tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1#
2# IP netfilter configuration
3#
4
5menu "IP: Netfilter Configuration"
6 depends on INET && NETFILTER
7
8config NF_CONNTRACK_IPV4
9 tristate "IPv4 support for new connection tracking (EXPERIMENTAL)"
10 depends on EXPERIMENTAL && NF_CONNTRACK
11 ---help---
12 Connection tracking keeps a record of what packets have passed
13 through your machine, in order to figure out how they are related
14 into connections.
15
16 This is IPv4 support on Layer 3 independent connection tracking.
17 Layer 3 independent connection tracking is experimental scheme
18 which generalize ip_conntrack to support other layer 3 protocols.
19
20 To compile it as a module, choose M here. If unsure, say N.
21
22# connection tracking, helpers and protocols
23config IP_NF_CONNTRACK
24 tristate "Connection tracking (required for masq/NAT)"
25 ---help---
26 Connection tracking keeps a record of what packets have passed
27 through your machine, in order to figure out how they are related
28 into connections.
29
30 This is required to do Masquerading or other kinds of Network
31 Address Translation (except for Fast NAT). It can also be used to
32 enhance packet filtering (see `Connection state match support'
33 below).
34
35 To compile it as a module, choose M here. If unsure, say N.
36
37config IP_NF_CT_ACCT
38 bool "Connection tracking flow accounting"
39 depends on IP_NF_CONNTRACK
40 help
41 If this option is enabled, the connection tracking code will
42 keep per-flow packet and byte counters.
43
44 Those counters can be used for flow-based accounting or the
45 `connbytes' match.
46
47 If unsure, say `N'.
48
49config IP_NF_CONNTRACK_MARK
50 bool 'Connection mark tracking support'
51 depends on IP_NF_CONNTRACK
52 help
53 This option enables support for connection marks, used by the
54 `CONNMARK' target and `connmark' match. Similar to the mark value
55 of packets, but this mark value is kept in the conntrack session
56 instead of the individual packets.
57
58config IP_NF_CONNTRACK_EVENTS
59 bool "Connection tracking events (EXPERIMENTAL)"
60 depends on EXPERIMENTAL && IP_NF_CONNTRACK
61 help
62 If this option is enabled, the connection tracking code will
63 provide a notifier chain that can be used by other kernel code
64 to get notified about changes in the connection tracking state.
65
66 IF unsure, say `N'.
67
68config IP_NF_CONNTRACK_NETLINK
69 tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
70 depends on EXPERIMENTAL && IP_NF_CONNTRACK && NETFILTER_NETLINK
71 depends on IP_NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
72 depends on IP_NF_NAT=n || IP_NF_NAT
73 help
74 This option enables support for a netlink-based userspace interface
75
76
77config IP_NF_CT_PROTO_SCTP
78 tristate 'SCTP protocol connection tracking support (EXPERIMENTAL)'
79 depends on IP_NF_CONNTRACK && EXPERIMENTAL
80 help
81 With this option enabled, the connection tracking code will
82 be able to do state tracking on SCTP connections.
83
84 If you want to compile it as a module, say M here and read
85 <file:Documentation/modules.txt>. If unsure, say `N'.
86
87config IP_NF_FTP
88 tristate "FTP protocol support"
89 depends on IP_NF_CONNTRACK
90 help
91 Tracking FTP connections is problematic: special helpers are
92 required for tracking them, and doing masquerading and other forms
93 of Network Address Translation on them.
94
95 To compile it as a module, choose M here. If unsure, say Y.
96
97config IP_NF_IRC
98 tristate "IRC protocol support"
99 depends on IP_NF_CONNTRACK
100 ---help---
101 There is a commonly-used extension to IRC called
102 Direct Client-to-Client Protocol (DCC). This enables users to send
103 files to each other, and also chat to each other without the need
104 of a server. DCC Sending is used anywhere you send files over IRC,
105 and DCC Chat is most commonly used by Eggdrop bots. If you are
106 using NAT, this extension will enable you to send files and initiate
107 chats. Note that you do NOT need this extension to get files or
108 have others initiate chats, or everything else in IRC.
109
110 To compile it as a module, choose M here. If unsure, say Y.
111
112config IP_NF_NETBIOS_NS
113 tristate "NetBIOS name service protocol support (EXPERIMENTAL)"
114 depends on IP_NF_CONNTRACK && EXPERIMENTAL
115 help
116 NetBIOS name service requests are sent as broadcast messages from an
117 unprivileged port and responded to with unicast messages to the
118 same port. This make them hard to firewall properly because connection
119 tracking doesn't deal with broadcasts. This helper tracks locally
120 originating NetBIOS name service requests and the corresponding
121 responses. It relies on correct IP address configuration, specifically
122 netmask and broadcast address. When properly configured, the output
123 of "ip address show" should look similar to this:
124
125 $ ip -4 address show eth0
126 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
127 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
128
129 To compile it as a module, choose M here. If unsure, say N.
130
131config IP_NF_TFTP
132 tristate "TFTP protocol support"
133 depends on IP_NF_CONNTRACK
134 help
135 TFTP connection tracking helper, this is required depending
136 on how restrictive your ruleset is.
137 If you are using a tftp client behind -j SNAT or -j MASQUERADING
138 you will need this.
139
140 To compile it as a module, choose M here. If unsure, say Y.
141
142config IP_NF_AMANDA
143 tristate "Amanda backup protocol support"
144 depends on IP_NF_CONNTRACK
145 help
146 If you are running the Amanda backup package <http://www.amanda.org/>
147 on this machine or machines that will be MASQUERADED through this
148 machine, then you may want to enable this feature. This allows the
149 connection tracking and natting code to allow the sub-channels that
150 Amanda requires for communication of the backup data, messages and
151 index.
152
153 To compile it as a module, choose M here. If unsure, say Y.
154
155config IP_NF_PPTP
156 tristate 'PPTP protocol support'
157 depends on IP_NF_CONNTRACK
158 help
159 This module adds support for PPTP (Point to Point Tunnelling
160 Protocol, RFC2637) connection tracking and NAT.
161
162 If you are running PPTP sessions over a stateful firewall or NAT
163 box, you may want to enable this feature.
164
165 Please note that not all PPTP modes of operation are supported yet.
166 For more info, read top of the file
167 net/ipv4/netfilter/ip_conntrack_pptp.c
168
169 If you want to compile it as a module, say M here and read
170 Documentation/modules.txt. If unsure, say `N'.
171
172config IP_NF_H323
173 tristate 'H.323 protocol support'
174 depends on IP_NF_CONNTRACK
175 help
176 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
177 important VoIP protocols, it is widely used by voice hardware and
178 software including voice gateways, IP phones, Netmeeting, OpenPhone,
179 Gnomemeeting, etc.
180
181 With this module you can support H.323 on a connection tracking/NAT
182 firewall.
183
184 This module supports RAS, Fast-start, H.245 tunnelling, RTP/RTCP
185 and T.120 based data and applications including audio, video, FAX,
186 chat, whiteboard, file transfer, etc. For more information, please
187 see http://nath323.sourceforge.net/.
188
189 If you want to compile it as a module, say 'M' here and read
190 Documentation/modules.txt. If unsure, say 'N'.
191
192config IP_NF_QUEUE
193 tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
194 help
195 Netfilter has the ability to queue packets to user space: the
196 netlink device can be used to access them using this driver.
197
198 This option enables the old IPv4-only "ip_queue" implementation
199 which has been obsoleted by the new "nfnetlink_queue" code (see
200 CONFIG_NETFILTER_NETLINK_QUEUE).
201
202 To compile it as a module, choose M here. If unsure, say N.
203
204config IP_NF_IPTABLES
205 tristate "IP tables support (required for filtering/masq/NAT)"
206 depends on NETFILTER_XTABLES
207 help
208 iptables is a general, extensible packet identification framework.
209 The packet filtering and full NAT (masquerading, port forwarding,
210 etc) subsystems now use this: say `Y' or `M' here if you want to use
211 either of those.
212
213 To compile it as a module, choose M here. If unsure, say N.
214
215# The matches.
216config IP_NF_MATCH_IPRANGE
217 tristate "IP range match support"
218 depends on IP_NF_IPTABLES
219 help
220 This option makes possible to match IP addresses against IP address
221 ranges.
222
223 To compile it as a module, choose M here. If unsure, say N.
224
225config IP_NF_MATCH_TOS
226 tristate "TOS match support"
227 depends on IP_NF_IPTABLES
228 help
229 TOS matching allows you to match packets based on the Type Of
230 Service fields of the IP packet.
231
232 To compile it as a module, choose M here. If unsure, say N.
233
234config IP_NF_MATCH_RECENT
235 tristate "recent match support"
236 depends on IP_NF_IPTABLES
237 help
238 This match is used for creating one or many lists of recently
239 used addresses and then matching against that/those list(s).
240
241 Short options are available by using 'iptables -m recent -h'
242 Official Website: <http://snowman.net/projects/ipt_recent/>
243
244 To compile it as a module, choose M here. If unsure, say N.
245
246config IP_NF_MATCH_ECN
247 tristate "ECN match support"
248 depends on IP_NF_IPTABLES
249 help
250 This option adds a `ECN' match, which allows you to match against
251 the IPv4 and TCP header ECN fields.
252
253 To compile it as a module, choose M here. If unsure, say N.
254
255config IP_NF_MATCH_DSCP
256 tristate "DSCP match support"
257 depends on IP_NF_IPTABLES
258 help
259 This option adds a `DSCP' match, which allows you to match against
260 the IPv4 header DSCP field (DSCP codepoint).
261
262 The DSCP codepoint can have any value between 0x0 and 0x4f.
263
264 To compile it as a module, choose M here. If unsure, say N.
265
266config IP_NF_MATCH_AH
267 tristate "AH match support"
268 depends on IP_NF_IPTABLES
269 help
270 This match extension allows you to match a range of SPIs
271 inside AH header of IPSec packets.
272
273 To compile it as a module, choose M here. If unsure, say N.
274
275config IP_NF_MATCH_TTL
276 tristate "TTL match support"
277 depends on IP_NF_IPTABLES
278 help
279 This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
280 to match packets by their TTL value.
281
282 To compile it as a module, choose M here. If unsure, say N.
283
284config IP_NF_MATCH_OWNER
285 tristate "Owner match support"
286 depends on IP_NF_IPTABLES
287 help
288 Packet owner matching allows you to match locally-generated packets
289 based on who created them: the user, group, process or session.
290
291 To compile it as a module, choose M here. If unsure, say N.
292
293config IP_NF_MATCH_ADDRTYPE
294 tristate 'address type match support'
295 depends on IP_NF_IPTABLES
296 help
297 This option allows you to match what routing thinks of an address,
298 eg. UNICAST, LOCAL, BROADCAST, ...
299
300 If you want to compile it as a module, say M here and read
301 <file:Documentation/modules.txt>. If unsure, say `N'.
302
303config IP_NF_MATCH_HASHLIMIT
304 tristate 'hashlimit match support'
305 depends on IP_NF_IPTABLES
306 help
307 This option adds a new iptables `hashlimit' match.
308
309 As opposed to `limit', this match dynamically crates a hash table
310 of limit buckets, based on your selection of source/destination
311 ip addresses and/or ports.
312
313 It enables you to express policies like `10kpps for any given
314 destination IP' or `500pps from any given source IP' with a single
315 IPtables rule.
316
317# `filter', generic and specific targets
318config IP_NF_FILTER
319 tristate "Packet filtering"
320 depends on IP_NF_IPTABLES
321 help
322 Packet filtering defines a table `filter', which has a series of
323 rules for simple packet filtering at local input, forwarding and
324 local output. See the man page for iptables(8).
325
326 To compile it as a module, choose M here. If unsure, say N.
327
328config IP_NF_TARGET_REJECT
329 tristate "REJECT target support"
330 depends on IP_NF_FILTER
331 help
332 The REJECT target allows a filtering rule to specify that an ICMP
333 error should be issued in response to an incoming packet, rather
334 than silently being dropped.
335
336 To compile it as a module, choose M here. If unsure, say N.
337
338config IP_NF_TARGET_LOG
339 tristate "LOG target support"
340 depends on IP_NF_IPTABLES
341 help
342 This option adds a `LOG' target, which allows you to create rules in
343 any iptables table which records the packet header to the syslog.
344
345 To compile it as a module, choose M here. If unsure, say N.
346
347config IP_NF_TARGET_ULOG
348 tristate "ULOG target support"
349 depends on IP_NF_IPTABLES
350 ---help---
351
352 This option enables the old IPv4-only "ipt_ULOG" implementation
353 which has been obsoleted by the new "nfnetlink_log" code (see
354 CONFIG_NETFILTER_NETLINK_LOG).
355
356 This option adds a `ULOG' target, which allows you to create rules in
357 any iptables table. The packet is passed to a userspace logging
358 daemon using netlink multicast sockets; unlike the LOG target
359 which can only be viewed through syslog.
360
361 The apropriate userspace logging daemon (ulogd) may be obtained from
362 <http://www.gnumonks.org/projects/ulogd/>
363
364 To compile it as a module, choose M here. If unsure, say N.
365
366config IP_NF_TARGET_TCPMSS
367 tristate "TCPMSS target support"
368 depends on IP_NF_IPTABLES
369 ---help---
370 This option adds a `TCPMSS' target, which allows you to alter the
371 MSS value of TCP SYN packets, to control the maximum size for that
372 connection (usually limiting it to your outgoing interface's MTU
373 minus 40).
374
375 This is used to overcome criminally braindead ISPs or servers which
376 block ICMP Fragmentation Needed packets. The symptoms of this
377 problem are that everything works fine from your Linux
378 firewall/router, but machines behind it can never exchange large
379 packets:
380 1) Web browsers connect, then hang with no data received.
381 2) Small mail works fine, but large emails hang.
382 3) ssh works fine, but scp hangs after initial handshaking.
383
384 Workaround: activate this option and add a rule to your firewall
385 configuration like:
386
387 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
388 -j TCPMSS --clamp-mss-to-pmtu
389
390 To compile it as a module, choose M here. If unsure, say N.
391
392# NAT + specific targets
393config IP_NF_NAT
394 tristate "Full NAT"
395 depends on IP_NF_IPTABLES && IP_NF_CONNTRACK
396 help
397 The Full NAT option allows masquerading, port forwarding and other
398 forms of full Network Address Port Translation. It is controlled by
399 the `nat' table in iptables: see the man page for iptables(8).
400
401 To compile it as a module, choose M here. If unsure, say N.
402
403config IP_NF_NAT_NEEDED
404 bool
405 depends on IP_NF_NAT != n
406 default y
407
408config IP_NF_TARGET_MASQUERADE
409 tristate "MASQUERADE target support"
410 depends on IP_NF_NAT
411 help
412 Masquerading is a special case of NAT: all outgoing connections are
413 changed to seem to come from a particular interface's address, and
414 if the interface goes down, those connections are lost. This is
415 only useful for dialup accounts with dynamic IP address (ie. your IP
416 address will be different on next dialup).
417
418 To compile it as a module, choose M here. If unsure, say N.
419
420config IP_NF_TARGET_REDIRECT
421 tristate "REDIRECT target support"
422 depends on IP_NF_NAT
423 help
424 REDIRECT is a special case of NAT: all incoming connections are
425 mapped onto the incoming interface's address, causing the packets to
426 come to the local machine instead of passing through. This is
427 useful for transparent proxies.
428
429 To compile it as a module, choose M here. If unsure, say N.
430
431config IP_NF_TARGET_NETMAP
432 tristate "NETMAP target support"
433 depends on IP_NF_NAT
434 help
435 NETMAP is an implementation of static 1:1 NAT mapping of network
436 addresses. It maps the network address part, while keeping the host
437 address part intact. It is similar to Fast NAT, except that
438 Netfilter's connection tracking doesn't work well with Fast NAT.
439
440 To compile it as a module, choose M here. If unsure, say N.
441
442config IP_NF_TARGET_SAME
443 tristate "SAME target support"
444 depends on IP_NF_NAT
445 help
446 This option adds a `SAME' target, which works like the standard SNAT
447 target, but attempts to give clients the same IP for all connections.
448
449 To compile it as a module, choose M here. If unsure, say N.
450
451config IP_NF_NAT_SNMP_BASIC
452 tristate "Basic SNMP-ALG support (EXPERIMENTAL)"
453 depends on EXPERIMENTAL && IP_NF_NAT
454 ---help---
455
456 This module implements an Application Layer Gateway (ALG) for
457 SNMP payloads. In conjunction with NAT, it allows a network
458 management system to access multiple private networks with
459 conflicting addresses. It works by modifying IP addresses
460 inside SNMP payloads to match IP-layer NAT mapping.
461
462 This is the "basic" form of SNMP-ALG, as described in RFC 2962
463
464 To compile it as a module, choose M here. If unsure, say N.
465
466config IP_NF_NAT_IRC
467 tristate
468 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
469 default IP_NF_NAT if IP_NF_IRC=y
470 default m if IP_NF_IRC=m
471
472# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
473# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker. Argh.
474config IP_NF_NAT_FTP
475 tristate
476 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
477 default IP_NF_NAT if IP_NF_FTP=y
478 default m if IP_NF_FTP=m
479
480config IP_NF_NAT_TFTP
481 tristate
482 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
483 default IP_NF_NAT if IP_NF_TFTP=y
484 default m if IP_NF_TFTP=m
485
486config IP_NF_NAT_AMANDA
487 tristate
488 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
489 default IP_NF_NAT if IP_NF_AMANDA=y
490 default m if IP_NF_AMANDA=m
491
492config IP_NF_NAT_PPTP
493 tristate
494 depends on IP_NF_NAT!=n && IP_NF_PPTP!=n
495 default IP_NF_NAT if IP_NF_PPTP=y
496 default m if IP_NF_PPTP=m
497
498config IP_NF_NAT_H323
499 tristate
500 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
501 default IP_NF_NAT if IP_NF_H323=y
502 default m if IP_NF_H323=m
503
504# mangle + specific targets
505config IP_NF_MANGLE
506 tristate "Packet mangling"
507 depends on IP_NF_IPTABLES
508 help
509 This option adds a `mangle' table to iptables: see the man page for
510 iptables(8). This table is used for various packet alterations
511 which can effect how the packet is routed.
512
513 To compile it as a module, choose M here. If unsure, say N.
514
515config IP_NF_TARGET_TOS
516 tristate "TOS target support"
517 depends on IP_NF_MANGLE
518 help
519 This option adds a `TOS' target, which allows you to create rules in
520 the `mangle' table which alter the Type Of Service field of an IP
521 packet prior to routing.
522
523 To compile it as a module, choose M here. If unsure, say N.
524
525config IP_NF_TARGET_ECN
526 tristate "ECN target support"
527 depends on IP_NF_MANGLE
528 ---help---
529 This option adds a `ECN' target, which can be used in the iptables mangle
530 table.
531
532 You can use this target to remove the ECN bits from the IPv4 header of
533 an IP packet. This is particularly useful, if you need to work around
534 existing ECN blackholes on the internet, but don't want to disable
535 ECN support in general.
536
537 To compile it as a module, choose M here. If unsure, say N.
538
539config IP_NF_TARGET_DSCP
540 tristate "DSCP target support"
541 depends on IP_NF_MANGLE
542 help
543 This option adds a `DSCP' match, which allows you to match against
544 the IPv4 header DSCP field (DSCP codepoint).
545
546 The DSCP codepoint can have any value between 0x0 and 0x4f.
547
548 To compile it as a module, choose M here. If unsure, say N.
549
550config IP_NF_TARGET_TTL
551 tristate 'TTL target support'
552 depends on IP_NF_MANGLE
553 help
554 This option adds a `TTL' target, which enables the user to modify
555 the TTL value of the IP header.
556
557 While it is safe to decrement/lower the TTL, this target also enables
558 functionality to increment and set the TTL value of the IP header to
559 arbitrary values. This is EXTREMELY DANGEROUS since you can easily
560 create immortal packets that loop forever on the network.
561
562 To compile it as a module, choose M here. If unsure, say N.
563
564config IP_NF_TARGET_CLUSTERIP
565 tristate "CLUSTERIP target support (EXPERIMENTAL)"
566 depends on IP_NF_MANGLE && EXPERIMENTAL
567 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK_IPV4)
568 help
569 The CLUSTERIP target allows you to build load-balancing clusters of
570 network servers without having a dedicated load-balancing
571 router/server/switch.
572
573 To compile it as a module, choose M here. If unsure, say N.
574
575# raw + specific targets
576config IP_NF_RAW
577 tristate 'raw table support (required for NOTRACK/TRACE)'
578 depends on IP_NF_IPTABLES
579 help
580 This option adds a `raw' table to iptables. This table is the very
581 first in the netfilter framework and hooks in at the PREROUTING
582 and OUTPUT chains.
583
584 If you want to compile it as a module, say M here and read
585 <file:Documentation/modules.txt>. If unsure, say `N'.
586
587# ARP tables
588config IP_NF_ARPTABLES
589 tristate "ARP tables support"
590 depends on NETFILTER_XTABLES
591 help
592 arptables is a general, extensible packet identification framework.
593 The ARP packet filtering and mangling (manipulation)subsystems
594 use this: say Y or M here if you want to use either of those.
595
596 To compile it as a module, choose M here. If unsure, say N.
597
598config IP_NF_ARPFILTER
599 tristate "ARP packet filtering"
600 depends on IP_NF_ARPTABLES
601 help
602 ARP packet filtering defines a table `filter', which has a series of
603 rules for simple ARP packet filtering at local input and
604 local output. On a bridge, you can also specify filtering rules
605 for forwarded ARP packets. See the man page for arptables(8).
606
607 To compile it as a module, choose M here. If unsure, say N.
608
609config IP_NF_ARP_MANGLE
610 tristate "ARP payload mangling"
611 depends on IP_NF_ARPTABLES
612 help
613 Allows altering the ARP packet payload: source and destination
614 hardware and network addresses.
615
616endmenu
617