1# SPDX-License-Identifier: GPL-2.0-only 2# 3# IP netfilter configuration 4# 5 6menu "IP: Netfilter Configuration" 7 depends on INET && NETFILTER 8 9config NF_DEFRAG_IPV4 10 tristate 11 default n 12 13config NF_SOCKET_IPV4 14 tristate "IPv4 socket lookup support" 15 help 16 This option enables the IPv4 socket lookup infrastructure. This is 17 is required by the {ip,nf}tables socket match. 18 19config NF_TPROXY_IPV4 20 tristate "IPv4 tproxy support" 21 22if NF_TABLES 23 24config NF_TABLES_IPV4 25 bool "IPv4 nf_tables support" 26 help 27 This option enables the IPv4 support for nf_tables. 28 29if NF_TABLES_IPV4 30 31config NFT_REJECT_IPV4 32 select NF_REJECT_IPV4 33 default NFT_REJECT 34 tristate 35 36config NFT_DUP_IPV4 37 tristate "IPv4 nf_tables packet duplication support" 38 depends on !NF_CONNTRACK || NF_CONNTRACK 39 select NF_DUP_IPV4 40 help 41 This module enables IPv4 packet duplication support for nf_tables. 42 43config NFT_FIB_IPV4 44 select NFT_FIB 45 tristate "nf_tables fib / ip route lookup support" 46 help 47 This module enables IPv4 FIB lookups, e.g. for reverse path filtering. 48 It also allows query of the FIB for the route type, e.g. local, unicast, 49 multicast or blackhole. 50 51endif # NF_TABLES_IPV4 52 53config NF_TABLES_ARP 54 bool "ARP nf_tables support" 55 select NETFILTER_FAMILY_ARP 56 help 57 This option enables the ARP support for nf_tables. 58 59endif # NF_TABLES 60 61config NF_DUP_IPV4 62 tristate "Netfilter IPv4 packet duplication to alternate destination" 63 depends on !NF_CONNTRACK || NF_CONNTRACK 64 help 65 This option enables the nf_dup_ipv4 core, which duplicates an IPv4 66 packet to be rerouted to another destination. 67 68config NF_LOG_ARP 69 tristate "ARP packet logging" 70 default m if NETFILTER_ADVANCED=n 71 select NF_LOG_SYSLOG 72 help 73 This is a backwards-compat option for the user's convenience 74 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG. 75 76config NF_LOG_IPV4 77 tristate "IPv4 packet logging" 78 default m if NETFILTER_ADVANCED=n 79 select NF_LOG_SYSLOG 80 help 81 This is a backwards-compat option for the user's convenience 82 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG. 83 84config NF_REJECT_IPV4 85 tristate "IPv4 packet rejection" 86 default m if NETFILTER_ADVANCED=n 87 88if NF_NAT 89config NF_NAT_SNMP_BASIC 90 tristate "Basic SNMP-ALG support" 91 depends on NF_CONNTRACK_SNMP 92 depends on NETFILTER_ADVANCED 93 default NF_NAT && NF_CONNTRACK_SNMP 94 select ASN1 95 help 96 97 This module implements an Application Layer Gateway (ALG) for 98 SNMP payloads. In conjunction with NAT, it allows a network 99 management system to access multiple private networks with 100 conflicting addresses. It works by modifying IP addresses 101 inside SNMP payloads to match IP-layer NAT mapping. 102 103 This is the "basic" form of SNMP-ALG, as described in RFC 2962 104 105 To compile it as a module, choose M here. If unsure, say N. 106 107config NF_NAT_PPTP 108 tristate 109 depends on NF_CONNTRACK 110 default NF_CONNTRACK_PPTP 111 112config NF_NAT_H323 113 tristate 114 depends on NF_CONNTRACK 115 default NF_CONNTRACK_H323 116 117endif # NF_NAT 118 119config IP_NF_IPTABLES 120 tristate "IP tables support (required for filtering/masq/NAT)" 121 default m if NETFILTER_ADVANCED=n 122 select NETFILTER_XTABLES 123 help 124 iptables is a general, extensible packet identification framework. 125 The packet filtering and full NAT (masquerading, port forwarding, 126 etc) subsystems now use this: say `Y' or `M' here if you want to use 127 either of those. 128 129 To compile it as a module, choose M here. If unsure, say N. 130 131if IP_NF_IPTABLES 132 133# The matches. 134config IP_NF_MATCH_AH 135 tristate '"ah" match support' 136 depends on NETFILTER_ADVANCED 137 help 138 This match extension allows you to match a range of SPIs 139 inside AH header of IPSec packets. 140 141 To compile it as a module, choose M here. If unsure, say N. 142 143config IP_NF_MATCH_ECN 144 tristate '"ecn" match support' 145 depends on NETFILTER_ADVANCED 146 select NETFILTER_XT_MATCH_ECN 147 help 148 This is a backwards-compat option for the user's convenience 149 (e.g. when running oldconfig). It selects 150 CONFIG_NETFILTER_XT_MATCH_ECN. 151 152config IP_NF_MATCH_RPFILTER 153 tristate '"rpfilter" reverse path filter match support' 154 depends on NETFILTER_ADVANCED 155 depends on IP_NF_MANGLE || IP_NF_RAW 156 help 157 This option allows you to match packets whose replies would 158 go out via the interface the packet came in. 159 160 To compile it as a module, choose M here. If unsure, say N. 161 The module will be called ipt_rpfilter. 162 163config IP_NF_MATCH_TTL 164 tristate '"ttl" match support' 165 depends on NETFILTER_ADVANCED 166 select NETFILTER_XT_MATCH_HL 167 help 168 This is a backwards-compat option for the user's convenience 169 (e.g. when running oldconfig). It selects 170 CONFIG_NETFILTER_XT_MATCH_HL. 171 172# `filter', generic and specific targets 173config IP_NF_FILTER 174 tristate "Packet filtering" 175 default m if NETFILTER_ADVANCED=n 176 help 177 Packet filtering defines a table `filter', which has a series of 178 rules for simple packet filtering at local input, forwarding and 179 local output. See the man page for iptables(8). 180 181 To compile it as a module, choose M here. If unsure, say N. 182 183config IP_NF_TARGET_REJECT 184 tristate "REJECT target support" 185 depends on IP_NF_FILTER 186 select NF_REJECT_IPV4 187 default m if NETFILTER_ADVANCED=n 188 help 189 The REJECT target allows a filtering rule to specify that an ICMP 190 error should be issued in response to an incoming packet, rather 191 than silently being dropped. 192 193 To compile it as a module, choose M here. If unsure, say N. 194 195config IP_NF_TARGET_SYNPROXY 196 tristate "SYNPROXY target support" 197 depends on NF_CONNTRACK && NETFILTER_ADVANCED 198 select NETFILTER_SYNPROXY 199 select SYN_COOKIES 200 help 201 The SYNPROXY target allows you to intercept TCP connections and 202 establish them using syncookies before they are passed on to the 203 server. This allows to avoid conntrack and server resource usage 204 during SYN-flood attacks. 205 206 To compile it as a module, choose M here. If unsure, say N. 207 208# NAT + specific targets: nf_conntrack 209config IP_NF_NAT 210 tristate "iptables NAT support" 211 depends on NF_CONNTRACK 212 default m if NETFILTER_ADVANCED=n 213 select NF_NAT 214 select NETFILTER_XT_NAT 215 help 216 This enables the `nat' table in iptables. This allows masquerading, 217 port forwarding and other forms of full Network Address Port 218 Translation. 219 220 To compile it as a module, choose M here. If unsure, say N. 221 222if IP_NF_NAT 223 224config IP_NF_TARGET_MASQUERADE 225 tristate "MASQUERADE target support" 226 select NETFILTER_XT_TARGET_MASQUERADE 227 help 228 This is a backwards-compat option for the user's convenience 229 (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE. 230 231config IP_NF_TARGET_NETMAP 232 tristate "NETMAP target support" 233 depends on NETFILTER_ADVANCED 234 select NETFILTER_XT_TARGET_NETMAP 235 help 236 This is a backwards-compat option for the user's convenience 237 (e.g. when running oldconfig). It selects 238 CONFIG_NETFILTER_XT_TARGET_NETMAP. 239 240config IP_NF_TARGET_REDIRECT 241 tristate "REDIRECT target support" 242 depends on NETFILTER_ADVANCED 243 select NETFILTER_XT_TARGET_REDIRECT 244 help 245 This is a backwards-compat option for the user's convenience 246 (e.g. when running oldconfig). It selects 247 CONFIG_NETFILTER_XT_TARGET_REDIRECT. 248 249endif # IP_NF_NAT 250 251# mangle + specific targets 252config IP_NF_MANGLE 253 tristate "Packet mangling" 254 default m if NETFILTER_ADVANCED=n 255 help 256 This option adds a `mangle' table to iptables: see the man page for 257 iptables(8). This table is used for various packet alterations 258 which can effect how the packet is routed. 259 260 To compile it as a module, choose M here. If unsure, say N. 261 262config IP_NF_TARGET_CLUSTERIP 263 tristate "CLUSTERIP target support" 264 depends on IP_NF_MANGLE 265 depends on NF_CONNTRACK 266 depends on NETFILTER_ADVANCED 267 select NF_CONNTRACK_MARK 268 select NETFILTER_FAMILY_ARP 269 help 270 The CLUSTERIP target allows you to build load-balancing clusters of 271 network servers without having a dedicated load-balancing 272 router/server/switch. 273 274 To compile it as a module, choose M here. If unsure, say N. 275 276config IP_NF_TARGET_ECN 277 tristate "ECN target support" 278 depends on IP_NF_MANGLE 279 depends on NETFILTER_ADVANCED 280 help 281 This option adds a `ECN' target, which can be used in the iptables mangle 282 table. 283 284 You can use this target to remove the ECN bits from the IPv4 header of 285 an IP packet. This is particularly useful, if you need to work around 286 existing ECN blackholes on the internet, but don't want to disable 287 ECN support in general. 288 289 To compile it as a module, choose M here. If unsure, say N. 290 291config IP_NF_TARGET_TTL 292 tristate '"TTL" target support' 293 depends on NETFILTER_ADVANCED && IP_NF_MANGLE 294 select NETFILTER_XT_TARGET_HL 295 help 296 This is a backwards-compatible option for the user's convenience 297 (e.g. when running oldconfig). It selects 298 CONFIG_NETFILTER_XT_TARGET_HL. 299 300# raw + specific targets 301config IP_NF_RAW 302 tristate 'raw table support (required for NOTRACK/TRACE)' 303 help 304 This option adds a `raw' table to iptables. This table is the very 305 first in the netfilter framework and hooks in at the PREROUTING 306 and OUTPUT chains. 307 308 If you want to compile it as a module, say M here and read 309 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 310 311# security table for MAC policy 312config IP_NF_SECURITY 313 tristate "Security table" 314 depends on SECURITY 315 depends on NETFILTER_ADVANCED 316 help 317 This option adds a `security' table to iptables, for use 318 with Mandatory Access Control (MAC) policy. 319 320 If unsure, say N. 321 322endif # IP_NF_IPTABLES 323 324# ARP tables 325config IP_NF_ARPTABLES 326 tristate "ARP tables support" 327 select NETFILTER_XTABLES 328 select NETFILTER_FAMILY_ARP 329 depends on NETFILTER_ADVANCED 330 help 331 arptables is a general, extensible packet identification framework. 332 The ARP packet filtering and mangling (manipulation)subsystems 333 use this: say Y or M here if you want to use either of those. 334 335 To compile it as a module, choose M here. If unsure, say N. 336 337if IP_NF_ARPTABLES 338 339config IP_NF_ARPFILTER 340 tristate "ARP packet filtering" 341 help 342 ARP packet filtering defines a table `filter', which has a series of 343 rules for simple ARP packet filtering at local input and 344 local output. On a bridge, you can also specify filtering rules 345 for forwarded ARP packets. See the man page for arptables(8). 346 347 To compile it as a module, choose M here. If unsure, say N. 348 349config IP_NF_ARP_MANGLE 350 tristate "ARP payload mangling" 351 help 352 Allows altering the ARP packet payload: source and destination 353 hardware and network addresses. 354 355endif # IP_NF_ARPTABLES 356 357endmenu 358 359