Linux Audio

Check our new training course

Loading...
v5.4
  1# SPDX-License-Identifier: GPL-2.0-only
  2#
  3# IP netfilter configuration
  4#
  5
  6menu "IP: Netfilter Configuration"
  7	depends on INET && NETFILTER
  8
  9config NF_DEFRAG_IPV4
 10	tristate
 11	default n
 12
 13config NF_SOCKET_IPV4
 14	tristate "IPv4 socket lookup support"
 15	help
 16	  This option enables the IPv4 socket lookup infrastructure. This is
 17	  is required by the {ip,nf}tables socket match.
 18
 19config NF_TPROXY_IPV4
 20	tristate "IPv4 tproxy support"
 21
 22if NF_TABLES
 23
 24config NF_TABLES_IPV4
 25	bool "IPv4 nf_tables support"
 26	help
 27	  This option enables the IPv4 support for nf_tables.
 28
 29if NF_TABLES_IPV4
 30
 31config NFT_REJECT_IPV4
 32	select NF_REJECT_IPV4
 33	default NFT_REJECT
 34	tristate
 35
 36config NFT_DUP_IPV4
 37	tristate "IPv4 nf_tables packet duplication support"
 38	depends on !NF_CONNTRACK || NF_CONNTRACK
 39	select NF_DUP_IPV4
 40	help
 41	  This module enables IPv4 packet duplication support for nf_tables.
 42
 43config NFT_FIB_IPV4
 44	select NFT_FIB
 45	tristate "nf_tables fib / ip route lookup support"
 46	help
 47	  This module enables IPv4 FIB lookups, e.g. for reverse path filtering.
 48	  It also allows query of the FIB for the route type, e.g. local, unicast,
 49	  multicast or blackhole.
 50
 51endif # NF_TABLES_IPV4
 52
 53config NF_TABLES_ARP
 54	bool "ARP nf_tables support"
 55	select NETFILTER_FAMILY_ARP
 56	help
 57	  This option enables the ARP support for nf_tables.
 58
 59endif # NF_TABLES
 60
 61config NF_FLOW_TABLE_IPV4
 62	tristate "Netfilter flow table IPv4 module"
 63	depends on NF_FLOW_TABLE
 64	help
 65	  This option adds the flow table IPv4 support.
 66
 67	  To compile it as a module, choose M here.
 68
 69config NF_DUP_IPV4
 70	tristate "Netfilter IPv4 packet duplication to alternate destination"
 71	depends on !NF_CONNTRACK || NF_CONNTRACK
 72	help
 73	  This option enables the nf_dup_ipv4 core, which duplicates an IPv4
 74	  packet to be rerouted to another destination.
 75
 76config NF_LOG_ARP
 77	tristate "ARP packet logging"
 78	default m if NETFILTER_ADVANCED=n
 79	select NF_LOG_COMMON
 
 
 
 80
 81config NF_LOG_IPV4
 82	tristate "IPv4 packet logging"
 83	default m if NETFILTER_ADVANCED=n
 84	select NF_LOG_COMMON
 
 
 
 85
 86config NF_REJECT_IPV4
 87	tristate "IPv4 packet rejection"
 88	default m if NETFILTER_ADVANCED=n
 89
 90if NF_NAT
 91config NF_NAT_SNMP_BASIC
 92	tristate "Basic SNMP-ALG support"
 93	depends on NF_CONNTRACK_SNMP
 94	depends on NETFILTER_ADVANCED
 95	default NF_NAT && NF_CONNTRACK_SNMP
 96	select ASN1
 97	---help---
 98
 99	  This module implements an Application Layer Gateway (ALG) for
100	  SNMP payloads.  In conjunction with NAT, it allows a network
101	  management system to access multiple private networks with
102	  conflicting addresses.  It works by modifying IP addresses
103	  inside SNMP payloads to match IP-layer NAT mapping.
104
105	  This is the "basic" form of SNMP-ALG, as described in RFC 2962
106
107	  To compile it as a module, choose M here.  If unsure, say N.
108
109config NF_NAT_PPTP
110	tristate
111	depends on NF_CONNTRACK
112	default NF_CONNTRACK_PPTP
113
114config NF_NAT_H323
115	tristate
116	depends on NF_CONNTRACK
117	default NF_CONNTRACK_H323
118
119endif # NF_NAT
120
121config IP_NF_IPTABLES
122	tristate "IP tables support (required for filtering/masq/NAT)"
123	default m if NETFILTER_ADVANCED=n
124	select NETFILTER_XTABLES
125	help
126	  iptables is a general, extensible packet identification framework.
127	  The packet filtering and full NAT (masquerading, port forwarding,
128	  etc) subsystems now use this: say `Y' or `M' here if you want to use
129	  either of those.
130
131	  To compile it as a module, choose M here.  If unsure, say N.
132
133if IP_NF_IPTABLES
134
135# The matches.
136config IP_NF_MATCH_AH
137	tristate '"ah" match support'
138	depends on NETFILTER_ADVANCED
139	help
140	  This match extension allows you to match a range of SPIs
141	  inside AH header of IPSec packets.
142
143	  To compile it as a module, choose M here.  If unsure, say N.
144
145config IP_NF_MATCH_ECN
146	tristate '"ecn" match support'
147	depends on NETFILTER_ADVANCED
148	select NETFILTER_XT_MATCH_ECN
149	---help---
150	This is a backwards-compat option for the user's convenience
151	(e.g. when running oldconfig). It selects
152	CONFIG_NETFILTER_XT_MATCH_ECN.
153
154config IP_NF_MATCH_RPFILTER
155	tristate '"rpfilter" reverse path filter match support'
156	depends on NETFILTER_ADVANCED
157	depends on IP_NF_MANGLE || IP_NF_RAW
158	---help---
159	  This option allows you to match packets whose replies would
160	  go out via the interface the packet came in.
161
162	  To compile it as a module, choose M here.  If unsure, say N.
163	  The module will be called ipt_rpfilter.
164
165config IP_NF_MATCH_TTL
166	tristate '"ttl" match support'
167	depends on NETFILTER_ADVANCED
168	select NETFILTER_XT_MATCH_HL
169	---help---
170	This is a backwards-compat option for the user's convenience
171	(e.g. when running oldconfig). It selects
172	CONFIG_NETFILTER_XT_MATCH_HL.
173
174# `filter', generic and specific targets
175config IP_NF_FILTER
176	tristate "Packet filtering"
177	default m if NETFILTER_ADVANCED=n
178	help
179	  Packet filtering defines a table `filter', which has a series of
180	  rules for simple packet filtering at local input, forwarding and
181	  local output.  See the man page for iptables(8).
182
183	  To compile it as a module, choose M here.  If unsure, say N.
184
185config IP_NF_TARGET_REJECT
186	tristate "REJECT target support"
187	depends on IP_NF_FILTER
188	select NF_REJECT_IPV4
189	default m if NETFILTER_ADVANCED=n
190	help
191	  The REJECT target allows a filtering rule to specify that an ICMP
192	  error should be issued in response to an incoming packet, rather
193	  than silently being dropped.
194
195	  To compile it as a module, choose M here.  If unsure, say N.
196
197config IP_NF_TARGET_SYNPROXY
198	tristate "SYNPROXY target support"
199	depends on NF_CONNTRACK && NETFILTER_ADVANCED
200	select NETFILTER_SYNPROXY
201	select SYN_COOKIES
202	help
203	  The SYNPROXY target allows you to intercept TCP connections and
204	  establish them using syncookies before they are passed on to the
205	  server. This allows to avoid conntrack and server resource usage
206	  during SYN-flood attacks.
207
208	  To compile it as a module, choose M here. If unsure, say N.
209
210# NAT + specific targets: nf_conntrack
211config IP_NF_NAT
212	tristate "iptables NAT support"
213	depends on NF_CONNTRACK
214	default m if NETFILTER_ADVANCED=n
215	select NF_NAT
216	select NETFILTER_XT_NAT
217	help
218	  This enables the `nat' table in iptables. This allows masquerading,
219	  port forwarding and other forms of full Network Address Port
220	  Translation.
221
222	  To compile it as a module, choose M here.  If unsure, say N.
223
224if IP_NF_NAT
225
226config IP_NF_TARGET_MASQUERADE
227	tristate "MASQUERADE target support"
228	select NETFILTER_XT_TARGET_MASQUERADE
229	help
230	  This is a backwards-compat option for the user's convenience
231	  (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE.
232
233config IP_NF_TARGET_NETMAP
234	tristate "NETMAP target support"
235	depends on NETFILTER_ADVANCED
236	select NETFILTER_XT_TARGET_NETMAP
237	---help---
238	This is a backwards-compat option for the user's convenience
239	(e.g. when running oldconfig). It selects
240	CONFIG_NETFILTER_XT_TARGET_NETMAP.
241
242config IP_NF_TARGET_REDIRECT
243	tristate "REDIRECT target support"
244	depends on NETFILTER_ADVANCED
245	select NETFILTER_XT_TARGET_REDIRECT
246	---help---
247	This is a backwards-compat option for the user's convenience
248	(e.g. when running oldconfig). It selects
249	CONFIG_NETFILTER_XT_TARGET_REDIRECT.
250
251endif # IP_NF_NAT
252
253# mangle + specific targets
254config IP_NF_MANGLE
255	tristate "Packet mangling"
256	default m if NETFILTER_ADVANCED=n
257	help
258	  This option adds a `mangle' table to iptables: see the man page for
259	  iptables(8).  This table is used for various packet alterations
260	  which can effect how the packet is routed.
261
262	  To compile it as a module, choose M here.  If unsure, say N.
263
264config IP_NF_TARGET_CLUSTERIP
265	tristate "CLUSTERIP target support"
266	depends on IP_NF_MANGLE
267	depends on NF_CONNTRACK
268	depends on NETFILTER_ADVANCED
269	select NF_CONNTRACK_MARK
270	select NETFILTER_FAMILY_ARP
271	help
272	  The CLUSTERIP target allows you to build load-balancing clusters of
273	  network servers without having a dedicated load-balancing
274	  router/server/switch.
275
276	  To compile it as a module, choose M here.  If unsure, say N.
277
278config IP_NF_TARGET_ECN
279	tristate "ECN target support"
280	depends on IP_NF_MANGLE
281	depends on NETFILTER_ADVANCED
282	---help---
283	  This option adds a `ECN' target, which can be used in the iptables mangle
284	  table.
285
286	  You can use this target to remove the ECN bits from the IPv4 header of
287	  an IP packet.  This is particularly useful, if you need to work around
288	  existing ECN blackholes on the internet, but don't want to disable
289	  ECN support in general.
290
291	  To compile it as a module, choose M here.  If unsure, say N.
292
293config IP_NF_TARGET_TTL
294	tristate '"TTL" target support'
295	depends on NETFILTER_ADVANCED && IP_NF_MANGLE
296	select NETFILTER_XT_TARGET_HL
297	---help---
298	This is a backwards-compatible option for the user's convenience
299	(e.g. when running oldconfig). It selects
300	CONFIG_NETFILTER_XT_TARGET_HL.
301
302# raw + specific targets
303config IP_NF_RAW
304	tristate  'raw table support (required for NOTRACK/TRACE)'
305	help
306	  This option adds a `raw' table to iptables. This table is the very
307	  first in the netfilter framework and hooks in at the PREROUTING
308	  and OUTPUT chains.
309
310	  If you want to compile it as a module, say M here and read
311	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
312
313# security table for MAC policy
314config IP_NF_SECURITY
315	tristate "Security table"
316	depends on SECURITY
317	depends on NETFILTER_ADVANCED
318	help
319	  This option adds a `security' table to iptables, for use
320	  with Mandatory Access Control (MAC) policy.
321
322	  If unsure, say N.
323
324endif # IP_NF_IPTABLES
325
326# ARP tables
327config IP_NF_ARPTABLES
328	tristate "ARP tables support"
329	select NETFILTER_XTABLES
330	select NETFILTER_FAMILY_ARP
331	depends on NETFILTER_ADVANCED
332	help
333	  arptables is a general, extensible packet identification framework.
334	  The ARP packet filtering and mangling (manipulation)subsystems
335	  use this: say Y or M here if you want to use either of those.
336
337	  To compile it as a module, choose M here.  If unsure, say N.
338
339if IP_NF_ARPTABLES
340
341config IP_NF_ARPFILTER
342	tristate "ARP packet filtering"
343	help
344	  ARP packet filtering defines a table `filter', which has a series of
345	  rules for simple ARP packet filtering at local input and
346	  local output.  On a bridge, you can also specify filtering rules
347	  for forwarded ARP packets. See the man page for arptables(8).
348
349	  To compile it as a module, choose M here.  If unsure, say N.
350
351config IP_NF_ARP_MANGLE
352	tristate "ARP payload mangling"
353	help
354	  Allows altering the ARP packet payload: source and destination
355	  hardware and network addresses.
356
357endif # IP_NF_ARPTABLES
358
359endmenu
360
v6.8
  1# SPDX-License-Identifier: GPL-2.0-only
  2#
  3# IP netfilter configuration
  4#
  5
  6menu "IP: Netfilter Configuration"
  7	depends on INET && NETFILTER
  8
  9config NF_DEFRAG_IPV4
 10	tristate
 11	default n
 12
 13config NF_SOCKET_IPV4
 14	tristate "IPv4 socket lookup support"
 15	help
 16	  This option enables the IPv4 socket lookup infrastructure. This is
 17	  is required by the {ip,nf}tables socket match.
 18
 19config NF_TPROXY_IPV4
 20	tristate "IPv4 tproxy support"
 21
 22if NF_TABLES
 23
 24config NF_TABLES_IPV4
 25	bool "IPv4 nf_tables support"
 26	help
 27	  This option enables the IPv4 support for nf_tables.
 28
 29if NF_TABLES_IPV4
 30
 31config NFT_REJECT_IPV4
 32	select NF_REJECT_IPV4
 33	default NFT_REJECT
 34	tristate
 35
 36config NFT_DUP_IPV4
 37	tristate "IPv4 nf_tables packet duplication support"
 38	depends on !NF_CONNTRACK || NF_CONNTRACK
 39	select NF_DUP_IPV4
 40	help
 41	  This module enables IPv4 packet duplication support for nf_tables.
 42
 43config NFT_FIB_IPV4
 44	select NFT_FIB
 45	tristate "nf_tables fib / ip route lookup support"
 46	help
 47	  This module enables IPv4 FIB lookups, e.g. for reverse path filtering.
 48	  It also allows query of the FIB for the route type, e.g. local, unicast,
 49	  multicast or blackhole.
 50
 51endif # NF_TABLES_IPV4
 52
 53config NF_TABLES_ARP
 54	bool "ARP nf_tables support"
 55	select NETFILTER_FAMILY_ARP
 56	help
 57	  This option enables the ARP support for nf_tables.
 58
 59endif # NF_TABLES
 60
 
 
 
 
 
 
 
 
 61config NF_DUP_IPV4
 62	tristate "Netfilter IPv4 packet duplication to alternate destination"
 63	depends on !NF_CONNTRACK || NF_CONNTRACK
 64	help
 65	  This option enables the nf_dup_ipv4 core, which duplicates an IPv4
 66	  packet to be rerouted to another destination.
 67
 68config NF_LOG_ARP
 69	tristate "ARP packet logging"
 70	default m if NETFILTER_ADVANCED=n
 71	select NF_LOG_SYSLOG
 72	help
 73	This is a backwards-compat option for the user's convenience
 74	(e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG.
 75
 76config NF_LOG_IPV4
 77	tristate "IPv4 packet logging"
 78	default m if NETFILTER_ADVANCED=n
 79	select NF_LOG_SYSLOG
 80	help
 81	This is a backwards-compat option for the user's convenience
 82	(e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG.
 83
 84config NF_REJECT_IPV4
 85	tristate "IPv4 packet rejection"
 86	default m if NETFILTER_ADVANCED=n
 87
 88if NF_NAT
 89config NF_NAT_SNMP_BASIC
 90	tristate "Basic SNMP-ALG support"
 91	depends on NF_CONNTRACK_SNMP
 92	depends on NETFILTER_ADVANCED
 93	default NF_NAT && NF_CONNTRACK_SNMP
 94	select ASN1
 95	help
 96
 97	  This module implements an Application Layer Gateway (ALG) for
 98	  SNMP payloads.  In conjunction with NAT, it allows a network
 99	  management system to access multiple private networks with
100	  conflicting addresses.  It works by modifying IP addresses
101	  inside SNMP payloads to match IP-layer NAT mapping.
102
103	  This is the "basic" form of SNMP-ALG, as described in RFC 2962
104
105	  To compile it as a module, choose M here.  If unsure, say N.
106
107config NF_NAT_PPTP
108	tristate
109	depends on NF_CONNTRACK
110	default NF_CONNTRACK_PPTP
111
112config NF_NAT_H323
113	tristate
114	depends on NF_CONNTRACK
115	default NF_CONNTRACK_H323
116
117endif # NF_NAT
118
119config IP_NF_IPTABLES
120	tristate "IP tables support (required for filtering/masq/NAT)"
121	default m if NETFILTER_ADVANCED=n
122	select NETFILTER_XTABLES
123	help
124	  iptables is a general, extensible packet identification framework.
125	  The packet filtering and full NAT (masquerading, port forwarding,
126	  etc) subsystems now use this: say `Y' or `M' here if you want to use
127	  either of those.
128
129	  To compile it as a module, choose M here.  If unsure, say N.
130
131if IP_NF_IPTABLES
132
133# The matches.
134config IP_NF_MATCH_AH
135	tristate '"ah" match support'
136	depends on NETFILTER_ADVANCED
137	help
138	  This match extension allows you to match a range of SPIs
139	  inside AH header of IPSec packets.
140
141	  To compile it as a module, choose M here.  If unsure, say N.
142
143config IP_NF_MATCH_ECN
144	tristate '"ecn" match support'
145	depends on NETFILTER_ADVANCED
146	select NETFILTER_XT_MATCH_ECN
147	help
148	This is a backwards-compat option for the user's convenience
149	(e.g. when running oldconfig). It selects
150	CONFIG_NETFILTER_XT_MATCH_ECN.
151
152config IP_NF_MATCH_RPFILTER
153	tristate '"rpfilter" reverse path filter match support'
154	depends on NETFILTER_ADVANCED
155	depends on IP_NF_MANGLE || IP_NF_RAW
156	help
157	  This option allows you to match packets whose replies would
158	  go out via the interface the packet came in.
159
160	  To compile it as a module, choose M here.  If unsure, say N.
161	  The module will be called ipt_rpfilter.
162
163config IP_NF_MATCH_TTL
164	tristate '"ttl" match support'
165	depends on NETFILTER_ADVANCED
166	select NETFILTER_XT_MATCH_HL
167	help
168	This is a backwards-compat option for the user's convenience
169	(e.g. when running oldconfig). It selects
170	CONFIG_NETFILTER_XT_MATCH_HL.
171
172# `filter', generic and specific targets
173config IP_NF_FILTER
174	tristate "Packet filtering"
175	default m if NETFILTER_ADVANCED=n
176	help
177	  Packet filtering defines a table `filter', which has a series of
178	  rules for simple packet filtering at local input, forwarding and
179	  local output.  See the man page for iptables(8).
180
181	  To compile it as a module, choose M here.  If unsure, say N.
182
183config IP_NF_TARGET_REJECT
184	tristate "REJECT target support"
185	depends on IP_NF_FILTER
186	select NF_REJECT_IPV4
187	default m if NETFILTER_ADVANCED=n
188	help
189	  The REJECT target allows a filtering rule to specify that an ICMP
190	  error should be issued in response to an incoming packet, rather
191	  than silently being dropped.
192
193	  To compile it as a module, choose M here.  If unsure, say N.
194
195config IP_NF_TARGET_SYNPROXY
196	tristate "SYNPROXY target support"
197	depends on NF_CONNTRACK && NETFILTER_ADVANCED
198	select NETFILTER_SYNPROXY
199	select SYN_COOKIES
200	help
201	  The SYNPROXY target allows you to intercept TCP connections and
202	  establish them using syncookies before they are passed on to the
203	  server. This allows to avoid conntrack and server resource usage
204	  during SYN-flood attacks.
205
206	  To compile it as a module, choose M here. If unsure, say N.
207
208# NAT + specific targets: nf_conntrack
209config IP_NF_NAT
210	tristate "iptables NAT support"
211	depends on NF_CONNTRACK
212	default m if NETFILTER_ADVANCED=n
213	select NF_NAT
214	select NETFILTER_XT_NAT
215	help
216	  This enables the `nat' table in iptables. This allows masquerading,
217	  port forwarding and other forms of full Network Address Port
218	  Translation.
219
220	  To compile it as a module, choose M here.  If unsure, say N.
221
222if IP_NF_NAT
223
224config IP_NF_TARGET_MASQUERADE
225	tristate "MASQUERADE target support"
226	select NETFILTER_XT_TARGET_MASQUERADE
227	help
228	  This is a backwards-compat option for the user's convenience
229	  (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE.
230
231config IP_NF_TARGET_NETMAP
232	tristate "NETMAP target support"
233	depends on NETFILTER_ADVANCED
234	select NETFILTER_XT_TARGET_NETMAP
235	help
236	This is a backwards-compat option for the user's convenience
237	(e.g. when running oldconfig). It selects
238	CONFIG_NETFILTER_XT_TARGET_NETMAP.
239
240config IP_NF_TARGET_REDIRECT
241	tristate "REDIRECT target support"
242	depends on NETFILTER_ADVANCED
243	select NETFILTER_XT_TARGET_REDIRECT
244	help
245	This is a backwards-compat option for the user's convenience
246	(e.g. when running oldconfig). It selects
247	CONFIG_NETFILTER_XT_TARGET_REDIRECT.
248
249endif # IP_NF_NAT
250
251# mangle + specific targets
252config IP_NF_MANGLE
253	tristate "Packet mangling"
254	default m if NETFILTER_ADVANCED=n
255	help
256	  This option adds a `mangle' table to iptables: see the man page for
257	  iptables(8).  This table is used for various packet alterations
258	  which can effect how the packet is routed.
259
260	  To compile it as a module, choose M here.  If unsure, say N.
261
 
 
 
 
 
 
 
 
 
 
 
 
 
 
262config IP_NF_TARGET_ECN
263	tristate "ECN target support"
264	depends on IP_NF_MANGLE
265	depends on NETFILTER_ADVANCED
266	help
267	  This option adds a `ECN' target, which can be used in the iptables mangle
268	  table.
269
270	  You can use this target to remove the ECN bits from the IPv4 header of
271	  an IP packet.  This is particularly useful, if you need to work around
272	  existing ECN blackholes on the internet, but don't want to disable
273	  ECN support in general.
274
275	  To compile it as a module, choose M here.  If unsure, say N.
276
277config IP_NF_TARGET_TTL
278	tristate '"TTL" target support'
279	depends on NETFILTER_ADVANCED && IP_NF_MANGLE
280	select NETFILTER_XT_TARGET_HL
281	help
282	This is a backwards-compatible option for the user's convenience
283	(e.g. when running oldconfig). It selects
284	CONFIG_NETFILTER_XT_TARGET_HL.
285
286# raw + specific targets
287config IP_NF_RAW
288	tristate  'raw table support (required for NOTRACK/TRACE)'
289	help
290	  This option adds a `raw' table to iptables. This table is the very
291	  first in the netfilter framework and hooks in at the PREROUTING
292	  and OUTPUT chains.
293
294	  If you want to compile it as a module, say M here and read
295	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
296
297# security table for MAC policy
298config IP_NF_SECURITY
299	tristate "Security table"
300	depends on SECURITY
301	depends on NETFILTER_ADVANCED
302	help
303	  This option adds a `security' table to iptables, for use
304	  with Mandatory Access Control (MAC) policy.
305
306	  If unsure, say N.
307
308endif # IP_NF_IPTABLES
309
310# ARP tables
311config IP_NF_ARPTABLES
312	tristate "ARP tables support"
313	select NETFILTER_XTABLES
314	select NETFILTER_FAMILY_ARP
315	depends on NETFILTER_ADVANCED
316	help
317	  arptables is a general, extensible packet identification framework.
318	  The ARP packet filtering and mangling (manipulation)subsystems
319	  use this: say Y or M here if you want to use either of those.
320
321	  To compile it as a module, choose M here.  If unsure, say N.
322
323if IP_NF_ARPTABLES
324
325config IP_NF_ARPFILTER
326	tristate "ARP packet filtering"
327	help
328	  ARP packet filtering defines a table `filter', which has a series of
329	  rules for simple ARP packet filtering at local input and
330	  local output.  On a bridge, you can also specify filtering rules
331	  for forwarded ARP packets. See the man page for arptables(8).
332
333	  To compile it as a module, choose M here.  If unsure, say N.
334
335config IP_NF_ARP_MANGLE
336	tristate "ARP payload mangling"
337	help
338	  Allows altering the ARP packet payload: source and destination
339	  hardware and network addresses.
340
341endif # IP_NF_ARPTABLES
342
343endmenu
344