" implementation
47 which has been obsoleted by the new "nfnetlink_queue" code (see
48 CONFIG_NETFILTER_NETLINK_QUEUE).
49
50 To compile it as a module, choose M here. If unsure, say N.
51
52config IP_NF_IPTABLES
53 tristate "IP tables support (required for filtering/masq/NAT)"
54 default m if NETFILTER_ADVANCED=n
55 select NETFILTER_XTABLES
56 help
57 iptables is a general, extensible packet identification framework.
58 The packet filtering and full NAT (masquerading, port forwarding,
59 etc) subsystems now use this: say `Y' or `M' here if you want to use
60 either of those.
61
62 To compile it as a module, choose M here. If unsure, say N.
63
64if IP_NF_IPTABLES
65
66# The matches.
67config IP_NF_MATCH_AH
68 tristate '"ah" match support'
69 depends on NETFILTER_ADVANCED
70 help
71 This match extension allows you to match a range of SPIs
72 inside AH header of IPSec packets.
73
74 To compile it as a module, choose M here. If unsure, say N.
75
76config IP_NF_MATCH_ECN
77 tristate '"ecn" match support'
78 depends on NETFILTER_ADVANCED
79 help
80 This option adds a `ECN' match, which allows you to match against
81 the IPv4 and TCP header ECN fields.
82
83 To compile it as a module, choose M here. If unsure, say N.
84
85config IP_NF_MATCH_TTL
86 tristate '"ttl" match support'
87 depends on NETFILTER_ADVANCED
88 select NETFILTER_XT_MATCH_HL
89 ---help---
90 This is a backwards-compat option for the user's convenience
91 (e.g. when running oldconfig). It selects
92 CONFIG_NETFILTER_XT_MATCH_HL.
93
94# `filter', generic and specific targets
95config IP_NF_FILTER
96 tristate "Packet filtering"
97 default m if NETFILTER_ADVANCED=n
98 help
99 Packet filtering defines a table `filter', which has a series of
100 rules for simple packet filtering at local input, forwarding and
101 local output. See the man page for iptables(8).
102
103 To compile it as a module, choose M here. If unsure, say N.
104
105config IP_NF_TARGET_REJECT
106 tristate "REJECT target support"
107 depends on IP_NF_FILTER
108 default m if NETFILTER_ADVANCED=n
109 help
110 The REJECT target allows a filtering rule to specify that an ICMP
111 error should be issued in response to an incoming packet, rather
112 than silently being dropped.
113
114 To compile it as a module, choose M here. If unsure, say N.
115
116config IP_NF_TARGET_LOG
117 tristate "LOG target support"
118 default m if NETFILTER_ADVANCED=n
119 help
120 This option adds a `LOG' target, which allows you to create rules in
121 any iptables table which records the packet header to the syslog.
122
123 To compile it as a module, choose M here. If unsure, say N.
124
125config IP_NF_TARGET_ULOG
126 tristate "ULOG target support"
127 default m if NETFILTER_ADVANCED=n
128 ---help---
129
130 This option enables the old IPv4-only "ipt_ULOG" implementation
131 which has been obsoleted by the new "nfnetlink_log" code (see
132 CONFIG_NETFILTER_NETLINK_LOG).
133
134 This option adds a `ULOG' target, which allows you to create rules in
135 any iptables table. The packet is passed to a userspace logging
136 daemon using netlink multicast sockets; unlike the LOG target
137 which can only be viewed through syslog.
138
139 The appropriate userspace logging daemon (ulogd) may be obtained from
140 <http://www.netfilter.org/projects/ulogd/index.html>
141
142 To compile it as a module, choose M here. If unsure, say N.
143
144# NAT + specific targets: nf_conntrack
145config NF_NAT
146 tristate "Full NAT"
147 depends on NF_CONNTRACK_IPV4
148 default m if NETFILTER_ADVANCED=n
149 help
150 The Full NAT option allows masquerading, port forwarding and other
151 forms of full Network Address Port Translation. It is controlled by
152 the `nat' table in iptables: see the man page for iptables(8).
153
154 To compile it as a module, choose M here. If unsure, say N.
155
156config NF_NAT_NEEDED
157 bool
158 depends on NF_NAT
159 default y
160
161config IP_NF_TARGET_MASQUERADE
162 tristate "MASQUERADE target support"
163 depends on NF_NAT
164 default m if NETFILTER_ADVANCED=n
165 help
166 Masquerading is a special case of NAT: all outgoing connections are
167 changed to seem to come from a particular interface's address, and
168 if the interface goes down, those connections are lost. This is
169 only useful for dialup accounts with dynamic IP address (ie. your IP
170 address will be different on next dialup).
171
172 To compile it as a module, choose M here. If unsure, say N.
173
174config IP_NF_TARGET_NETMAP
175 tristate "NETMAP target support"
176 depends on NF_NAT
177 depends on NETFILTER_ADVANCED
178 help
179 NETMAP is an implementation of static 1:1 NAT mapping of network
180 addresses. It maps the network address part, while keeping the host
181 address part intact.
182
183 To compile it as a module, choose M here. If unsure, say N.
184
185config IP_NF_TARGET_REDIRECT
186 tristate "REDIRECT target support"
187 depends on NF_NAT
188 depends on NETFILTER_ADVANCED
189 help
190 REDIRECT is a special case of NAT: all incoming connections are
191 mapped onto the incoming interface's address, causing the packets to
192 come to the local machine instead of passing through. This is
193 useful for transparent proxies.
194
195 To compile it as a module, choose M here. If unsure, say N.
196
197config NF_NAT_SNMP_BASIC
198 tristate "Basic SNMP-ALG support"
199 depends on NF_CONNTRACK_SNMP && NF_NAT
200 depends on NETFILTER_ADVANCED
201 default NF_NAT && NF_CONNTRACK_SNMP
202 ---help---
203
204 This module implements an Application Layer Gateway (ALG) for
205 SNMP payloads. In conjunction with NAT, it allows a network
206 management system to access multiple private networks with
207 conflicting addresses. It works by modifying IP addresses
208 inside SNMP payloads to match IP-layer NAT mapping.
209
210 This is the "basic" form of SNMP-ALG, as described in RFC 2962
211
212 To compile it as a module, choose M here. If unsure, say N.
213
214# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
215# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
216# From kconfig-language.txt:
217#
218# <expr> '&&' <expr> (6)
219#
220# (6) Returns the result of min(/expr/, /expr/).
221config NF_NAT_PROTO_DCCP
222 tristate
223 depends on NF_NAT && NF_CT_PROTO_DCCP
224 default NF_NAT && NF_CT_PROTO_DCCP
225
226config NF_NAT_PROTO_GRE
227 tristate
228 depends on NF_NAT && NF_CT_PROTO_GRE
229
230config NF_NAT_PROTO_UDPLITE
231 tristate
232 depends on NF_NAT && NF_CT_PROTO_UDPLITE
233 default NF_NAT && NF_CT_PROTO_UDPLITE
234
235config NF_NAT_PROTO_SCTP
236 tristate
237 default NF_NAT && NF_CT_PROTO_SCTP
238 depends on NF_NAT && NF_CT_PROTO_SCTP
239 select LIBCRC32C
240
241config NF_NAT_FTP
242 tristate
243 depends on NF_CONNTRACK && NF_NAT
244 default NF_NAT && NF_CONNTRACK_FTP
245
246config NF_NAT_IRC
247 tristate
248 depends on NF_CONNTRACK && NF_NAT
249 default NF_NAT && NF_CONNTRACK_IRC
250
251config NF_NAT_TFTP
252 tristate
253 depends on NF_CONNTRACK && NF_NAT
254 default NF_NAT && NF_CONNTRACK_TFTP
255
256config NF_NAT_AMANDA
257 tristate
258 depends on NF_CONNTRACK && NF_NAT
259 default NF_NAT && NF_CONNTRACK_AMANDA
260
261config NF_NAT_PPTP
262 tristate
263 depends on NF_CONNTRACK && NF_NAT
264 default NF_NAT && NF_CONNTRACK_PPTP
265 select NF_NAT_PROTO_GRE
266
267config NF_NAT_H323
268 tristate
269 depends on NF_CONNTRACK && NF_NAT
270 default NF_NAT && NF_CONNTRACK_H323
271
272config NF_NAT_SIP
273 tristate
274 depends on NF_CONNTRACK && NF_NAT
275 default NF_NAT && NF_CONNTRACK_SIP
276
277# mangle + specific targets
278config IP_NF_MANGLE
279 tristate "Packet mangling"
280 default m if NETFILTER_ADVANCED=n
281 help
282 This option adds a `mangle' table to iptables: see the man page for
283 iptables(8). This table is used for various packet alterations
284 which can effect how the packet is routed.
285
286 To compile it as a module, choose M here. If unsure, say N.
287
288config IP_NF_TARGET_CLUSTERIP
289 tristate "CLUSTERIP target support (EXPERIMENTAL)"
290 depends on IP_NF_MANGLE && EXPERIMENTAL
291 depends on NF_CONNTRACK_IPV4
292 depends on NETFILTER_ADVANCED
293 select NF_CONNTRACK_MARK
294 help
295 The CLUSTERIP target allows you to build load-balancing clusters of
296 network servers without having a dedicated load-balancing
297 router/server/switch.
298
299 To compile it as a module, choose M here. If unsure, say N.
300
301config IP_NF_TARGET_ECN
302 tristate "ECN target support"
303 depends on IP_NF_MANGLE
304 depends on NETFILTER_ADVANCED
305 ---help---
306 This option adds a `ECN' target, which can be used in the iptables mangle
307 table.
308
309 You can use this target to remove the ECN bits from the IPv4 header of
310 an IP packet. This is particularly useful, if you need to work around
311 existing ECN blackholes on the internet, but don't want to disable
312 ECN support in general.
313
314 To compile it as a module, choose M here. If unsure, say N.
315
316config IP_NF_TARGET_TTL
317 tristate '"TTL" target support'
318 depends on NETFILTER_ADVANCED && IP_NF_MANGLE
319 select NETFILTER_XT_TARGET_HL
320 ---help---
321 This is a backwards-compatible option for the user's convenience
322 (e.g. when running oldconfig). It selects
323 CONFIG_NETFILTER_XT_TARGET_HL.
324
325# raw + specific targets
326config IP_NF_RAW
327 tristate 'raw table support (required for NOTRACK/TRACE)'
328 depends on NETFILTER_ADVANCED
329 help
330 This option adds a `raw' table to iptables. This table is the very
331 first in the netfilter framework and hooks in at the PREROUTING
332 and OUTPUT chains.
333
334 If you want to compile it as a module, say M here and read
335 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
336
337# security table for MAC policy
338config IP_NF_SECURITY
339 tristate "Security table"
340 depends on SECURITY
341 depends on NETFILTER_ADVANCED
342 help
343 This option adds a `security' table to iptables, for use
344 with Mandatory Access Control (MAC) policy.
345
346 If unsure, say N.
347
348endif # IP_NF_IPTABLES
349
350# ARP tables
351config IP_NF_ARPTABLES
352 tristate "ARP tables support"
353 select NETFILTER_XTABLES
354 depends on NETFILTER_ADVANCED
355 help
356 arptables is a general, extensible packet identification framework.
357 The ARP packet filtering and mangling (manipulation)subsystems
358 use this: say Y or M here if you want to use either of those.
359
360 To compile it as a module, choose M here. If unsure, say N.
361
362if IP_NF_ARPTABLES
363
364config IP_NF_ARPFILTER
365 tristate "ARP packet filtering"
366 help
367 ARP packet filtering defines a table `filter', which has a series of
368 rules for simple ARP packet filtering at local input and
369 local output. On a bridge, you can also specify filtering rules
370 for forwarded ARP packets. See the man page for arptables(8).
371
372 To compile it as a module, choose M here. If unsure, say N.
373
374config IP_NF_ARP_MANGLE
375 tristate "ARP payload mangling"
376 help
377 Allows altering the ARP packet payload: source and destination
378 hardware and network addresses.
379
380endif # IP_NF_ARPTABLES
381
382endmenu
383