Loading...
1#
2# IP netfilter configuration
3#
4
5menu "IPv6: Netfilter Configuration"
6 depends on INET && IPV6 && NETFILTER
7
8config NF_DEFRAG_IPV6
9 tristate
10 default n
11
12config NF_CONNTRACK_IPV6
13 tristate "IPv6 connection tracking support"
14 depends on INET && IPV6 && NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
16 select NF_DEFRAG_IPV6
17 ---help---
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
20 into connections.
21
22 This is IPv6 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
25
26 To compile it as a module, choose M here. If unsure, say N.
27
28config NF_SOCKET_IPV6
29 tristate "IPv6 socket lookup support"
30 help
31 This option enables the IPv6 socket lookup infrastructure. This
32 is used by the ip6tables socket match.
33
34if NF_TABLES
35
36config NF_TABLES_IPV6
37 bool "IPv6 nf_tables support"
38 help
39 This option enables the IPv6 support for nf_tables.
40
41if NF_TABLES_IPV6
42
43config NFT_CHAIN_ROUTE_IPV6
44 tristate "IPv6 nf_tables route chain support"
45 help
46 This option enables the "route" chain for IPv6 in nf_tables. This
47 chain type is used to force packet re-routing after mangling header
48 fields such as the source, destination, flowlabel, hop-limit and
49 the packet mark.
50
51if NF_NAT_IPV6
52
53config NFT_CHAIN_NAT_IPV6
54 tristate "IPv6 nf_tables nat chain support"
55 help
56 This option enables the "nat" chain for IPv6 in nf_tables. This
57 chain type is used to perform Network Address Translation (NAT)
58 packet transformations such as the source, destination address and
59 source and destination ports.
60
61config NFT_MASQ_IPV6
62 tristate "IPv6 masquerade support for nf_tables"
63 depends on NFT_MASQ
64 select NF_NAT_MASQUERADE_IPV6
65 help
66 This is the expression that provides IPv4 masquerading support for
67 nf_tables.
68
69config NFT_REDIR_IPV6
70 tristate "IPv6 redirect support for nf_tables"
71 depends on NFT_REDIR
72 select NF_NAT_REDIRECT
73 help
74 This is the expression that provides IPv4 redirect support for
75 nf_tables.
76
77endif # NF_NAT_IPV6
78
79config NFT_REJECT_IPV6
80 select NF_REJECT_IPV6
81 default NFT_REJECT
82 tristate
83
84config NFT_DUP_IPV6
85 tristate "IPv6 nf_tables packet duplication support"
86 depends on !NF_CONNTRACK || NF_CONNTRACK
87 select NF_DUP_IPV6
88 help
89 This module enables IPv6 packet duplication support for nf_tables.
90
91config NFT_FIB_IPV6
92 tristate "nf_tables fib / ipv6 route lookup support"
93 select NFT_FIB
94 help
95 This module enables IPv6 FIB lookups, e.g. for reverse path filtering.
96 It also allows query of the FIB for the route type, e.g. local, unicast,
97 multicast or blackhole.
98
99endif # NF_TABLES_IPV6
100endif # NF_TABLES
101
102config NF_FLOW_TABLE_IPV6
103 tristate "Netfilter flow table IPv6 module"
104 depends on NF_FLOW_TABLE
105 help
106 This option adds the flow table IPv6 support.
107
108 To compile it as a module, choose M here.
109
110config NF_DUP_IPV6
111 tristate "Netfilter IPv6 packet duplication to alternate destination"
112 depends on !NF_CONNTRACK || NF_CONNTRACK
113 help
114 This option enables the nf_dup_ipv6 core, which duplicates an IPv6
115 packet to be rerouted to another destination.
116
117config NF_REJECT_IPV6
118 tristate "IPv6 packet rejection"
119 default m if NETFILTER_ADVANCED=n
120
121config NF_LOG_IPV6
122 tristate "IPv6 packet logging"
123 default m if NETFILTER_ADVANCED=n
124 select NF_LOG_COMMON
125
126config NF_NAT_IPV6
127 tristate "IPv6 NAT"
128 depends on NF_CONNTRACK_IPV6
129 depends on NETFILTER_ADVANCED
130 select NF_NAT
131 help
132 The IPv6 NAT option allows masquerading, port forwarding and other
133 forms of full Network Address Port Translation. This can be
134 controlled by iptables or nft.
135
136if NF_NAT_IPV6
137
138config NF_NAT_MASQUERADE_IPV6
139 tristate "IPv6 masquerade support"
140 help
141 This is the kernel functionality to provide NAT in the masquerade
142 flavour (automatic source address selection) for IPv6.
143
144endif # NF_NAT_IPV6
145
146config IP6_NF_IPTABLES
147 tristate "IP6 tables support (required for filtering)"
148 depends on INET && IPV6
149 select NETFILTER_XTABLES
150 default m if NETFILTER_ADVANCED=n
151 help
152 ip6tables is a general, extensible packet identification framework.
153 Currently only the packet filtering and packet mangling subsystem
154 for IPv6 use this, but connection tracking is going to follow.
155 Say 'Y' or 'M' here if you want to use either of those.
156
157 To compile it as a module, choose M here. If unsure, say N.
158
159if IP6_NF_IPTABLES
160
161# The simple matches.
162config IP6_NF_MATCH_AH
163 tristate '"ah" match support'
164 depends on NETFILTER_ADVANCED
165 help
166 This module allows one to match AH packets.
167
168 To compile it as a module, choose M here. If unsure, say N.
169
170config IP6_NF_MATCH_EUI64
171 tristate '"eui64" address check'
172 depends on NETFILTER_ADVANCED
173 help
174 This module performs checking on the IPv6 source address
175 Compares the last 64 bits with the EUI64 (delivered
176 from the MAC address) address
177
178 To compile it as a module, choose M here. If unsure, say N.
179
180config IP6_NF_MATCH_FRAG
181 tristate '"frag" Fragmentation header match support'
182 depends on NETFILTER_ADVANCED
183 help
184 frag matching allows you to match packets based on the fragmentation
185 header of the packet.
186
187 To compile it as a module, choose M here. If unsure, say N.
188
189config IP6_NF_MATCH_OPTS
190 tristate '"hbh" hop-by-hop and "dst" opts header match support'
191 depends on NETFILTER_ADVANCED
192 help
193 This allows one to match packets based on the hop-by-hop
194 and destination options headers of a packet.
195
196 To compile it as a module, choose M here. If unsure, say N.
197
198config IP6_NF_MATCH_HL
199 tristate '"hl" hoplimit match support'
200 depends on NETFILTER_ADVANCED
201 select NETFILTER_XT_MATCH_HL
202 ---help---
203 This is a backwards-compat option for the user's convenience
204 (e.g. when running oldconfig). It selects
205 CONFIG_NETFILTER_XT_MATCH_HL.
206
207config IP6_NF_MATCH_IPV6HEADER
208 tristate '"ipv6header" IPv6 Extension Headers Match'
209 default m if NETFILTER_ADVANCED=n
210 help
211 This module allows one to match packets based upon
212 the ipv6 extension headers.
213
214 To compile it as a module, choose M here. If unsure, say N.
215
216config IP6_NF_MATCH_MH
217 tristate '"mh" match support'
218 depends on NETFILTER_ADVANCED
219 help
220 This module allows one to match MH packets.
221
222 To compile it as a module, choose M here. If unsure, say N.
223
224config IP6_NF_MATCH_RPFILTER
225 tristate '"rpfilter" reverse path filter match support'
226 depends on NETFILTER_ADVANCED
227 depends on IP6_NF_MANGLE || IP6_NF_RAW
228 ---help---
229 This option allows you to match packets whose replies would
230 go out via the interface the packet came in.
231
232 To compile it as a module, choose M here. If unsure, say N.
233 The module will be called ip6t_rpfilter.
234
235config IP6_NF_MATCH_RT
236 tristate '"rt" Routing header match support'
237 depends on NETFILTER_ADVANCED
238 help
239 rt matching allows you to match packets based on the routing
240 header of the packet.
241
242 To compile it as a module, choose M here. If unsure, say N.
243
244config IP6_NF_MATCH_SRH
245 tristate '"srh" Segment Routing header match support'
246 depends on NETFILTER_ADVANCED
247 help
248 srh matching allows you to match packets based on the segment
249 routing header of the packet.
250
251 To compile it as a module, choose M here. If unsure, say N.
252
253# The targets
254config IP6_NF_TARGET_HL
255 tristate '"HL" hoplimit target support'
256 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
257 select NETFILTER_XT_TARGET_HL
258 ---help---
259 This is a backwards-compatible option for the user's convenience
260 (e.g. when running oldconfig). It selects
261 CONFIG_NETFILTER_XT_TARGET_HL.
262
263config IP6_NF_FILTER
264 tristate "Packet filtering"
265 default m if NETFILTER_ADVANCED=n
266 help
267 Packet filtering defines a table `filter', which has a series of
268 rules for simple packet filtering at local input, forwarding and
269 local output. See the man page for iptables(8).
270
271 To compile it as a module, choose M here. If unsure, say N.
272
273config IP6_NF_TARGET_REJECT
274 tristate "REJECT target support"
275 depends on IP6_NF_FILTER
276 select NF_REJECT_IPV6
277 default m if NETFILTER_ADVANCED=n
278 help
279 The REJECT target allows a filtering rule to specify that an ICMPv6
280 error should be issued in response to an incoming packet, rather
281 than silently being dropped.
282
283 To compile it as a module, choose M here. If unsure, say N.
284
285config IP6_NF_TARGET_SYNPROXY
286 tristate "SYNPROXY target support"
287 depends on NF_CONNTRACK && NETFILTER_ADVANCED
288 select NETFILTER_SYNPROXY
289 select SYN_COOKIES
290 help
291 The SYNPROXY target allows you to intercept TCP connections and
292 establish them using syncookies before they are passed on to the
293 server. This allows to avoid conntrack and server resource usage
294 during SYN-flood attacks.
295
296 To compile it as a module, choose M here. If unsure, say N.
297
298config IP6_NF_MANGLE
299 tristate "Packet mangling"
300 default m if NETFILTER_ADVANCED=n
301 help
302 This option adds a `mangle' table to iptables: see the man page for
303 iptables(8). This table is used for various packet alterations
304 which can effect how the packet is routed.
305
306 To compile it as a module, choose M here. If unsure, say N.
307
308config IP6_NF_RAW
309 tristate 'raw table support (required for TRACE)'
310 help
311 This option adds a `raw' table to ip6tables. This table is the very
312 first in the netfilter framework and hooks in at the PREROUTING
313 and OUTPUT chains.
314
315 If you want to compile it as a module, say M here and read
316 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
317
318# security table for MAC policy
319config IP6_NF_SECURITY
320 tristate "Security table"
321 depends on SECURITY
322 depends on NETFILTER_ADVANCED
323 help
324 This option adds a `security' table to iptables, for use
325 with Mandatory Access Control (MAC) policy.
326
327 If unsure, say N.
328
329config IP6_NF_NAT
330 tristate "ip6tables NAT support"
331 depends on NF_CONNTRACK_IPV6
332 depends on NETFILTER_ADVANCED
333 select NF_NAT
334 select NF_NAT_IPV6
335 select NETFILTER_XT_NAT
336 help
337 This enables the `nat' table in ip6tables. This allows masquerading,
338 port forwarding and other forms of full Network Address Port
339 Translation.
340
341 To compile it as a module, choose M here. If unsure, say N.
342
343if IP6_NF_NAT
344
345config IP6_NF_TARGET_MASQUERADE
346 tristate "MASQUERADE target support"
347 select NF_NAT_MASQUERADE_IPV6
348 help
349 Masquerading is a special case of NAT: all outgoing connections are
350 changed to seem to come from a particular interface's address, and
351 if the interface goes down, those connections are lost. This is
352 only useful for dialup accounts with dynamic IP address (ie. your IP
353 address will be different on next dialup).
354
355 To compile it as a module, choose M here. If unsure, say N.
356
357config IP6_NF_TARGET_NPT
358 tristate "NPT (Network Prefix translation) target support"
359 help
360 This option adds the `SNPT' and `DNPT' target, which perform
361 stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
362
363 To compile it as a module, choose M here. If unsure, say N.
364
365endif # IP6_NF_NAT
366
367endif # IP6_NF_IPTABLES
368
369endmenu
370
1#
2# IP netfilter configuration
3#
4
5menu "IPv6: Netfilter Configuration"
6 depends on INET && IPV6 && NETFILTER
7
8config NF_DEFRAG_IPV6
9 tristate
10 default n
11
12config NF_CONNTRACK_IPV6
13 tristate "IPv6 connection tracking support"
14 depends on INET && IPV6 && NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
16 select NF_DEFRAG_IPV6
17 ---help---
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
20 into connections.
21
22 This is IPv6 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
25
26 To compile it as a module, choose M here. If unsure, say N.
27
28config IP6_NF_QUEUE
29 tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
30 depends on INET && IPV6 && NETFILTER
31 depends on NETFILTER_ADVANCED
32 ---help---
33
34 This option adds a queue handler to the kernel for IPv6
35 packets which enables users to receive the filtered packets
36 with QUEUE target using libipq.
37
38 This option enables the old IPv6-only "ip6_queue" implementation
39 which has been obsoleted by the new "nfnetlink_queue" code (see
40 CONFIG_NETFILTER_NETLINK_QUEUE).
41
42 (C) Fernando Anton 2001
43 IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
44 Universidad Carlos III de Madrid
45 Universidad Politecnica de Alcala de Henares
46 email: <fanton@it.uc3m.es>.
47
48 To compile it as a module, choose M here. If unsure, say N.
49
50config IP6_NF_IPTABLES
51 tristate "IP6 tables support (required for filtering)"
52 depends on INET && IPV6
53 select NETFILTER_XTABLES
54 default m if NETFILTER_ADVANCED=n
55 help
56 ip6tables is a general, extensible packet identification framework.
57 Currently only the packet filtering and packet mangling subsystem
58 for IPv6 use this, but connection tracking is going to follow.
59 Say 'Y' or 'M' here if you want to use either of those.
60
61 To compile it as a module, choose M here. If unsure, say N.
62
63if IP6_NF_IPTABLES
64
65# The simple matches.
66config IP6_NF_MATCH_AH
67 tristate '"ah" match support'
68 depends on NETFILTER_ADVANCED
69 help
70 This module allows one to match AH packets.
71
72 To compile it as a module, choose M here. If unsure, say N.
73
74config IP6_NF_MATCH_EUI64
75 tristate '"eui64" address check'
76 depends on NETFILTER_ADVANCED
77 help
78 This module performs checking on the IPv6 source address
79 Compares the last 64 bits with the EUI64 (delivered
80 from the MAC address) address
81
82 To compile it as a module, choose M here. If unsure, say N.
83
84config IP6_NF_MATCH_FRAG
85 tristate '"frag" Fragmentation header match support'
86 depends on NETFILTER_ADVANCED
87 help
88 frag matching allows you to match packets based on the fragmentation
89 header of the packet.
90
91 To compile it as a module, choose M here. If unsure, say N.
92
93config IP6_NF_MATCH_OPTS
94 tristate '"hbh" hop-by-hop and "dst" opts header match support'
95 depends on NETFILTER_ADVANCED
96 help
97 This allows one to match packets based on the hop-by-hop
98 and destination options headers of a packet.
99
100 To compile it as a module, choose M here. If unsure, say N.
101
102config IP6_NF_MATCH_HL
103 tristate '"hl" hoplimit match support'
104 depends on NETFILTER_ADVANCED
105 select NETFILTER_XT_MATCH_HL
106 ---help---
107 This is a backwards-compat option for the user's convenience
108 (e.g. when running oldconfig). It selects
109 CONFIG_NETFILTER_XT_MATCH_HL.
110
111config IP6_NF_MATCH_IPV6HEADER
112 tristate '"ipv6header" IPv6 Extension Headers Match'
113 default m if NETFILTER_ADVANCED=n
114 help
115 This module allows one to match packets based upon
116 the ipv6 extension headers.
117
118 To compile it as a module, choose M here. If unsure, say N.
119
120config IP6_NF_MATCH_MH
121 tristate '"mh" match support'
122 depends on NETFILTER_ADVANCED
123 help
124 This module allows one to match MH packets.
125
126 To compile it as a module, choose M here. If unsure, say N.
127
128config IP6_NF_MATCH_RT
129 tristate '"rt" Routing header match support'
130 depends on NETFILTER_ADVANCED
131 help
132 rt matching allows you to match packets based on the routing
133 header of the packet.
134
135 To compile it as a module, choose M here. If unsure, say N.
136
137# The targets
138config IP6_NF_TARGET_HL
139 tristate '"HL" hoplimit target support'
140 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
141 select NETFILTER_XT_TARGET_HL
142 ---help---
143 This is a backwards-compatible option for the user's convenience
144 (e.g. when running oldconfig). It selects
145 CONFIG_NETFILTER_XT_TARGET_HL.
146
147config IP6_NF_TARGET_LOG
148 tristate "LOG target support"
149 default m if NETFILTER_ADVANCED=n
150 help
151 This option adds a `LOG' target, which allows you to create rules in
152 any iptables table which records the packet header to the syslog.
153
154 To compile it as a module, choose M here. If unsure, say N.
155
156config IP6_NF_FILTER
157 tristate "Packet filtering"
158 default m if NETFILTER_ADVANCED=n
159 help
160 Packet filtering defines a table `filter', which has a series of
161 rules for simple packet filtering at local input, forwarding and
162 local output. See the man page for iptables(8).
163
164 To compile it as a module, choose M here. If unsure, say N.
165
166config IP6_NF_TARGET_REJECT
167 tristate "REJECT target support"
168 depends on IP6_NF_FILTER
169 default m if NETFILTER_ADVANCED=n
170 help
171 The REJECT target allows a filtering rule to specify that an ICMPv6
172 error should be issued in response to an incoming packet, rather
173 than silently being dropped.
174
175 To compile it as a module, choose M here. If unsure, say N.
176
177config IP6_NF_MANGLE
178 tristate "Packet mangling"
179 default m if NETFILTER_ADVANCED=n
180 help
181 This option adds a `mangle' table to iptables: see the man page for
182 iptables(8). This table is used for various packet alterations
183 which can effect how the packet is routed.
184
185 To compile it as a module, choose M here. If unsure, say N.
186
187config IP6_NF_RAW
188 tristate 'raw table support (required for TRACE)'
189 depends on NETFILTER_ADVANCED
190 help
191 This option adds a `raw' table to ip6tables. This table is the very
192 first in the netfilter framework and hooks in at the PREROUTING
193 and OUTPUT chains.
194
195 If you want to compile it as a module, say M here and read
196 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
197
198# security table for MAC policy
199config IP6_NF_SECURITY
200 tristate "Security table"
201 depends on SECURITY
202 depends on NETFILTER_ADVANCED
203 help
204 This option adds a `security' table to iptables, for use
205 with Mandatory Access Control (MAC) policy.
206
207 If unsure, say N.
208
209endif # IP6_NF_IPTABLES
210
211endmenu
212