1#
  2# IP netfilter configuration
  3#
  4
  5menu "IP: Netfilter Configuration"
  6	depends on INET && NETFILTER
  7
  8config NF_DEFRAG_IPV4
  9	tristate
 10	default n
 11
 12config NF_CONNTRACK_IPV4
 13	tristate "IPv4 connection tracking support (required for NAT)"
 14	depends on NF_CONNTRACK
 15	default m if NETFILTER_ADVANCED=n
 16	select NF_DEFRAG_IPV4
 17	---help---
 18	  Connection tracking keeps a record of what packets have passed
 19	  through your machine, in order to figure out how they are related
 20	  into connections.
 21
 22	  This is IPv4 support on Layer 3 independent connection tracking.
 23	  Layer 3 independent connection tracking is experimental scheme
 24	  which generalize ip_conntrack to support other layer 3 protocols.
 25
 26	  To compile it as a module, choose M here.  If unsure, say N.
 27
 28config NF_SOCKET_IPV4
 29	tristate "IPv4 socket lookup support"
 30	help
 31	  This option enables the IPv4 socket lookup infrastructure. This is
 32	  is required by the iptables socket match.
 33
 34if NF_TABLES
 35
 36config NF_TABLES_IPV4
 37	bool "IPv4 nf_tables support"
 38	help
 39	  This option enables the IPv4 support for nf_tables.
 40
 41if NF_TABLES_IPV4
 42
 43config NFT_CHAIN_ROUTE_IPV4
 44	tristate "IPv4 nf_tables route chain support"
 45	help
 46	  This option enables the "route" chain for IPv4 in nf_tables. This
 47	  chain type is used to force packet re-routing after mangling header
 48	  fields such as the source, destination, type of service and
 49	  the packet mark.
 50
 51config NFT_REJECT_IPV4
 52	select NF_REJECT_IPV4
 53	default NFT_REJECT
 54	tristate
 55
 56config NFT_DUP_IPV4
 57	tristate "IPv4 nf_tables packet duplication support"
 58	depends on !NF_CONNTRACK || NF_CONNTRACK
 59	select NF_DUP_IPV4
 60	help
 61	  This module enables IPv4 packet duplication support for nf_tables.
 62
 63config NFT_FIB_IPV4
 64	select NFT_FIB
 65	tristate "nf_tables fib / ip route lookup support"
 66	help
 67	  This module enables IPv4 FIB lookups, e.g. for reverse path filtering.
 68	  It also allows query of the FIB for the route type, e.g. local, unicast,
 69	  multicast or blackhole.
 70
 71endif # NF_TABLES_IPV4
 72
 73config NF_TABLES_ARP
 74	bool "ARP nf_tables support"
 75	select NETFILTER_FAMILY_ARP
 76	help
 77	  This option enables the ARP support for nf_tables.
 78
 79endif # NF_TABLES
 80
 81config NF_FLOW_TABLE_IPV4
 82	tristate "Netfilter flow table IPv4 module"
 83	depends on NF_FLOW_TABLE
 84	help
 85	  This option adds the flow table IPv4 support.
 86
 87	  To compile it as a module, choose M here.
 88
 89config NF_DUP_IPV4
 90	tristate "Netfilter IPv4 packet duplication to alternate destination"
 91	depends on !NF_CONNTRACK || NF_CONNTRACK
 92	help
 93	  This option enables the nf_dup_ipv4 core, which duplicates an IPv4
 94	  packet to be rerouted to another destination.
 95
 96config NF_LOG_ARP
 97	tristate "ARP packet logging"
 98	default m if NETFILTER_ADVANCED=n
 99	select NF_LOG_COMMON
100
101config NF_LOG_IPV4
102	tristate "IPv4 packet logging"
103	default m if NETFILTER_ADVANCED=n
104	select NF_LOG_COMMON
105
106config NF_REJECT_IPV4
107	tristate "IPv4 packet rejection"
108	default m if NETFILTER_ADVANCED=n
109
110config NF_NAT_IPV4
111	tristate "IPv4 NAT"
112	depends on NF_CONNTRACK_IPV4
113	default m if NETFILTER_ADVANCED=n
114	select NF_NAT
115	help
116	  The IPv4 NAT option allows masquerading, port forwarding and other
117	  forms of full Network Address Port Translation. This can be
118	  controlled by iptables or nft.
119
120if NF_NAT_IPV4
121
122config NFT_CHAIN_NAT_IPV4
123	depends on NF_TABLES_IPV4
124	tristate "IPv4 nf_tables nat chain support"
125	help
126	  This option enables the "nat" chain for IPv4 in nf_tables. This
127	  chain type is used to perform Network Address Translation (NAT)
128	  packet transformations such as the source, destination address and
129	  source and destination ports.
130
131config NF_NAT_MASQUERADE_IPV4
132	tristate "IPv4 masquerade support"
133	help
134	  This is the kernel functionality to provide NAT in the masquerade
135	  flavour (automatic source address selection).
136
137config NFT_MASQ_IPV4
138	tristate "IPv4 masquerading support for nf_tables"
139	depends on NF_TABLES_IPV4
140	depends on NFT_MASQ
141	select NF_NAT_MASQUERADE_IPV4
142	help
143	  This is the expression that provides IPv4 masquerading support for
144	  nf_tables.
145
146config NFT_REDIR_IPV4
147	tristate "IPv4 redirect support for nf_tables"
148	depends on NF_TABLES_IPV4
149	depends on NFT_REDIR
150	select NF_NAT_REDIRECT
151	help
152	  This is the expression that provides IPv4 redirect support for
153	  nf_tables.
154
155config NF_NAT_SNMP_BASIC
156	tristate "Basic SNMP-ALG support"
157	depends on NF_CONNTRACK_SNMP
158	depends on NETFILTER_ADVANCED
159	default NF_NAT && NF_CONNTRACK_SNMP
160	select ASN1
161	---help---
162
163	  This module implements an Application Layer Gateway (ALG) for
164	  SNMP payloads.  In conjunction with NAT, it allows a network
165	  management system to access multiple private networks with
166	  conflicting addresses.  It works by modifying IP addresses
167	  inside SNMP payloads to match IP-layer NAT mapping.
168
169	  This is the "basic" form of SNMP-ALG, as described in RFC 2962
170
171	  To compile it as a module, choose M here.  If unsure, say N.
172
173config NF_NAT_PROTO_GRE
174	tristate
175	depends on NF_CT_PROTO_GRE
176
177config NF_NAT_PPTP
178	tristate
179	depends on NF_CONNTRACK
180	default NF_CONNTRACK_PPTP
181	select NF_NAT_PROTO_GRE
182
183config NF_NAT_H323
184	tristate
185	depends on NF_CONNTRACK
186	default NF_CONNTRACK_H323
187
188endif # NF_NAT_IPV4
189
190config IP_NF_IPTABLES
191	tristate "IP tables support (required for filtering/masq/NAT)"
192	default m if NETFILTER_ADVANCED=n
193	select NETFILTER_XTABLES
194	help
195	  iptables is a general, extensible packet identification framework.
196	  The packet filtering and full NAT (masquerading, port forwarding,
197	  etc) subsystems now use this: say `Y' or `M' here if you want to use
198	  either of those.
199
200	  To compile it as a module, choose M here.  If unsure, say N.
201
202if IP_NF_IPTABLES
203
204# The matches.
205config IP_NF_MATCH_AH
206	tristate '"ah" match support'
207	depends on NETFILTER_ADVANCED
208	help
209	  This match extension allows you to match a range of SPIs
210	  inside AH header of IPSec packets.
211
212	  To compile it as a module, choose M here.  If unsure, say N.
213
214config IP_NF_MATCH_ECN
215	tristate '"ecn" match support'
216	depends on NETFILTER_ADVANCED
217	select NETFILTER_XT_MATCH_ECN
218	---help---
219	This is a backwards-compat option for the user's convenience
220	(e.g. when running oldconfig). It selects
221	CONFIG_NETFILTER_XT_MATCH_ECN.
222
223config IP_NF_MATCH_RPFILTER
224	tristate '"rpfilter" reverse path filter match support'
225	depends on NETFILTER_ADVANCED
226	depends on IP_NF_MANGLE || IP_NF_RAW
227	---help---
228	  This option allows you to match packets whose replies would
229	  go out via the interface the packet came in.
230
231	  To compile it as a module, choose M here.  If unsure, say N.
232	  The module will be called ipt_rpfilter.
233
234config IP_NF_MATCH_TTL
235	tristate '"ttl" match support'
236	depends on NETFILTER_ADVANCED
237	select NETFILTER_XT_MATCH_HL
238	---help---
239	This is a backwards-compat option for the user's convenience
240	(e.g. when running oldconfig). It selects
241	CONFIG_NETFILTER_XT_MATCH_HL.
242
243# `filter', generic and specific targets
244config IP_NF_FILTER
245	tristate "Packet filtering"
246	default m if NETFILTER_ADVANCED=n
247	help
248	  Packet filtering defines a table `filter', which has a series of
249	  rules for simple packet filtering at local input, forwarding and
250	  local output.  See the man page for iptables(8).
251
252	  To compile it as a module, choose M here.  If unsure, say N.
253
254config IP_NF_TARGET_REJECT
255	tristate "REJECT target support"
256	depends on IP_NF_FILTER
257	select NF_REJECT_IPV4
258	default m if NETFILTER_ADVANCED=n
259	help
260	  The REJECT target allows a filtering rule to specify that an ICMP
261	  error should be issued in response to an incoming packet, rather
262	  than silently being dropped.
263
264	  To compile it as a module, choose M here.  If unsure, say N.
265
266config IP_NF_TARGET_SYNPROXY
267	tristate "SYNPROXY target support"
268	depends on NF_CONNTRACK && NETFILTER_ADVANCED
269	select NETFILTER_SYNPROXY
270	select SYN_COOKIES
271	help
272	  The SYNPROXY target allows you to intercept TCP connections and
273	  establish them using syncookies before they are passed on to the
274	  server. This allows to avoid conntrack and server resource usage
275	  during SYN-flood attacks.
276
277	  To compile it as a module, choose M here. If unsure, say N.
278
279# NAT + specific targets: nf_conntrack
280config IP_NF_NAT
281	tristate "iptables NAT support"
282	depends on NF_CONNTRACK_IPV4
283	default m if NETFILTER_ADVANCED=n
284	select NF_NAT
285	select NF_NAT_IPV4
286	select NETFILTER_XT_NAT
287	help
288	  This enables the `nat' table in iptables. This allows masquerading,
289	  port forwarding and other forms of full Network Address Port
290	  Translation.
291
292	  To compile it as a module, choose M here.  If unsure, say N.
293
294if IP_NF_NAT
295
296config IP_NF_TARGET_MASQUERADE
297	tristate "MASQUERADE target support"
298	select NF_NAT_MASQUERADE_IPV4
299	default m if NETFILTER_ADVANCED=n
300	help
301	  Masquerading is a special case of NAT: all outgoing connections are
302	  changed to seem to come from a particular interface's address, and
303	  if the interface goes down, those connections are lost.  This is
304	  only useful for dialup accounts with dynamic IP address (ie. your IP
305	  address will be different on next dialup).
306
307	  To compile it as a module, choose M here.  If unsure, say N.
308
309config IP_NF_TARGET_NETMAP
310	tristate "NETMAP target support"
311	depends on NETFILTER_ADVANCED
312	select NETFILTER_XT_TARGET_NETMAP
313	---help---
314	This is a backwards-compat option for the user's convenience
315	(e.g. when running oldconfig). It selects
316	CONFIG_NETFILTER_XT_TARGET_NETMAP.
317
318config IP_NF_TARGET_REDIRECT
319	tristate "REDIRECT target support"
320	depends on NETFILTER_ADVANCED
321	select NETFILTER_XT_TARGET_REDIRECT
322	---help---
323	This is a backwards-compat option for the user's convenience
324	(e.g. when running oldconfig). It selects
325	CONFIG_NETFILTER_XT_TARGET_REDIRECT.
326
327endif # IP_NF_NAT
328
329# mangle + specific targets
330config IP_NF_MANGLE
331	tristate "Packet mangling"
332	default m if NETFILTER_ADVANCED=n
333	help
334	  This option adds a `mangle' table to iptables: see the man page for
335	  iptables(8).  This table is used for various packet alterations
336	  which can effect how the packet is routed.
337
338	  To compile it as a module, choose M here.  If unsure, say N.
339
340config IP_NF_TARGET_CLUSTERIP
341	tristate "CLUSTERIP target support"
342	depends on IP_NF_MANGLE
343	depends on NF_CONNTRACK_IPV4
344	depends on NETFILTER_ADVANCED
345	select NF_CONNTRACK_MARK
346	select NETFILTER_FAMILY_ARP
347	help
348	  The CLUSTERIP target allows you to build load-balancing clusters of
349	  network servers without having a dedicated load-balancing
350	  router/server/switch.
351	
352	  To compile it as a module, choose M here.  If unsure, say N.
353
354config IP_NF_TARGET_ECN
355	tristate "ECN target support"
356	depends on IP_NF_MANGLE
357	depends on NETFILTER_ADVANCED
358	---help---
359	  This option adds a `ECN' target, which can be used in the iptables mangle
360	  table.  
361
362	  You can use this target to remove the ECN bits from the IPv4 header of
363	  an IP packet.  This is particularly useful, if you need to work around
364	  existing ECN blackholes on the internet, but don't want to disable
365	  ECN support in general.
366
367	  To compile it as a module, choose M here.  If unsure, say N.
368
369config IP_NF_TARGET_TTL
370	tristate '"TTL" target support'
371	depends on NETFILTER_ADVANCED && IP_NF_MANGLE
372	select NETFILTER_XT_TARGET_HL
373	---help---
374	This is a backwards-compatible option for the user's convenience
375	(e.g. when running oldconfig). It selects
376	CONFIG_NETFILTER_XT_TARGET_HL.
377
378# raw + specific targets
379config IP_NF_RAW
380	tristate  'raw table support (required for NOTRACK/TRACE)'
381	help
382	  This option adds a `raw' table to iptables. This table is the very
383	  first in the netfilter framework and hooks in at the PREROUTING
384	  and OUTPUT chains.
385	
386	  If you want to compile it as a module, say M here and read
387	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
388
389# security table for MAC policy
390config IP_NF_SECURITY
391	tristate "Security table"
392	depends on SECURITY
393	depends on NETFILTER_ADVANCED
394	help
395	  This option adds a `security' table to iptables, for use
396	  with Mandatory Access Control (MAC) policy.
397	 
398	  If unsure, say N.
399
400endif # IP_NF_IPTABLES
401
402# ARP tables
403config IP_NF_ARPTABLES
404	tristate "ARP tables support"
405	select NETFILTER_XTABLES
406	select NETFILTER_FAMILY_ARP
407	depends on NETFILTER_ADVANCED
408	help
409	  arptables is a general, extensible packet identification framework.
410	  The ARP packet filtering and mangling (manipulation)subsystems
411	  use this: say Y or M here if you want to use either of those.
412
413	  To compile it as a module, choose M here.  If unsure, say N.
414
415if IP_NF_ARPTABLES
416
417config IP_NF_ARPFILTER
418	tristate "ARP packet filtering"
419	help
420	  ARP packet filtering defines a table `filter', which has a series of
421	  rules for simple ARP packet filtering at local input and
422	  local output.  On a bridge, you can also specify filtering rules
423	  for forwarded ARP packets. See the man page for arptables(8).
424
425	  To compile it as a module, choose M here.  If unsure, say N.
426
427config IP_NF_ARP_MANGLE
428	tristate "ARP payload mangling"
429	help
430	  Allows altering the ARP packet payload: source and destination
431	  hardware and network addresses.
432
433endif # IP_NF_ARPTABLES
434
435endmenu
436

  1#
  2# IP netfilter configuration
  3#
  4
  5menu "IP: Netfilter Configuration"
  6	depends on INET && NETFILTER
  7
  8config NF_DEFRAG_IPV4
  9	tristate
 10	default n
 11
 12config NF_CONNTRACK_IPV4
 13	tristate "IPv4 connection tracking support (required for NAT)"
 14	depends on NF_CONNTRACK
 15	default m if NETFILTER_ADVANCED=n
 16	select NF_DEFRAG_IPV4
 17	---help---
 18	  Connection tracking keeps a record of what packets have passed
 19	  through your machine, in order to figure out how they are related
 20	  into connections.
 21
 22	  This is IPv4 support on Layer 3 independent connection tracking.
 23	  Layer 3 independent connection tracking is experimental scheme
 24	  which generalize ip_conntrack to support other layer 3 protocols.
 25
 26	  To compile it as a module, choose M here.  If unsure, say N.
 27
 28config NF_SOCKET_IPV4
 29	tristate "IPv4 socket lookup support"
 30	help
 31	  This option enables the IPv4 socket lookup infrastructure. This is
 32	  is required by the iptables socket match.
 33
 34if NF_TABLES
 35
 36config NF_TABLES_IPV4
 37	tristate "IPv4 nf_tables support"
 38	help
 39	  This option enables the IPv4 support for nf_tables.
 40
 41if NF_TABLES_IPV4
 42
 43config NFT_CHAIN_ROUTE_IPV4
 44	tristate "IPv4 nf_tables route chain support"
 45	help
 46	  This option enables the "route" chain for IPv4 in nf_tables. This
 47	  chain type is used to force packet re-routing after mangling header
 48	  fields such as the source, destination, type of service and
 49	  the packet mark.
 50
 51config NFT_REJECT_IPV4
 52	select NF_REJECT_IPV4
 53	default NFT_REJECT
 54	tristate
 55
 56config NFT_DUP_IPV4
 57	tristate "IPv4 nf_tables packet duplication support"
 58	depends on !NF_CONNTRACK || NF_CONNTRACK
 59	select NF_DUP_IPV4
 60	help
 61	  This module enables IPv4 packet duplication support for nf_tables.
 62
 63config NFT_FIB_IPV4
 64	select NFT_FIB
 65	tristate "nf_tables fib / ip route lookup support"
 66	help
 67	  This module enables IPv4 FIB lookups, e.g. for reverse path filtering.
 68	  It also allows query of the FIB for the route type, e.g. local, unicast,
 69	  multicast or blackhole.
 70
 71endif # NF_TABLES_IPV4
 72
 73config NF_TABLES_ARP
 74	tristate "ARP nf_tables support"
 
 75	help
 76	  This option enables the ARP support for nf_tables.
 77
 78endif # NF_TABLES
 79
 
 
 
 
 
 
 
 
 80config NF_DUP_IPV4
 81	tristate "Netfilter IPv4 packet duplication to alternate destination"
 82	depends on !NF_CONNTRACK || NF_CONNTRACK
 83	help
 84	  This option enables the nf_dup_ipv4 core, which duplicates an IPv4
 85	  packet to be rerouted to another destination.
 86
 87config NF_LOG_ARP
 88	tristate "ARP packet logging"
 89	default m if NETFILTER_ADVANCED=n
 90	select NF_LOG_COMMON
 91
 92config NF_LOG_IPV4
 93	tristate "IPv4 packet logging"
 94	default m if NETFILTER_ADVANCED=n
 95	select NF_LOG_COMMON
 96
 97config NF_REJECT_IPV4
 98	tristate "IPv4 packet rejection"
 99	default m if NETFILTER_ADVANCED=n
100
101config NF_NAT_IPV4
102	tristate "IPv4 NAT"
103	depends on NF_CONNTRACK_IPV4
104	default m if NETFILTER_ADVANCED=n
105	select NF_NAT
106	help
107	  The IPv4 NAT option allows masquerading, port forwarding and other
108	  forms of full Network Address Port Translation. This can be
109	  controlled by iptables or nft.
110
111if NF_NAT_IPV4
112
113config NFT_CHAIN_NAT_IPV4
114	depends on NF_TABLES_IPV4
115	tristate "IPv4 nf_tables nat chain support"
116	help
117	  This option enables the "nat" chain for IPv4 in nf_tables. This
118	  chain type is used to perform Network Address Translation (NAT)
119	  packet transformations such as the source, destination address and
120	  source and destination ports.
121
122config NF_NAT_MASQUERADE_IPV4
123	tristate "IPv4 masquerade support"
124	help
125	  This is the kernel functionality to provide NAT in the masquerade
126	  flavour (automatic source address selection).
127
128config NFT_MASQ_IPV4
129	tristate "IPv4 masquerading support for nf_tables"
130	depends on NF_TABLES_IPV4
131	depends on NFT_MASQ
132	select NF_NAT_MASQUERADE_IPV4
133	help
134	  This is the expression that provides IPv4 masquerading support for
135	  nf_tables.
136
137config NFT_REDIR_IPV4
138	tristate "IPv4 redirect support for nf_tables"
139	depends on NF_TABLES_IPV4
140	depends on NFT_REDIR
141	select NF_NAT_REDIRECT
142	help
143	  This is the expression that provides IPv4 redirect support for
144	  nf_tables.
145
146config NF_NAT_SNMP_BASIC
147	tristate "Basic SNMP-ALG support"
148	depends on NF_CONNTRACK_SNMP
149	depends on NETFILTER_ADVANCED
150	default NF_NAT && NF_CONNTRACK_SNMP
 
151	---help---
152
153	  This module implements an Application Layer Gateway (ALG) for
154	  SNMP payloads.  In conjunction with NAT, it allows a network
155	  management system to access multiple private networks with
156	  conflicting addresses.  It works by modifying IP addresses
157	  inside SNMP payloads to match IP-layer NAT mapping.
158
159	  This is the "basic" form of SNMP-ALG, as described in RFC 2962
160
161	  To compile it as a module, choose M here.  If unsure, say N.
162
163config NF_NAT_PROTO_GRE
164	tristate
165	depends on NF_CT_PROTO_GRE
166
167config NF_NAT_PPTP
168	tristate
169	depends on NF_CONNTRACK
170	default NF_CONNTRACK_PPTP
171	select NF_NAT_PROTO_GRE
172
173config NF_NAT_H323
174	tristate
175	depends on NF_CONNTRACK
176	default NF_CONNTRACK_H323
177
178endif # NF_NAT_IPV4
179
180config IP_NF_IPTABLES
181	tristate "IP tables support (required for filtering/masq/NAT)"
182	default m if NETFILTER_ADVANCED=n
183	select NETFILTER_XTABLES
184	help
185	  iptables is a general, extensible packet identification framework.
186	  The packet filtering and full NAT (masquerading, port forwarding,
187	  etc) subsystems now use this: say `Y' or `M' here if you want to use
188	  either of those.
189
190	  To compile it as a module, choose M here.  If unsure, say N.
191
192if IP_NF_IPTABLES
193
194# The matches.
195config IP_NF_MATCH_AH
196	tristate '"ah" match support'
197	depends on NETFILTER_ADVANCED
198	help
199	  This match extension allows you to match a range of SPIs
200	  inside AH header of IPSec packets.
201
202	  To compile it as a module, choose M here.  If unsure, say N.
203
204config IP_NF_MATCH_ECN
205	tristate '"ecn" match support'
206	depends on NETFILTER_ADVANCED
207	select NETFILTER_XT_MATCH_ECN
208	---help---
209	This is a backwards-compat option for the user's convenience
210	(e.g. when running oldconfig). It selects
211	CONFIG_NETFILTER_XT_MATCH_ECN.
212
213config IP_NF_MATCH_RPFILTER
214	tristate '"rpfilter" reverse path filter match support'
215	depends on NETFILTER_ADVANCED
216	depends on IP_NF_MANGLE || IP_NF_RAW
217	---help---
218	  This option allows you to match packets whose replies would
219	  go out via the interface the packet came in.
220
221	  To compile it as a module, choose M here.  If unsure, say N.
222	  The module will be called ipt_rpfilter.
223
224config IP_NF_MATCH_TTL
225	tristate '"ttl" match support'
226	depends on NETFILTER_ADVANCED
227	select NETFILTER_XT_MATCH_HL
228	---help---
229	This is a backwards-compat option for the user's convenience
230	(e.g. when running oldconfig). It selects
231	CONFIG_NETFILTER_XT_MATCH_HL.
232
233# `filter', generic and specific targets
234config IP_NF_FILTER
235	tristate "Packet filtering"
236	default m if NETFILTER_ADVANCED=n
237	help
238	  Packet filtering defines a table `filter', which has a series of
239	  rules for simple packet filtering at local input, forwarding and
240	  local output.  See the man page for iptables(8).
241
242	  To compile it as a module, choose M here.  If unsure, say N.
243
244config IP_NF_TARGET_REJECT
245	tristate "REJECT target support"
246	depends on IP_NF_FILTER
247	select NF_REJECT_IPV4
248	default m if NETFILTER_ADVANCED=n
249	help
250	  The REJECT target allows a filtering rule to specify that an ICMP
251	  error should be issued in response to an incoming packet, rather
252	  than silently being dropped.
253
254	  To compile it as a module, choose M here.  If unsure, say N.
255
256config IP_NF_TARGET_SYNPROXY
257	tristate "SYNPROXY target support"
258	depends on NF_CONNTRACK && NETFILTER_ADVANCED
259	select NETFILTER_SYNPROXY
260	select SYN_COOKIES
261	help
262	  The SYNPROXY target allows you to intercept TCP connections and
263	  establish them using syncookies before they are passed on to the
264	  server. This allows to avoid conntrack and server resource usage
265	  during SYN-flood attacks.
266
267	  To compile it as a module, choose M here. If unsure, say N.
268
269# NAT + specific targets: nf_conntrack
270config IP_NF_NAT
271	tristate "iptables NAT support"
272	depends on NF_CONNTRACK_IPV4
273	default m if NETFILTER_ADVANCED=n
274	select NF_NAT
275	select NF_NAT_IPV4
276	select NETFILTER_XT_NAT
277	help
278	  This enables the `nat' table in iptables. This allows masquerading,
279	  port forwarding and other forms of full Network Address Port
280	  Translation.
281
282	  To compile it as a module, choose M here.  If unsure, say N.
283
284if IP_NF_NAT
285
286config IP_NF_TARGET_MASQUERADE
287	tristate "MASQUERADE target support"
288	select NF_NAT_MASQUERADE_IPV4
289	default m if NETFILTER_ADVANCED=n
290	help
291	  Masquerading is a special case of NAT: all outgoing connections are
292	  changed to seem to come from a particular interface's address, and
293	  if the interface goes down, those connections are lost.  This is
294	  only useful for dialup accounts with dynamic IP address (ie. your IP
295	  address will be different on next dialup).
296
297	  To compile it as a module, choose M here.  If unsure, say N.
298
299config IP_NF_TARGET_NETMAP
300	tristate "NETMAP target support"
301	depends on NETFILTER_ADVANCED
302	select NETFILTER_XT_TARGET_NETMAP
303	---help---
304	This is a backwards-compat option for the user's convenience
305	(e.g. when running oldconfig). It selects
306	CONFIG_NETFILTER_XT_TARGET_NETMAP.
307
308config IP_NF_TARGET_REDIRECT
309	tristate "REDIRECT target support"
310	depends on NETFILTER_ADVANCED
311	select NETFILTER_XT_TARGET_REDIRECT
312	---help---
313	This is a backwards-compat option for the user's convenience
314	(e.g. when running oldconfig). It selects
315	CONFIG_NETFILTER_XT_TARGET_REDIRECT.
316
317endif # IP_NF_NAT
318
319# mangle + specific targets
320config IP_NF_MANGLE
321	tristate "Packet mangling"
322	default m if NETFILTER_ADVANCED=n
323	help
324	  This option adds a `mangle' table to iptables: see the man page for
325	  iptables(8).  This table is used for various packet alterations
326	  which can effect how the packet is routed.
327
328	  To compile it as a module, choose M here.  If unsure, say N.
329
330config IP_NF_TARGET_CLUSTERIP
331	tristate "CLUSTERIP target support"
332	depends on IP_NF_MANGLE
333	depends on NF_CONNTRACK_IPV4
334	depends on NETFILTER_ADVANCED
335	select NF_CONNTRACK_MARK
 
336	help
337	  The CLUSTERIP target allows you to build load-balancing clusters of
338	  network servers without having a dedicated load-balancing
339	  router/server/switch.
340	
341	  To compile it as a module, choose M here.  If unsure, say N.
342
343config IP_NF_TARGET_ECN
344	tristate "ECN target support"
345	depends on IP_NF_MANGLE
346	depends on NETFILTER_ADVANCED
347	---help---
348	  This option adds a `ECN' target, which can be used in the iptables mangle
349	  table.  
350
351	  You can use this target to remove the ECN bits from the IPv4 header of
352	  an IP packet.  This is particularly useful, if you need to work around
353	  existing ECN blackholes on the internet, but don't want to disable
354	  ECN support in general.
355
356	  To compile it as a module, choose M here.  If unsure, say N.
357
358config IP_NF_TARGET_TTL
359	tristate '"TTL" target support'
360	depends on NETFILTER_ADVANCED && IP_NF_MANGLE
361	select NETFILTER_XT_TARGET_HL
362	---help---
363	This is a backwards-compatible option for the user's convenience
364	(e.g. when running oldconfig). It selects
365	CONFIG_NETFILTER_XT_TARGET_HL.
366
367# raw + specific targets
368config IP_NF_RAW
369	tristate  'raw table support (required for NOTRACK/TRACE)'
370	help
371	  This option adds a `raw' table to iptables. This table is the very
372	  first in the netfilter framework and hooks in at the PREROUTING
373	  and OUTPUT chains.
374	
375	  If you want to compile it as a module, say M here and read
376	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
377
378# security table for MAC policy
379config IP_NF_SECURITY
380	tristate "Security table"
381	depends on SECURITY
382	depends on NETFILTER_ADVANCED
383	help
384	  This option adds a `security' table to iptables, for use
385	  with Mandatory Access Control (MAC) policy.
386	 
387	  If unsure, say N.
388
389endif # IP_NF_IPTABLES
390
391# ARP tables
392config IP_NF_ARPTABLES
393	tristate "ARP tables support"
394	select NETFILTER_XTABLES
 
395	depends on NETFILTER_ADVANCED
396	help
397	  arptables is a general, extensible packet identification framework.
398	  The ARP packet filtering and mangling (manipulation)subsystems
399	  use this: say Y or M here if you want to use either of those.
400
401	  To compile it as a module, choose M here.  If unsure, say N.
402
403if IP_NF_ARPTABLES
404
405config IP_NF_ARPFILTER
406	tristate "ARP packet filtering"
407	help
408	  ARP packet filtering defines a table `filter', which has a series of
409	  rules for simple ARP packet filtering at local input and
410	  local output.  On a bridge, you can also specify filtering rules
411	  for forwarded ARP packets. See the man page for arptables(8).
412
413	  To compile it as a module, choose M here.  If unsure, say N.
414
415config IP_NF_ARP_MANGLE
416	tristate "ARP payload mangling"
417	help
418	  Allows altering the ARP packet payload: source and destination
419	  hardware and network addresses.
420
421endif # IP_NF_ARPTABLES
422
423endmenu
424