Loading...
1# SPDX-License-Identifier: GPL-2.0-only
2#
3# IP netfilter configuration
4#
5
6menu "IP: Netfilter Configuration"
7 depends on INET && NETFILTER
8
9config NF_DEFRAG_IPV4
10 tristate
11 default n
12
13config NF_SOCKET_IPV4
14 tristate "IPv4 socket lookup support"
15 help
16 This option enables the IPv4 socket lookup infrastructure. This is
17 is required by the {ip,nf}tables socket match.
18
19config NF_TPROXY_IPV4
20 tristate "IPv4 tproxy support"
21
22if NF_TABLES
23
24config NF_TABLES_IPV4
25 bool "IPv4 nf_tables support"
26 help
27 This option enables the IPv4 support for nf_tables.
28
29if NF_TABLES_IPV4
30
31config NFT_REJECT_IPV4
32 select NF_REJECT_IPV4
33 default NFT_REJECT
34 tristate
35
36config NFT_DUP_IPV4
37 tristate "IPv4 nf_tables packet duplication support"
38 depends on !NF_CONNTRACK || NF_CONNTRACK
39 select NF_DUP_IPV4
40 help
41 This module enables IPv4 packet duplication support for nf_tables.
42
43config NFT_FIB_IPV4
44 select NFT_FIB
45 tristate "nf_tables fib / ip route lookup support"
46 help
47 This module enables IPv4 FIB lookups, e.g. for reverse path filtering.
48 It also allows query of the FIB for the route type, e.g. local, unicast,
49 multicast or blackhole.
50
51endif # NF_TABLES_IPV4
52
53config NF_TABLES_ARP
54 bool "ARP nf_tables support"
55 select NETFILTER_FAMILY_ARP
56 help
57 This option enables the ARP support for nf_tables.
58
59endif # NF_TABLES
60
61config NF_FLOW_TABLE_IPV4
62 tristate "Netfilter flow table IPv4 module"
63 depends on NF_FLOW_TABLE
64 help
65 This option adds the flow table IPv4 support.
66
67 To compile it as a module, choose M here.
68
69config NF_DUP_IPV4
70 tristate "Netfilter IPv4 packet duplication to alternate destination"
71 depends on !NF_CONNTRACK || NF_CONNTRACK
72 help
73 This option enables the nf_dup_ipv4 core, which duplicates an IPv4
74 packet to be rerouted to another destination.
75
76config NF_LOG_ARP
77 tristate "ARP packet logging"
78 default m if NETFILTER_ADVANCED=n
79 select NF_LOG_COMMON
80
81config NF_LOG_IPV4
82 tristate "IPv4 packet logging"
83 default m if NETFILTER_ADVANCED=n
84 select NF_LOG_COMMON
85
86config NF_REJECT_IPV4
87 tristate "IPv4 packet rejection"
88 default m if NETFILTER_ADVANCED=n
89
90if NF_NAT
91config NF_NAT_SNMP_BASIC
92 tristate "Basic SNMP-ALG support"
93 depends on NF_CONNTRACK_SNMP
94 depends on NETFILTER_ADVANCED
95 default NF_NAT && NF_CONNTRACK_SNMP
96 select ASN1
97 ---help---
98
99 This module implements an Application Layer Gateway (ALG) for
100 SNMP payloads. In conjunction with NAT, it allows a network
101 management system to access multiple private networks with
102 conflicting addresses. It works by modifying IP addresses
103 inside SNMP payloads to match IP-layer NAT mapping.
104
105 This is the "basic" form of SNMP-ALG, as described in RFC 2962
106
107 To compile it as a module, choose M here. If unsure, say N.
108
109config NF_NAT_PPTP
110 tristate
111 depends on NF_CONNTRACK
112 default NF_CONNTRACK_PPTP
113
114config NF_NAT_H323
115 tristate
116 depends on NF_CONNTRACK
117 default NF_CONNTRACK_H323
118
119endif # NF_NAT
120
121config IP_NF_IPTABLES
122 tristate "IP tables support (required for filtering/masq/NAT)"
123 default m if NETFILTER_ADVANCED=n
124 select NETFILTER_XTABLES
125 help
126 iptables is a general, extensible packet identification framework.
127 The packet filtering and full NAT (masquerading, port forwarding,
128 etc) subsystems now use this: say `Y' or `M' here if you want to use
129 either of those.
130
131 To compile it as a module, choose M here. If unsure, say N.
132
133if IP_NF_IPTABLES
134
135# The matches.
136config IP_NF_MATCH_AH
137 tristate '"ah" match support'
138 depends on NETFILTER_ADVANCED
139 help
140 This match extension allows you to match a range of SPIs
141 inside AH header of IPSec packets.
142
143 To compile it as a module, choose M here. If unsure, say N.
144
145config IP_NF_MATCH_ECN
146 tristate '"ecn" match support'
147 depends on NETFILTER_ADVANCED
148 select NETFILTER_XT_MATCH_ECN
149 ---help---
150 This is a backwards-compat option for the user's convenience
151 (e.g. when running oldconfig). It selects
152 CONFIG_NETFILTER_XT_MATCH_ECN.
153
154config IP_NF_MATCH_RPFILTER
155 tristate '"rpfilter" reverse path filter match support'
156 depends on NETFILTER_ADVANCED
157 depends on IP_NF_MANGLE || IP_NF_RAW
158 ---help---
159 This option allows you to match packets whose replies would
160 go out via the interface the packet came in.
161
162 To compile it as a module, choose M here. If unsure, say N.
163 The module will be called ipt_rpfilter.
164
165config IP_NF_MATCH_TTL
166 tristate '"ttl" match support'
167 depends on NETFILTER_ADVANCED
168 select NETFILTER_XT_MATCH_HL
169 ---help---
170 This is a backwards-compat option for the user's convenience
171 (e.g. when running oldconfig). It selects
172 CONFIG_NETFILTER_XT_MATCH_HL.
173
174# `filter', generic and specific targets
175config IP_NF_FILTER
176 tristate "Packet filtering"
177 default m if NETFILTER_ADVANCED=n
178 help
179 Packet filtering defines a table `filter', which has a series of
180 rules for simple packet filtering at local input, forwarding and
181 local output. See the man page for iptables(8).
182
183 To compile it as a module, choose M here. If unsure, say N.
184
185config IP_NF_TARGET_REJECT
186 tristate "REJECT target support"
187 depends on IP_NF_FILTER
188 select NF_REJECT_IPV4
189 default m if NETFILTER_ADVANCED=n
190 help
191 The REJECT target allows a filtering rule to specify that an ICMP
192 error should be issued in response to an incoming packet, rather
193 than silently being dropped.
194
195 To compile it as a module, choose M here. If unsure, say N.
196
197config IP_NF_TARGET_SYNPROXY
198 tristate "SYNPROXY target support"
199 depends on NF_CONNTRACK && NETFILTER_ADVANCED
200 select NETFILTER_SYNPROXY
201 select SYN_COOKIES
202 help
203 The SYNPROXY target allows you to intercept TCP connections and
204 establish them using syncookies before they are passed on to the
205 server. This allows to avoid conntrack and server resource usage
206 during SYN-flood attacks.
207
208 To compile it as a module, choose M here. If unsure, say N.
209
210# NAT + specific targets: nf_conntrack
211config IP_NF_NAT
212 tristate "iptables NAT support"
213 depends on NF_CONNTRACK
214 default m if NETFILTER_ADVANCED=n
215 select NF_NAT
216 select NETFILTER_XT_NAT
217 help
218 This enables the `nat' table in iptables. This allows masquerading,
219 port forwarding and other forms of full Network Address Port
220 Translation.
221
222 To compile it as a module, choose M here. If unsure, say N.
223
224if IP_NF_NAT
225
226config IP_NF_TARGET_MASQUERADE
227 tristate "MASQUERADE target support"
228 select NETFILTER_XT_TARGET_MASQUERADE
229 help
230 This is a backwards-compat option for the user's convenience
231 (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE.
232
233config IP_NF_TARGET_NETMAP
234 tristate "NETMAP target support"
235 depends on NETFILTER_ADVANCED
236 select NETFILTER_XT_TARGET_NETMAP
237 ---help---
238 This is a backwards-compat option for the user's convenience
239 (e.g. when running oldconfig). It selects
240 CONFIG_NETFILTER_XT_TARGET_NETMAP.
241
242config IP_NF_TARGET_REDIRECT
243 tristate "REDIRECT target support"
244 depends on NETFILTER_ADVANCED
245 select NETFILTER_XT_TARGET_REDIRECT
246 ---help---
247 This is a backwards-compat option for the user's convenience
248 (e.g. when running oldconfig). It selects
249 CONFIG_NETFILTER_XT_TARGET_REDIRECT.
250
251endif # IP_NF_NAT
252
253# mangle + specific targets
254config IP_NF_MANGLE
255 tristate "Packet mangling"
256 default m if NETFILTER_ADVANCED=n
257 help
258 This option adds a `mangle' table to iptables: see the man page for
259 iptables(8). This table is used for various packet alterations
260 which can effect how the packet is routed.
261
262 To compile it as a module, choose M here. If unsure, say N.
263
264config IP_NF_TARGET_CLUSTERIP
265 tristate "CLUSTERIP target support"
266 depends on IP_NF_MANGLE
267 depends on NF_CONNTRACK
268 depends on NETFILTER_ADVANCED
269 select NF_CONNTRACK_MARK
270 select NETFILTER_FAMILY_ARP
271 help
272 The CLUSTERIP target allows you to build load-balancing clusters of
273 network servers without having a dedicated load-balancing
274 router/server/switch.
275
276 To compile it as a module, choose M here. If unsure, say N.
277
278config IP_NF_TARGET_ECN
279 tristate "ECN target support"
280 depends on IP_NF_MANGLE
281 depends on NETFILTER_ADVANCED
282 ---help---
283 This option adds a `ECN' target, which can be used in the iptables mangle
284 table.
285
286 You can use this target to remove the ECN bits from the IPv4 header of
287 an IP packet. This is particularly useful, if you need to work around
288 existing ECN blackholes on the internet, but don't want to disable
289 ECN support in general.
290
291 To compile it as a module, choose M here. If unsure, say N.
292
293config IP_NF_TARGET_TTL
294 tristate '"TTL" target support'
295 depends on NETFILTER_ADVANCED && IP_NF_MANGLE
296 select NETFILTER_XT_TARGET_HL
297 ---help---
298 This is a backwards-compatible option for the user's convenience
299 (e.g. when running oldconfig). It selects
300 CONFIG_NETFILTER_XT_TARGET_HL.
301
302# raw + specific targets
303config IP_NF_RAW
304 tristate 'raw table support (required for NOTRACK/TRACE)'
305 help
306 This option adds a `raw' table to iptables. This table is the very
307 first in the netfilter framework and hooks in at the PREROUTING
308 and OUTPUT chains.
309
310 If you want to compile it as a module, say M here and read
311 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
312
313# security table for MAC policy
314config IP_NF_SECURITY
315 tristate "Security table"
316 depends on SECURITY
317 depends on NETFILTER_ADVANCED
318 help
319 This option adds a `security' table to iptables, for use
320 with Mandatory Access Control (MAC) policy.
321
322 If unsure, say N.
323
324endif # IP_NF_IPTABLES
325
326# ARP tables
327config IP_NF_ARPTABLES
328 tristate "ARP tables support"
329 select NETFILTER_XTABLES
330 select NETFILTER_FAMILY_ARP
331 depends on NETFILTER_ADVANCED
332 help
333 arptables is a general, extensible packet identification framework.
334 The ARP packet filtering and mangling (manipulation)subsystems
335 use this: say Y or M here if you want to use either of those.
336
337 To compile it as a module, choose M here. If unsure, say N.
338
339if IP_NF_ARPTABLES
340
341config IP_NF_ARPFILTER
342 tristate "ARP packet filtering"
343 help
344 ARP packet filtering defines a table `filter', which has a series of
345 rules for simple ARP packet filtering at local input and
346 local output. On a bridge, you can also specify filtering rules
347 for forwarded ARP packets. See the man page for arptables(8).
348
349 To compile it as a module, choose M here. If unsure, say N.
350
351config IP_NF_ARP_MANGLE
352 tristate "ARP payload mangling"
353 help
354 Allows altering the ARP packet payload: source and destination
355 hardware and network addresses.
356
357endif # IP_NF_ARPTABLES
358
359endmenu
360
1#
2# IP netfilter configuration
3#
4
5menu "IP: Netfilter Configuration"
6 depends on INET && NETFILTER
7
8config NF_DEFRAG_IPV4
9 tristate
10 default n
11
12config NF_CONNTRACK_IPV4
13 tristate "IPv4 connection tracking support (required for NAT)"
14 depends on NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
16 select NF_DEFRAG_IPV4
17 ---help---
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
20 into connections.
21
22 This is IPv4 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
25
26 To compile it as a module, choose M here. If unsure, say N.
27
28config NF_CONNTRACK_PROC_COMPAT
29 bool "proc/sysctl compatibility with old connection tracking"
30 depends on NF_CONNTRACK_PROCFS && NF_CONNTRACK_IPV4
31 default y
32 help
33 This option enables /proc and sysctl compatibility with the old
34 layer 3 dependent connection tracking. This is needed to keep
35 old programs that have not been adapted to the new names working.
36
37 If unsure, say Y.
38
39if NF_TABLES
40
41config NF_TABLES_IPV4
42 tristate "IPv4 nf_tables support"
43 help
44 This option enables the IPv4 support for nf_tables.
45
46if NF_TABLES_IPV4
47
48config NFT_CHAIN_ROUTE_IPV4
49 tristate "IPv4 nf_tables route chain support"
50 help
51 This option enables the "route" chain for IPv4 in nf_tables. This
52 chain type is used to force packet re-routing after mangling header
53 fields such as the source, destination, type of service and
54 the packet mark.
55
56config NFT_REJECT_IPV4
57 select NF_REJECT_IPV4
58 default NFT_REJECT
59 tristate
60
61config NFT_DUP_IPV4
62 tristate "IPv4 nf_tables packet duplication support"
63 depends on !NF_CONNTRACK || NF_CONNTRACK
64 select NF_DUP_IPV4
65 help
66 This module enables IPv4 packet duplication support for nf_tables.
67
68endif # NF_TABLES_IPV4
69
70config NF_TABLES_ARP
71 tristate "ARP nf_tables support"
72 help
73 This option enables the ARP support for nf_tables.
74
75endif # NF_TABLES
76
77config NF_DUP_IPV4
78 tristate "Netfilter IPv4 packet duplication to alternate destination"
79 depends on !NF_CONNTRACK || NF_CONNTRACK
80 help
81 This option enables the nf_dup_ipv4 core, which duplicates an IPv4
82 packet to be rerouted to another destination.
83
84config NF_LOG_ARP
85 tristate "ARP packet logging"
86 default m if NETFILTER_ADVANCED=n
87 select NF_LOG_COMMON
88
89config NF_LOG_IPV4
90 tristate "IPv4 packet logging"
91 default m if NETFILTER_ADVANCED=n
92 select NF_LOG_COMMON
93
94config NF_REJECT_IPV4
95 tristate "IPv4 packet rejection"
96 default m if NETFILTER_ADVANCED=n
97
98config NF_NAT_IPV4
99 tristate "IPv4 NAT"
100 depends on NF_CONNTRACK_IPV4
101 default m if NETFILTER_ADVANCED=n
102 select NF_NAT
103 help
104 The IPv4 NAT option allows masquerading, port forwarding and other
105 forms of full Network Address Port Translation. This can be
106 controlled by iptables or nft.
107
108if NF_NAT_IPV4
109
110config NFT_CHAIN_NAT_IPV4
111 depends on NF_TABLES_IPV4
112 tristate "IPv4 nf_tables nat chain support"
113 help
114 This option enables the "nat" chain for IPv4 in nf_tables. This
115 chain type is used to perform Network Address Translation (NAT)
116 packet transformations such as the source, destination address and
117 source and destination ports.
118
119config NF_NAT_MASQUERADE_IPV4
120 tristate "IPv4 masquerade support"
121 help
122 This is the kernel functionality to provide NAT in the masquerade
123 flavour (automatic source address selection).
124
125config NFT_MASQ_IPV4
126 tristate "IPv4 masquerading support for nf_tables"
127 depends on NF_TABLES_IPV4
128 depends on NFT_MASQ
129 select NF_NAT_MASQUERADE_IPV4
130 help
131 This is the expression that provides IPv4 masquerading support for
132 nf_tables.
133
134config NFT_REDIR_IPV4
135 tristate "IPv4 redirect support for nf_tables"
136 depends on NF_TABLES_IPV4
137 depends on NFT_REDIR
138 select NF_NAT_REDIRECT
139 help
140 This is the expression that provides IPv4 redirect support for
141 nf_tables.
142
143config NF_NAT_SNMP_BASIC
144 tristate "Basic SNMP-ALG support"
145 depends on NF_CONNTRACK_SNMP
146 depends on NETFILTER_ADVANCED
147 default NF_NAT && NF_CONNTRACK_SNMP
148 ---help---
149
150 This module implements an Application Layer Gateway (ALG) for
151 SNMP payloads. In conjunction with NAT, it allows a network
152 management system to access multiple private networks with
153 conflicting addresses. It works by modifying IP addresses
154 inside SNMP payloads to match IP-layer NAT mapping.
155
156 This is the "basic" form of SNMP-ALG, as described in RFC 2962
157
158 To compile it as a module, choose M here. If unsure, say N.
159
160config NF_NAT_PROTO_GRE
161 tristate
162 depends on NF_CT_PROTO_GRE
163
164config NF_NAT_PPTP
165 tristate
166 depends on NF_CONNTRACK
167 default NF_CONNTRACK_PPTP
168 select NF_NAT_PROTO_GRE
169
170config NF_NAT_H323
171 tristate
172 depends on NF_CONNTRACK
173 default NF_CONNTRACK_H323
174
175endif # NF_NAT_IPV4
176
177config IP_NF_IPTABLES
178 tristate "IP tables support (required for filtering/masq/NAT)"
179 default m if NETFILTER_ADVANCED=n
180 select NETFILTER_XTABLES
181 help
182 iptables is a general, extensible packet identification framework.
183 The packet filtering and full NAT (masquerading, port forwarding,
184 etc) subsystems now use this: say `Y' or `M' here if you want to use
185 either of those.
186
187 To compile it as a module, choose M here. If unsure, say N.
188
189if IP_NF_IPTABLES
190
191# The matches.
192config IP_NF_MATCH_AH
193 tristate '"ah" match support'
194 depends on NETFILTER_ADVANCED
195 help
196 This match extension allows you to match a range of SPIs
197 inside AH header of IPSec packets.
198
199 To compile it as a module, choose M here. If unsure, say N.
200
201config IP_NF_MATCH_ECN
202 tristate '"ecn" match support'
203 depends on NETFILTER_ADVANCED
204 select NETFILTER_XT_MATCH_ECN
205 ---help---
206 This is a backwards-compat option for the user's convenience
207 (e.g. when running oldconfig). It selects
208 CONFIG_NETFILTER_XT_MATCH_ECN.
209
210config IP_NF_MATCH_RPFILTER
211 tristate '"rpfilter" reverse path filter match support'
212 depends on NETFILTER_ADVANCED
213 depends on IP_NF_MANGLE || IP_NF_RAW
214 ---help---
215 This option allows you to match packets whose replies would
216 go out via the interface the packet came in.
217
218 To compile it as a module, choose M here. If unsure, say N.
219 The module will be called ipt_rpfilter.
220
221config IP_NF_MATCH_TTL
222 tristate '"ttl" match support'
223 depends on NETFILTER_ADVANCED
224 select NETFILTER_XT_MATCH_HL
225 ---help---
226 This is a backwards-compat option for the user's convenience
227 (e.g. when running oldconfig). It selects
228 CONFIG_NETFILTER_XT_MATCH_HL.
229
230# `filter', generic and specific targets
231config IP_NF_FILTER
232 tristate "Packet filtering"
233 default m if NETFILTER_ADVANCED=n
234 help
235 Packet filtering defines a table `filter', which has a series of
236 rules for simple packet filtering at local input, forwarding and
237 local output. See the man page for iptables(8).
238
239 To compile it as a module, choose M here. If unsure, say N.
240
241config IP_NF_TARGET_REJECT
242 tristate "REJECT target support"
243 depends on IP_NF_FILTER
244 select NF_REJECT_IPV4
245 default m if NETFILTER_ADVANCED=n
246 help
247 The REJECT target allows a filtering rule to specify that an ICMP
248 error should be issued in response to an incoming packet, rather
249 than silently being dropped.
250
251 To compile it as a module, choose M here. If unsure, say N.
252
253config IP_NF_TARGET_SYNPROXY
254 tristate "SYNPROXY target support"
255 depends on NF_CONNTRACK && NETFILTER_ADVANCED
256 select NETFILTER_SYNPROXY
257 select SYN_COOKIES
258 help
259 The SYNPROXY target allows you to intercept TCP connections and
260 establish them using syncookies before they are passed on to the
261 server. This allows to avoid conntrack and server resource usage
262 during SYN-flood attacks.
263
264 To compile it as a module, choose M here. If unsure, say N.
265
266# NAT + specific targets: nf_conntrack
267config IP_NF_NAT
268 tristate "iptables NAT support"
269 depends on NF_CONNTRACK_IPV4
270 default m if NETFILTER_ADVANCED=n
271 select NF_NAT
272 select NF_NAT_IPV4
273 select NETFILTER_XT_NAT
274 help
275 This enables the `nat' table in iptables. This allows masquerading,
276 port forwarding and other forms of full Network Address Port
277 Translation.
278
279 To compile it as a module, choose M here. If unsure, say N.
280
281if IP_NF_NAT
282
283config IP_NF_TARGET_MASQUERADE
284 tristate "MASQUERADE target support"
285 select NF_NAT_MASQUERADE_IPV4
286 default m if NETFILTER_ADVANCED=n
287 help
288 Masquerading is a special case of NAT: all outgoing connections are
289 changed to seem to come from a particular interface's address, and
290 if the interface goes down, those connections are lost. This is
291 only useful for dialup accounts with dynamic IP address (ie. your IP
292 address will be different on next dialup).
293
294 To compile it as a module, choose M here. If unsure, say N.
295
296config IP_NF_TARGET_NETMAP
297 tristate "NETMAP target support"
298 depends on NETFILTER_ADVANCED
299 select NETFILTER_XT_TARGET_NETMAP
300 ---help---
301 This is a backwards-compat option for the user's convenience
302 (e.g. when running oldconfig). It selects
303 CONFIG_NETFILTER_XT_TARGET_NETMAP.
304
305config IP_NF_TARGET_REDIRECT
306 tristate "REDIRECT target support"
307 depends on NETFILTER_ADVANCED
308 select NETFILTER_XT_TARGET_REDIRECT
309 ---help---
310 This is a backwards-compat option for the user's convenience
311 (e.g. when running oldconfig). It selects
312 CONFIG_NETFILTER_XT_TARGET_REDIRECT.
313
314endif # IP_NF_NAT
315
316# mangle + specific targets
317config IP_NF_MANGLE
318 tristate "Packet mangling"
319 default m if NETFILTER_ADVANCED=n
320 help
321 This option adds a `mangle' table to iptables: see the man page for
322 iptables(8). This table is used for various packet alterations
323 which can effect how the packet is routed.
324
325 To compile it as a module, choose M here. If unsure, say N.
326
327config IP_NF_TARGET_CLUSTERIP
328 tristate "CLUSTERIP target support"
329 depends on IP_NF_MANGLE
330 depends on NF_CONNTRACK_IPV4
331 depends on NETFILTER_ADVANCED
332 select NF_CONNTRACK_MARK
333 help
334 The CLUSTERIP target allows you to build load-balancing clusters of
335 network servers without having a dedicated load-balancing
336 router/server/switch.
337
338 To compile it as a module, choose M here. If unsure, say N.
339
340config IP_NF_TARGET_ECN
341 tristate "ECN target support"
342 depends on IP_NF_MANGLE
343 depends on NETFILTER_ADVANCED
344 ---help---
345 This option adds a `ECN' target, which can be used in the iptables mangle
346 table.
347
348 You can use this target to remove the ECN bits from the IPv4 header of
349 an IP packet. This is particularly useful, if you need to work around
350 existing ECN blackholes on the internet, but don't want to disable
351 ECN support in general.
352
353 To compile it as a module, choose M here. If unsure, say N.
354
355config IP_NF_TARGET_TTL
356 tristate '"TTL" target support'
357 depends on NETFILTER_ADVANCED && IP_NF_MANGLE
358 select NETFILTER_XT_TARGET_HL
359 ---help---
360 This is a backwards-compatible option for the user's convenience
361 (e.g. when running oldconfig). It selects
362 CONFIG_NETFILTER_XT_TARGET_HL.
363
364# raw + specific targets
365config IP_NF_RAW
366 tristate 'raw table support (required for NOTRACK/TRACE)'
367 help
368 This option adds a `raw' table to iptables. This table is the very
369 first in the netfilter framework and hooks in at the PREROUTING
370 and OUTPUT chains.
371
372 If you want to compile it as a module, say M here and read
373 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
374
375# security table for MAC policy
376config IP_NF_SECURITY
377 tristate "Security table"
378 depends on SECURITY
379 depends on NETFILTER_ADVANCED
380 help
381 This option adds a `security' table to iptables, for use
382 with Mandatory Access Control (MAC) policy.
383
384 If unsure, say N.
385
386endif # IP_NF_IPTABLES
387
388# ARP tables
389config IP_NF_ARPTABLES
390 tristate "ARP tables support"
391 select NETFILTER_XTABLES
392 depends on NETFILTER_ADVANCED
393 help
394 arptables is a general, extensible packet identification framework.
395 The ARP packet filtering and mangling (manipulation)subsystems
396 use this: say Y or M here if you want to use either of those.
397
398 To compile it as a module, choose M here. If unsure, say N.
399
400if IP_NF_ARPTABLES
401
402config IP_NF_ARPFILTER
403 tristate "ARP packet filtering"
404 help
405 ARP packet filtering defines a table `filter', which has a series of
406 rules for simple ARP packet filtering at local input and
407 local output. On a bridge, you can also specify filtering rules
408 for forwarded ARP packets. See the man page for arptables(8).
409
410 To compile it as a module, choose M here. If unsure, say N.
411
412config IP_NF_ARP_MANGLE
413 tristate "ARP payload mangling"
414 help
415 Allows altering the ARP packet payload: source and destination
416 hardware and network addresses.
417
418endif # IP_NF_ARPTABLES
419
420endmenu
421