1# SPDX-License-Identifier: GPL-2.0-only 2# 3# IP netfilter configuration 4# 5 6menu "IP: Netfilter Configuration" 7 depends on INET && NETFILTER 8 9config NF_DEFRAG_IPV4 10 tristate 11 default n 12 13config NF_SOCKET_IPV4 14 tristate "IPv4 socket lookup support" 15 help 16 This option enables the IPv4 socket lookup infrastructure. This is 17 is required by the {ip,nf}tables socket match. 18 19config NF_TPROXY_IPV4 20 tristate "IPv4 tproxy support" 21 22if NF_TABLES 23 24config NF_TABLES_IPV4 25 bool "IPv4 nf_tables support" 26 help 27 This option enables the IPv4 support for nf_tables. 28 29if NF_TABLES_IPV4 30 31config NFT_REJECT_IPV4 32 select NF_REJECT_IPV4 33 default NFT_REJECT 34 tristate 35 36config NFT_DUP_IPV4 37 tristate "IPv4 nf_tables packet duplication support" 38 depends on !NF_CONNTRACK || NF_CONNTRACK 39 select NF_DUP_IPV4 40 help 41 This module enables IPv4 packet duplication support for nf_tables. 42 43config NFT_FIB_IPV4 44 select NFT_FIB 45 tristate "nf_tables fib / ip route lookup support" 46 help 47 This module enables IPv4 FIB lookups, e.g. for reverse path filtering. 48 It also allows query of the FIB for the route type, e.g. local, unicast, 49 multicast or blackhole. 50 51endif # NF_TABLES_IPV4 52 53config NF_TABLES_ARP 54 bool "ARP nf_tables support" 55 select NETFILTER_FAMILY_ARP 56 help 57 This option enables the ARP support for nf_tables. 58 59endif # NF_TABLES 60 61config NF_FLOW_TABLE_IPV4 62 tristate "Netfilter flow table IPv4 module" 63 depends on NF_FLOW_TABLE 64 help 65 This option adds the flow table IPv4 support. 66 67 To compile it as a module, choose M here. 68 69config NF_DUP_IPV4 70 tristate "Netfilter IPv4 packet duplication to alternate destination" 71 depends on !NF_CONNTRACK || NF_CONNTRACK 72 help 73 This option enables the nf_dup_ipv4 core, which duplicates an IPv4 74 packet to be rerouted to another destination. 75 76config NF_LOG_ARP 77 tristate "ARP packet logging" 78 default m if NETFILTER_ADVANCED=n 79 select NF_LOG_SYSLOG 80 help 81 This is a backwards-compat option for the user's convenience 82 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG. 83 84config NF_LOG_IPV4 85 tristate "IPv4 packet logging" 86 default m if NETFILTER_ADVANCED=n 87 select NF_LOG_SYSLOG 88 help 89 This is a backwards-compat option for the user's convenience 90 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG. 91 92config NF_REJECT_IPV4 93 tristate "IPv4 packet rejection" 94 default m if NETFILTER_ADVANCED=n 95 96if NF_NAT 97config NF_NAT_SNMP_BASIC 98 tristate "Basic SNMP-ALG support" 99 depends on NF_CONNTRACK_SNMP 100 depends on NETFILTER_ADVANCED 101 default NF_NAT && NF_CONNTRACK_SNMP 102 select ASN1 103 help 104 105 This module implements an Application Layer Gateway (ALG) for 106 SNMP payloads. In conjunction with NAT, it allows a network 107 management system to access multiple private networks with 108 conflicting addresses. It works by modifying IP addresses 109 inside SNMP payloads to match IP-layer NAT mapping. 110 111 This is the "basic" form of SNMP-ALG, as described in RFC 2962 112 113 To compile it as a module, choose M here. If unsure, say N. 114 115config NF_NAT_PPTP 116 tristate 117 depends on NF_CONNTRACK 118 default NF_CONNTRACK_PPTP 119 120config NF_NAT_H323 121 tristate 122 depends on NF_CONNTRACK 123 default NF_CONNTRACK_H323 124 125endif # NF_NAT 126 127config IP_NF_IPTABLES 128 tristate "IP tables support (required for filtering/masq/NAT)" 129 default m if NETFILTER_ADVANCED=n 130 select NETFILTER_XTABLES 131 help 132 iptables is a general, extensible packet identification framework. 133 The packet filtering and full NAT (masquerading, port forwarding, 134 etc) subsystems now use this: say `Y' or `M' here if you want to use 135 either of those. 136 137 To compile it as a module, choose M here. If unsure, say N. 138 139if IP_NF_IPTABLES 140 141# The matches. 142config IP_NF_MATCH_AH 143 tristate '"ah" match support' 144 depends on NETFILTER_ADVANCED 145 help 146 This match extension allows you to match a range of SPIs 147 inside AH header of IPSec packets. 148 149 To compile it as a module, choose M here. If unsure, say N. 150 151config IP_NF_MATCH_ECN 152 tristate '"ecn" match support' 153 depends on NETFILTER_ADVANCED 154 select NETFILTER_XT_MATCH_ECN 155 help 156 This is a backwards-compat option for the user's convenience 157 (e.g. when running oldconfig). It selects 158 CONFIG_NETFILTER_XT_MATCH_ECN. 159 160config IP_NF_MATCH_RPFILTER 161 tristate '"rpfilter" reverse path filter match support' 162 depends on NETFILTER_ADVANCED 163 depends on IP_NF_MANGLE || IP_NF_RAW 164 help 165 This option allows you to match packets whose replies would 166 go out via the interface the packet came in. 167 168 To compile it as a module, choose M here. If unsure, say N. 169 The module will be called ipt_rpfilter. 170 171config IP_NF_MATCH_TTL 172 tristate '"ttl" match support' 173 depends on NETFILTER_ADVANCED 174 select NETFILTER_XT_MATCH_HL 175 help 176 This is a backwards-compat option for the user's convenience 177 (e.g. when running oldconfig). It selects 178 CONFIG_NETFILTER_XT_MATCH_HL. 179 180# `filter', generic and specific targets 181config IP_NF_FILTER 182 tristate "Packet filtering" 183 default m if NETFILTER_ADVANCED=n 184 help 185 Packet filtering defines a table `filter', which has a series of 186 rules for simple packet filtering at local input, forwarding and 187 local output. See the man page for iptables(8). 188 189 To compile it as a module, choose M here. If unsure, say N. 190 191config IP_NF_TARGET_REJECT 192 tristate "REJECT target support" 193 depends on IP_NF_FILTER 194 select NF_REJECT_IPV4 195 default m if NETFILTER_ADVANCED=n 196 help 197 The REJECT target allows a filtering rule to specify that an ICMP 198 error should be issued in response to an incoming packet, rather 199 than silently being dropped. 200 201 To compile it as a module, choose M here. If unsure, say N. 202 203config IP_NF_TARGET_SYNPROXY 204 tristate "SYNPROXY target support" 205 depends on NF_CONNTRACK && NETFILTER_ADVANCED 206 select NETFILTER_SYNPROXY 207 select SYN_COOKIES 208 help 209 The SYNPROXY target allows you to intercept TCP connections and 210 establish them using syncookies before they are passed on to the 211 server. This allows to avoid conntrack and server resource usage 212 during SYN-flood attacks. 213 214 To compile it as a module, choose M here. If unsure, say N. 215 216# NAT + specific targets: nf_conntrack 217config IP_NF_NAT 218 tristate "iptables NAT support" 219 depends on NF_CONNTRACK 220 default m if NETFILTER_ADVANCED=n 221 select NF_NAT 222 select NETFILTER_XT_NAT 223 help 224 This enables the `nat' table in iptables. This allows masquerading, 225 port forwarding and other forms of full Network Address Port 226 Translation. 227 228 To compile it as a module, choose M here. If unsure, say N. 229 230if IP_NF_NAT 231 232config IP_NF_TARGET_MASQUERADE 233 tristate "MASQUERADE target support" 234 select NETFILTER_XT_TARGET_MASQUERADE 235 help 236 This is a backwards-compat option for the user's convenience 237 (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE. 238 239config IP_NF_TARGET_NETMAP 240 tristate "NETMAP target support" 241 depends on NETFILTER_ADVANCED 242 select NETFILTER_XT_TARGET_NETMAP 243 help 244 This is a backwards-compat option for the user's convenience 245 (e.g. when running oldconfig). It selects 246 CONFIG_NETFILTER_XT_TARGET_NETMAP. 247 248config IP_NF_TARGET_REDIRECT 249 tristate "REDIRECT target support" 250 depends on NETFILTER_ADVANCED 251 select NETFILTER_XT_TARGET_REDIRECT 252 help 253 This is a backwards-compat option for the user's convenience 254 (e.g. when running oldconfig). It selects 255 CONFIG_NETFILTER_XT_TARGET_REDIRECT. 256 257endif # IP_NF_NAT 258 259# mangle + specific targets 260config IP_NF_MANGLE 261 tristate "Packet mangling" 262 default m if NETFILTER_ADVANCED=n 263 help 264 This option adds a `mangle' table to iptables: see the man page for 265 iptables(8). This table is used for various packet alterations 266 which can effect how the packet is routed. 267 268 To compile it as a module, choose M here. If unsure, say N. 269 270config IP_NF_TARGET_CLUSTERIP 271 tristate "CLUSTERIP target support" 272 depends on IP_NF_MANGLE 273 depends on NF_CONNTRACK 274 depends on NETFILTER_ADVANCED 275 select NF_CONNTRACK_MARK 276 select NETFILTER_FAMILY_ARP 277 help 278 The CLUSTERIP target allows you to build load-balancing clusters of 279 network servers without having a dedicated load-balancing 280 router/server/switch. 281 282 To compile it as a module, choose M here. If unsure, say N. 283 284config IP_NF_TARGET_ECN 285 tristate "ECN target support" 286 depends on IP_NF_MANGLE 287 depends on NETFILTER_ADVANCED 288 help 289 This option adds a `ECN' target, which can be used in the iptables mangle 290 table. 291 292 You can use this target to remove the ECN bits from the IPv4 header of 293 an IP packet. This is particularly useful, if you need to work around 294 existing ECN blackholes on the internet, but don't want to disable 295 ECN support in general. 296 297 To compile it as a module, choose M here. If unsure, say N. 298 299config IP_NF_TARGET_TTL 300 tristate '"TTL" target support' 301 depends on NETFILTER_ADVANCED && IP_NF_MANGLE 302 select NETFILTER_XT_TARGET_HL 303 help 304 This is a backwards-compatible option for the user's convenience 305 (e.g. when running oldconfig). It selects 306 CONFIG_NETFILTER_XT_TARGET_HL. 307 308# raw + specific targets 309config IP_NF_RAW 310 tristate 'raw table support (required for NOTRACK/TRACE)' 311 help 312 This option adds a `raw' table to iptables. This table is the very 313 first in the netfilter framework and hooks in at the PREROUTING 314 and OUTPUT chains. 315 316 If you want to compile it as a module, say M here and read 317 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 318 319# security table for MAC policy 320config IP_NF_SECURITY 321 tristate "Security table" 322 depends on SECURITY 323 depends on NETFILTER_ADVANCED 324 help 325 This option adds a `security' table to iptables, for use 326 with Mandatory Access Control (MAC) policy. 327 328 If unsure, say N. 329 330endif # IP_NF_IPTABLES 331 332# ARP tables 333config IP_NF_ARPTABLES 334 tristate "ARP tables support" 335 select NETFILTER_XTABLES 336 select NETFILTER_FAMILY_ARP 337 depends on NETFILTER_ADVANCED 338 help 339 arptables is a general, extensible packet identification framework. 340 The ARP packet filtering and mangling (manipulation)subsystems 341 use this: say Y or M here if you want to use either of those. 342 343 To compile it as a module, choose M here. If unsure, say N. 344 345if IP_NF_ARPTABLES 346 347config IP_NF_ARPFILTER 348 tristate "ARP packet filtering" 349 help 350 ARP packet filtering defines a table `filter', which has a series of 351 rules for simple ARP packet filtering at local input and 352 local output. On a bridge, you can also specify filtering rules 353 for forwarded ARP packets. See the man page for arptables(8). 354 355 To compile it as a module, choose M here. If unsure, say N. 356 357config IP_NF_ARP_MANGLE 358 tristate "ARP payload mangling" 359 help 360 Allows altering the ARP packet payload: source and destination 361 hardware and network addresses. 362 363endif # IP_NF_ARPTABLES 364 365endmenu 366 367