1#
  2# IP netfilter configuration
  3#
  4
  5menu "IPv6: Netfilter Configuration"
  6	depends on INET && IPV6 && NETFILTER
  7
  8config NF_DEFRAG_IPV6
  9	tristate
 10	default n
 11
 12config NF_CONNTRACK_IPV6
 13	tristate "IPv6 connection tracking support"
 14	depends on INET && IPV6 && NF_CONNTRACK
 15	default m if NETFILTER_ADVANCED=n
 16	select NF_DEFRAG_IPV6
 17	---help---
 18	  Connection tracking keeps a record of what packets have passed
 19	  through your machine, in order to figure out how they are related
 20	  into connections.
 21
 22	  This is IPv6 support on Layer 3 independent connection tracking.
 23	  Layer 3 independent connection tracking is experimental scheme
 24	  which generalize ip_conntrack to support other layer 3 protocols.
 25
 26	  To compile it as a module, choose M here.  If unsure, say N.
 27
 28config NF_SOCKET_IPV6
 29	tristate "IPv6 socket lookup support"
 30	help
 31	  This option enables the IPv6 socket lookup infrastructure. This
 32	  is used by the ip6tables socket match.
 33
 34if NF_TABLES
 35
 36config NF_TABLES_IPV6
 37	bool "IPv6 nf_tables support"
 
 38	help
 39	  This option enables the IPv6 support for nf_tables.
 40
 41if NF_TABLES_IPV6
 42
 43config NFT_CHAIN_ROUTE_IPV6
 
 44	tristate "IPv6 nf_tables route chain support"
 45	help
 46	  This option enables the "route" chain for IPv6 in nf_tables. This
 47	  chain type is used to force packet re-routing after mangling header
 48	  fields such as the source, destination, flowlabel, hop-limit and
 49	  the packet mark.
 50
 51if NF_NAT_IPV6
 52
 53config NFT_CHAIN_NAT_IPV6
 
 
 54	tristate "IPv6 nf_tables nat chain support"
 55	help
 56	  This option enables the "nat" chain for IPv6 in nf_tables. This
 57	  chain type is used to perform Network Address Translation (NAT)
 58	  packet transformations such as the source, destination address and
 59	  source and destination ports.
 60
 61config NFT_MASQ_IPV6
 62	tristate "IPv6 masquerade support for nf_tables"
 63	depends on NFT_MASQ
 64	select NF_NAT_MASQUERADE_IPV6
 65	help
 66	  This is the expression that provides IPv4 masquerading support for
 67	  nf_tables.
 68
 69config NFT_REDIR_IPV6
 70	tristate "IPv6 redirect support for nf_tables"
 71	depends on NFT_REDIR
 72	select NF_NAT_REDIRECT
 73	help
 74	  This is the expression that provides IPv4 redirect support for
 75	  nf_tables.
 76
 77endif # NF_NAT_IPV6
 78
 79config NFT_REJECT_IPV6
 80	select NF_REJECT_IPV6
 81	default NFT_REJECT
 82	tristate
 83
 84config NFT_DUP_IPV6
 85	tristate "IPv6 nf_tables packet duplication support"
 86	depends on !NF_CONNTRACK || NF_CONNTRACK
 87	select NF_DUP_IPV6
 88	help
 89	  This module enables IPv6 packet duplication support for nf_tables.
 90
 91config NFT_FIB_IPV6
 92	tristate "nf_tables fib / ipv6 route lookup support"
 93	select NFT_FIB
 94	help
 95	  This module enables IPv6 FIB lookups, e.g. for reverse path filtering.
 96	  It also allows query of the FIB for the route type, e.g. local, unicast,
 97	  multicast or blackhole.
 98
 99endif # NF_TABLES_IPV6
100endif # NF_TABLES
101
102config NF_FLOW_TABLE_IPV6
103	tristate "Netfilter flow table IPv6 module"
104	depends on NF_FLOW_TABLE
105	help
106	  This option adds the flow table IPv6 support.
107
108	  To compile it as a module, choose M here.
109
110config NF_DUP_IPV6
111	tristate "Netfilter IPv6 packet duplication to alternate destination"
112	depends on !NF_CONNTRACK || NF_CONNTRACK
113	help
114	  This option enables the nf_dup_ipv6 core, which duplicates an IPv6
115	  packet to be rerouted to another destination.
116
117config NF_REJECT_IPV6
118	tristate "IPv6 packet rejection"
119	default m if NETFILTER_ADVANCED=n
120
121config NF_LOG_IPV6
122	tristate "IPv6 packet logging"
123	default m if NETFILTER_ADVANCED=n
124	select NF_LOG_COMMON
125
126config NF_NAT_IPV6
127	tristate "IPv6 NAT"
128	depends on NF_CONNTRACK_IPV6
129	depends on NETFILTER_ADVANCED
130	select NF_NAT
131	help
132	  The IPv6 NAT option allows masquerading, port forwarding and other
133	  forms of full Network Address Port Translation. This can be
134	  controlled by iptables or nft.
135
136if NF_NAT_IPV6
137
138config NF_NAT_MASQUERADE_IPV6
139	tristate "IPv6 masquerade support"
140	help
141	  This is the kernel functionality to provide NAT in the masquerade
142	  flavour (automatic source address selection) for IPv6.
143
144endif # NF_NAT_IPV6
145
146config IP6_NF_IPTABLES
147	tristate "IP6 tables support (required for filtering)"
148	depends on INET && IPV6
149	select NETFILTER_XTABLES
150	default m if NETFILTER_ADVANCED=n
151	help
152	  ip6tables is a general, extensible packet identification framework.
153	  Currently only the packet filtering and packet mangling subsystem
154	  for IPv6 use this, but connection tracking is going to follow.
155	  Say 'Y' or 'M' here if you want to use either of those.
156
157	  To compile it as a module, choose M here.  If unsure, say N.
158
159if IP6_NF_IPTABLES
160
161# The simple matches.
162config IP6_NF_MATCH_AH
163	tristate '"ah" match support'
164	depends on NETFILTER_ADVANCED
165	help
166	  This module allows one to match AH packets.
167
168	  To compile it as a module, choose M here.  If unsure, say N.
169
170config IP6_NF_MATCH_EUI64
171	tristate '"eui64" address check'
172	depends on NETFILTER_ADVANCED
173	help
174	  This module performs checking on the IPv6 source address
175	  Compares the last 64 bits with the EUI64 (delivered
176	  from the MAC address) address
177
178	  To compile it as a module, choose M here.  If unsure, say N.
179
180config IP6_NF_MATCH_FRAG
181	tristate '"frag" Fragmentation header match support'
182	depends on NETFILTER_ADVANCED
183	help
184	  frag matching allows you to match packets based on the fragmentation
185	  header of the packet.
186
187	  To compile it as a module, choose M here.  If unsure, say N.
188
189config IP6_NF_MATCH_OPTS
190	tristate '"hbh" hop-by-hop and "dst" opts header match support'
191	depends on NETFILTER_ADVANCED
192	help
193	  This allows one to match packets based on the hop-by-hop
194	  and destination options headers of a packet.
195
196	  To compile it as a module, choose M here.  If unsure, say N.
197
198config IP6_NF_MATCH_HL
199	tristate '"hl" hoplimit match support'
200	depends on NETFILTER_ADVANCED
201	select NETFILTER_XT_MATCH_HL
202	---help---
203	This is a backwards-compat option for the user's convenience
204	(e.g. when running oldconfig). It selects
205	CONFIG_NETFILTER_XT_MATCH_HL.
206
207config IP6_NF_MATCH_IPV6HEADER
208	tristate '"ipv6header" IPv6 Extension Headers Match'
209	default m if NETFILTER_ADVANCED=n
210	help
211	  This module allows one to match packets based upon
212	  the ipv6 extension headers.
213
214	  To compile it as a module, choose M here.  If unsure, say N.
215
216config IP6_NF_MATCH_MH
217	tristate '"mh" match support'
218	depends on NETFILTER_ADVANCED
219	help
220	  This module allows one to match MH packets.
221
222	  To compile it as a module, choose M here.  If unsure, say N.
223
224config IP6_NF_MATCH_RPFILTER
225	tristate '"rpfilter" reverse path filter match support'
226	depends on NETFILTER_ADVANCED
227	depends on IP6_NF_MANGLE || IP6_NF_RAW
228	---help---
229	  This option allows you to match packets whose replies would
230	  go out via the interface the packet came in.
231
232	  To compile it as a module, choose M here.  If unsure, say N.
233	  The module will be called ip6t_rpfilter.
234
235config IP6_NF_MATCH_RT
236	tristate '"rt" Routing header match support'
237	depends on NETFILTER_ADVANCED
238	help
239	  rt matching allows you to match packets based on the routing
240	  header of the packet.
241
242	  To compile it as a module, choose M here.  If unsure, say N.
243
244config IP6_NF_MATCH_SRH
245        tristate '"srh" Segment Routing header match support'
246        depends on NETFILTER_ADVANCED
247        help
248          srh matching allows you to match packets based on the segment
249	  routing header of the packet.
250
251          To compile it as a module, choose M here.  If unsure, say N.
252
253# The targets
254config IP6_NF_TARGET_HL
255	tristate '"HL" hoplimit target support'
256	depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
257	select NETFILTER_XT_TARGET_HL
258	---help---
259	This is a backwards-compatible option for the user's convenience
260	(e.g. when running oldconfig). It selects
261	CONFIG_NETFILTER_XT_TARGET_HL.
262
263config IP6_NF_FILTER
264	tristate "Packet filtering"
265	default m if NETFILTER_ADVANCED=n
266	help
267	  Packet filtering defines a table `filter', which has a series of
268	  rules for simple packet filtering at local input, forwarding and
269	  local output.  See the man page for iptables(8).
270
271	  To compile it as a module, choose M here.  If unsure, say N.
272
273config IP6_NF_TARGET_REJECT
274	tristate "REJECT target support"
275	depends on IP6_NF_FILTER
276	select NF_REJECT_IPV6
277	default m if NETFILTER_ADVANCED=n
278	help
279	  The REJECT target allows a filtering rule to specify that an ICMPv6
280	  error should be issued in response to an incoming packet, rather
281	  than silently being dropped.
282
283	  To compile it as a module, choose M here.  If unsure, say N.
284
285config IP6_NF_TARGET_SYNPROXY
286	tristate "SYNPROXY target support"
287	depends on NF_CONNTRACK && NETFILTER_ADVANCED
288	select NETFILTER_SYNPROXY
289	select SYN_COOKIES
290	help
291	  The SYNPROXY target allows you to intercept TCP connections and
292	  establish them using syncookies before they are passed on to the
293	  server. This allows to avoid conntrack and server resource usage
294	  during SYN-flood attacks.
295
296	  To compile it as a module, choose M here. If unsure, say N.
297
298config IP6_NF_MANGLE
299	tristate "Packet mangling"
300	default m if NETFILTER_ADVANCED=n
301	help
302	  This option adds a `mangle' table to iptables: see the man page for
303	  iptables(8).  This table is used for various packet alterations
304	  which can effect how the packet is routed.
305
306	  To compile it as a module, choose M here.  If unsure, say N.
307
308config IP6_NF_RAW
309	tristate  'raw table support (required for TRACE)'
310	help
311	  This option adds a `raw' table to ip6tables. This table is the very
312	  first in the netfilter framework and hooks in at the PREROUTING
313	  and OUTPUT chains.
314
315	  If you want to compile it as a module, say M here and read
316	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
317
318# security table for MAC policy
319config IP6_NF_SECURITY
320       tristate "Security table"
321       depends on SECURITY
322       depends on NETFILTER_ADVANCED
323       help
324         This option adds a `security' table to iptables, for use
325         with Mandatory Access Control (MAC) policy.
326
327         If unsure, say N.
328
329config IP6_NF_NAT
330	tristate "ip6tables NAT support"
331	depends on NF_CONNTRACK_IPV6
332	depends on NETFILTER_ADVANCED
333	select NF_NAT
334	select NF_NAT_IPV6
335	select NETFILTER_XT_NAT
336	help
337	  This enables the `nat' table in ip6tables. This allows masquerading,
338	  port forwarding and other forms of full Network Address Port
339	  Translation.
340
341	  To compile it as a module, choose M here.  If unsure, say N.
342
343if IP6_NF_NAT
344
345config IP6_NF_TARGET_MASQUERADE
346	tristate "MASQUERADE target support"
347	select NF_NAT_MASQUERADE_IPV6
348	help
349	  Masquerading is a special case of NAT: all outgoing connections are
350	  changed to seem to come from a particular interface's address, and
351	  if the interface goes down, those connections are lost.  This is
352	  only useful for dialup accounts with dynamic IP address (ie. your IP
353	  address will be different on next dialup).
354
355	  To compile it as a module, choose M here.  If unsure, say N.
356
357config IP6_NF_TARGET_NPT
358	tristate "NPT (Network Prefix translation) target support"
359	help
360	  This option adds the `SNPT' and `DNPT' target, which perform
361	  stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
362
363	  To compile it as a module, choose M here.  If unsure, say N.
364
365endif # IP6_NF_NAT
366
367endif # IP6_NF_IPTABLES
368
369endmenu
370

  1#
  2# IP netfilter configuration
  3#
  4
  5menu "IPv6: Netfilter Configuration"
  6	depends on INET && IPV6 && NETFILTER
  7
  8config NF_DEFRAG_IPV6
  9	tristate
 10	default n
 11
 12config NF_CONNTRACK_IPV6
 13	tristate "IPv6 connection tracking support"
 14	depends on INET && IPV6 && NF_CONNTRACK
 15	default m if NETFILTER_ADVANCED=n
 16	select NF_DEFRAG_IPV6
 17	---help---
 18	  Connection tracking keeps a record of what packets have passed
 19	  through your machine, in order to figure out how they are related
 20	  into connections.
 21
 22	  This is IPv6 support on Layer 3 independent connection tracking.
 23	  Layer 3 independent connection tracking is experimental scheme
 24	  which generalize ip_conntrack to support other layer 3 protocols.
 25
 26	  To compile it as a module, choose M here.  If unsure, say N.
 27
 
 
 
 
 
 
 
 
 28config NF_TABLES_IPV6
 29	depends on NF_TABLES
 30	tristate "IPv6 nf_tables support"
 31	help
 32	  This option enables the IPv6 support for nf_tables.
 33
 
 
 34config NFT_CHAIN_ROUTE_IPV6
 35	depends on NF_TABLES_IPV6
 36	tristate "IPv6 nf_tables route chain support"
 37	help
 38	  This option enables the "route" chain for IPv6 in nf_tables. This
 39	  chain type is used to force packet re-routing after mangling header
 40	  fields such as the source, destination, flowlabel, hop-limit and
 41	  the packet mark.
 42
 
 
 43config NFT_CHAIN_NAT_IPV6
 44	depends on NF_TABLES_IPV6
 45	depends on NF_NAT_IPV6 && NFT_NAT
 46	tristate "IPv6 nf_tables nat chain support"
 47	help
 48	  This option enables the "nat" chain for IPv6 in nf_tables. This
 49	  chain type is used to perform Network Address Translation (NAT)
 50	  packet transformations such as the source, destination address and
 51	  source and destination ports.
 52
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 53config NFT_REJECT_IPV6
 54	depends on NF_TABLES_IPV6
 55	default NFT_REJECT
 56	tristate
 57
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 58config IP6_NF_IPTABLES
 59	tristate "IP6 tables support (required for filtering)"
 60	depends on INET && IPV6
 61	select NETFILTER_XTABLES
 62	default m if NETFILTER_ADVANCED=n
 63	help
 64	  ip6tables is a general, extensible packet identification framework.
 65	  Currently only the packet filtering and packet mangling subsystem
 66	  for IPv6 use this, but connection tracking is going to follow.
 67	  Say 'Y' or 'M' here if you want to use either of those.
 68
 69	  To compile it as a module, choose M here.  If unsure, say N.
 70
 71if IP6_NF_IPTABLES
 72
 73# The simple matches.
 74config IP6_NF_MATCH_AH
 75	tristate '"ah" match support'
 76	depends on NETFILTER_ADVANCED
 77	help
 78	  This module allows one to match AH packets.
 79
 80	  To compile it as a module, choose M here.  If unsure, say N.
 81
 82config IP6_NF_MATCH_EUI64
 83	tristate '"eui64" address check'
 84	depends on NETFILTER_ADVANCED
 85	help
 86	  This module performs checking on the IPv6 source address
 87	  Compares the last 64 bits with the EUI64 (delivered
 88	  from the MAC address) address
 89
 90	  To compile it as a module, choose M here.  If unsure, say N.
 91
 92config IP6_NF_MATCH_FRAG
 93	tristate '"frag" Fragmentation header match support'
 94	depends on NETFILTER_ADVANCED
 95	help
 96	  frag matching allows you to match packets based on the fragmentation
 97	  header of the packet.
 98
 99	  To compile it as a module, choose M here.  If unsure, say N.
100
101config IP6_NF_MATCH_OPTS
102	tristate '"hbh" hop-by-hop and "dst" opts header match support'
103	depends on NETFILTER_ADVANCED
104	help
105	  This allows one to match packets based on the hop-by-hop
106	  and destination options headers of a packet.
107
108	  To compile it as a module, choose M here.  If unsure, say N.
109
110config IP6_NF_MATCH_HL
111	tristate '"hl" hoplimit match support'
112	depends on NETFILTER_ADVANCED
113	select NETFILTER_XT_MATCH_HL
114	---help---
115	This is a backwards-compat option for the user's convenience
116	(e.g. when running oldconfig). It selects
117	CONFIG_NETFILTER_XT_MATCH_HL.
118
119config IP6_NF_MATCH_IPV6HEADER
120	tristate '"ipv6header" IPv6 Extension Headers Match'
121	default m if NETFILTER_ADVANCED=n
122	help
123	  This module allows one to match packets based upon
124	  the ipv6 extension headers.
125
126	  To compile it as a module, choose M here.  If unsure, say N.
127
128config IP6_NF_MATCH_MH
129	tristate '"mh" match support'
130	depends on NETFILTER_ADVANCED
131	help
132	  This module allows one to match MH packets.
133
134	  To compile it as a module, choose M here.  If unsure, say N.
135
136config IP6_NF_MATCH_RPFILTER
137	tristate '"rpfilter" reverse path filter match support'
138	depends on NETFILTER_ADVANCED && (IP6_NF_MANGLE || IP6_NF_RAW)
 
139	---help---
140	  This option allows you to match packets whose replies would
141	  go out via the interface the packet came in.
142
143	  To compile it as a module, choose M here.  If unsure, say N.
144	  The module will be called ip6t_rpfilter.
145
146config IP6_NF_MATCH_RT
147	tristate '"rt" Routing header match support'
148	depends on NETFILTER_ADVANCED
149	help
150	  rt matching allows you to match packets based on the routing
151	  header of the packet.
152
153	  To compile it as a module, choose M here.  If unsure, say N.
154
 
 
 
 
 
 
 
 
 
155# The targets
156config IP6_NF_TARGET_HL
157	tristate '"HL" hoplimit target support'
158	depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
159	select NETFILTER_XT_TARGET_HL
160	---help---
161	This is a backwards-compatible option for the user's convenience
162	(e.g. when running oldconfig). It selects
163	CONFIG_NETFILTER_XT_TARGET_HL.
164
165config IP6_NF_FILTER
166	tristate "Packet filtering"
167	default m if NETFILTER_ADVANCED=n
168	help
169	  Packet filtering defines a table `filter', which has a series of
170	  rules for simple packet filtering at local input, forwarding and
171	  local output.  See the man page for iptables(8).
172
173	  To compile it as a module, choose M here.  If unsure, say N.
174
175config IP6_NF_TARGET_REJECT
176	tristate "REJECT target support"
177	depends on IP6_NF_FILTER
 
178	default m if NETFILTER_ADVANCED=n
179	help
180	  The REJECT target allows a filtering rule to specify that an ICMPv6
181	  error should be issued in response to an incoming packet, rather
182	  than silently being dropped.
183
184	  To compile it as a module, choose M here.  If unsure, say N.
185
186config IP6_NF_TARGET_SYNPROXY
187	tristate "SYNPROXY target support"
188	depends on NF_CONNTRACK && NETFILTER_ADVANCED
189	select NETFILTER_SYNPROXY
190	select SYN_COOKIES
191	help
192	  The SYNPROXY target allows you to intercept TCP connections and
193	  establish them using syncookies before they are passed on to the
194	  server. This allows to avoid conntrack and server resource usage
195	  during SYN-flood attacks.
196
197	  To compile it as a module, choose M here. If unsure, say N.
198
199config IP6_NF_MANGLE
200	tristate "Packet mangling"
201	default m if NETFILTER_ADVANCED=n
202	help
203	  This option adds a `mangle' table to iptables: see the man page for
204	  iptables(8).  This table is used for various packet alterations
205	  which can effect how the packet is routed.
206
207	  To compile it as a module, choose M here.  If unsure, say N.
208
209config IP6_NF_RAW
210	tristate  'raw table support (required for TRACE)'
211	help
212	  This option adds a `raw' table to ip6tables. This table is the very
213	  first in the netfilter framework and hooks in at the PREROUTING
214	  and OUTPUT chains.
215
216	  If you want to compile it as a module, say M here and read
217	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
218
219# security table for MAC policy
220config IP6_NF_SECURITY
221       tristate "Security table"
222       depends on SECURITY
223       depends on NETFILTER_ADVANCED
224       help
225         This option adds a `security' table to iptables, for use
226         with Mandatory Access Control (MAC) policy.
227
228         If unsure, say N.
229
230config NF_NAT_IPV6
231	tristate "IPv6 NAT"
232	depends on NF_CONNTRACK_IPV6
233	depends on NETFILTER_ADVANCED
234	select NF_NAT
 
 
235	help
236	  The IPv6 NAT option allows masquerading, port forwarding and other
237	  forms of full Network Address Port Translation. It is controlled by
238	  the `nat' table in ip6tables, see the man page for ip6tables(8).
239
240	  To compile it as a module, choose M here.  If unsure, say N.
241
242if NF_NAT_IPV6
243
244config IP6_NF_TARGET_MASQUERADE
245	tristate "MASQUERADE target support"
 
246	help
247	  Masquerading is a special case of NAT: all outgoing connections are
248	  changed to seem to come from a particular interface's address, and
249	  if the interface goes down, those connections are lost.  This is
250	  only useful for dialup accounts with dynamic IP address (ie. your IP
251	  address will be different on next dialup).
252
253	  To compile it as a module, choose M here.  If unsure, say N.
254
255config IP6_NF_TARGET_NPT
256	tristate "NPT (Network Prefix translation) target support"
257	help
258	  This option adds the `SNPT' and `DNPT' target, which perform
259	  stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
260
261	  To compile it as a module, choose M here.  If unsure, say N.
262
263endif # NF_NAT_IPV6
264
265endif # IP6_NF_IPTABLES
266
267endmenu
268