tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1# SPDX-License-Identifier: GPL-2.0-only
2#
3# IP netfilter configuration
4#
5
6menu "IP: Netfilter Configuration"
7 depends on INET && NETFILTER
8
9config NF_DEFRAG_IPV4
10 tristate
11 default n
12
13config NF_SOCKET_IPV4
14 tristate "IPv4 socket lookup support"
15 help
16 This option enables the IPv4 socket lookup infrastructure. This is
17 is required by the {ip,nf}tables socket match.
18
19config NF_TPROXY_IPV4
20 tristate "IPv4 tproxy support"
21
22if NF_TABLES
23
24config NF_TABLES_IPV4
25 bool "IPv4 nf_tables support"
26 help
27 This option enables the IPv4 support for nf_tables.
28
29if NF_TABLES_IPV4
30
31config NFT_REJECT_IPV4
32 select NF_REJECT_IPV4
33 default NFT_REJECT
34 tristate
35
36config NFT_DUP_IPV4
37 tristate "IPv4 nf_tables packet duplication support"
38 depends on !NF_CONNTRACK || NF_CONNTRACK
39 select NF_DUP_IPV4
40 help
41 This module enables IPv4 packet duplication support for nf_tables.
42
43config NFT_FIB_IPV4
44 select NFT_FIB
45 tristate "nf_tables fib / ip route lookup support"
46 help
47 This module enables IPv4 FIB lookups, e.g. for reverse path filtering.
48 It also allows query of the FIB for the route type, e.g. local, unicast,
49 multicast or blackhole.
50
51endif # NF_TABLES_IPV4
52
53config NF_TABLES_ARP
54 bool "ARP nf_tables support"
55 select NETFILTER_FAMILY_ARP
56 help
57 This option enables the ARP support for nf_tables.
58
59endif # NF_TABLES
60
61config NF_FLOW_TABLE_IPV4
62 tristate "Netfilter flow table IPv4 module"
63 depends on NF_FLOW_TABLE
64 help
65 This option adds the flow table IPv4 support.
66
67 To compile it as a module, choose M here.
68
69config NF_DUP_IPV4
70 tristate "Netfilter IPv4 packet duplication to alternate destination"
71 depends on !NF_CONNTRACK || NF_CONNTRACK
72 help
73 This option enables the nf_dup_ipv4 core, which duplicates an IPv4
74 packet to be rerouted to another destination.
75
76config NF_LOG_ARP
77 tristate "ARP packet logging"
78 default m if NETFILTER_ADVANCED=n
79 select NF_LOG_SYSLOG
80 help
81 This is a backwards-compat option for the user's convenience
82 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG.
83
84config NF_LOG_IPV4
85 tristate "IPv4 packet logging"
86 default m if NETFILTER_ADVANCED=n
87 select NF_LOG_SYSLOG
88 help
89 This is a backwards-compat option for the user's convenience
90 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG.
91
92config NF_REJECT_IPV4
93 tristate "IPv4 packet rejection"
94 default m if NETFILTER_ADVANCED=n
95
96if NF_NAT
97config NF_NAT_SNMP_BASIC
98 tristate "Basic SNMP-ALG support"
99 depends on NF_CONNTRACK_SNMP
100 depends on NETFILTER_ADVANCED
101 default NF_NAT && NF_CONNTRACK_SNMP
102 select ASN1
103 help
104
105 This module implements an Application Layer Gateway (ALG) for
106 SNMP payloads. In conjunction with NAT, it allows a network
107 management system to access multiple private networks with
108 conflicting addresses. It works by modifying IP addresses
109 inside SNMP payloads to match IP-layer NAT mapping.
110
111 This is the "basic" form of SNMP-ALG, as described in RFC 2962
112
113 To compile it as a module, choose M here. If unsure, say N.
114
115config NF_NAT_PPTP
116 tristate
117 depends on NF_CONNTRACK
118 default NF_CONNTRACK_PPTP
119
120config NF_NAT_H323
121 tristate
122 depends on NF_CONNTRACK
123 default NF_CONNTRACK_H323
124
125endif # NF_NAT
126
127config IP_NF_IPTABLES
128 tristate "IP tables support (required for filtering/masq/NAT)"
129 default m if NETFILTER_ADVANCED=n
130 select NETFILTER_XTABLES
131 help
132 iptables is a general, extensible packet identification framework.
133 The packet filtering and full NAT (masquerading, port forwarding,
134 etc) subsystems now use this: say `Y' or `M' here if you want to use
135 either of those.
136
137 To compile it as a module, choose M here. If unsure, say N.
138
139if IP_NF_IPTABLES
140
141# The matches.
142config IP_NF_MATCH_AH
143 tristate '"ah" match support'
144 depends on NETFILTER_ADVANCED
145 help
146 This match extension allows you to match a range of SPIs
147 inside AH header of IPSec packets.
148
149 To compile it as a module, choose M here. If unsure, say N.
150
151config IP_NF_MATCH_ECN
152 tristate '"ecn" match support'
153 depends on NETFILTER_ADVANCED
154 select NETFILTER_XT_MATCH_ECN
155 help
156 This is a backwards-compat option for the user's convenience
157 (e.g. when running oldconfig). It selects
158 CONFIG_NETFILTER_XT_MATCH_ECN.
159
160config IP_NF_MATCH_RPFILTER
161 tristate '"rpfilter" reverse path filter match support'
162 depends on NETFILTER_ADVANCED
163 depends on IP_NF_MANGLE || IP_NF_RAW
164 help
165 This option allows you to match packets whose replies would
166 go out via the interface the packet came in.
167
168 To compile it as a module, choose M here. If unsure, say N.
169 The module will be called ipt_rpfilter.
170
171config IP_NF_MATCH_TTL
172 tristate '"ttl" match support'
173 depends on NETFILTER_ADVANCED
174 select NETFILTER_XT_MATCH_HL
175 help
176 This is a backwards-compat option for the user's convenience
177 (e.g. when running oldconfig). It selects
178 CONFIG_NETFILTER_XT_MATCH_HL.
179
180# `filter', generic and specific targets
181config IP_NF_FILTER
182 tristate "Packet filtering"
183 default m if NETFILTER_ADVANCED=n
184 help
185 Packet filtering defines a table `filter', which has a series of
186 rules for simple packet filtering at local input, forwarding and
187 local output. See the man page for iptables(8).
188
189 To compile it as a module, choose M here. If unsure, say N.
190
191config IP_NF_TARGET_REJECT
192 tristate "REJECT target support"
193 depends on IP_NF_FILTER
194 select NF_REJECT_IPV4
195 default m if NETFILTER_ADVANCED=n
196 help
197 The REJECT target allows a filtering rule to specify that an ICMP
198 error should be issued in response to an incoming packet, rather
199 than silently being dropped.
200
201 To compile it as a module, choose M here. If unsure, say N.
202
203config IP_NF_TARGET_SYNPROXY
204 tristate "SYNPROXY target support"
205 depends on NF_CONNTRACK && NETFILTER_ADVANCED
206 select NETFILTER_SYNPROXY
207 select SYN_COOKIES
208 help
209 The SYNPROXY target allows you to intercept TCP connections and
210 establish them using syncookies before they are passed on to the
211 server. This allows to avoid conntrack and server resource usage
212 during SYN-flood attacks.
213
214 To compile it as a module, choose M here. If unsure, say N.
215
216# NAT + specific targets: nf_conntrack
217config IP_NF_NAT
218 tristate "iptables NAT support"
219 depends on NF_CONNTRACK
220 default m if NETFILTER_ADVANCED=n
221 select NF_NAT
222 select NETFILTER_XT_NAT
223 help
224 This enables the `nat' table in iptables. This allows masquerading,
225 port forwarding and other forms of full Network Address Port
226 Translation.
227
228 To compile it as a module, choose M here. If unsure, say N.
229
230if IP_NF_NAT
231
232config IP_NF_TARGET_MASQUERADE
233 tristate "MASQUERADE target support"
234 select NETFILTER_XT_TARGET_MASQUERADE
235 help
236 This is a backwards-compat option for the user's convenience
237 (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE.
238
239config IP_NF_TARGET_NETMAP
240 tristate "NETMAP target support"
241 depends on NETFILTER_ADVANCED
242 select NETFILTER_XT_TARGET_NETMAP
243 help
244 This is a backwards-compat option for the user's convenience
245 (e.g. when running oldconfig). It selects
246 CONFIG_NETFILTER_XT_TARGET_NETMAP.
247
248config IP_NF_TARGET_REDIRECT
249 tristate "REDIRECT target support"
250 depends on NETFILTER_ADVANCED
251 select NETFILTER_XT_TARGET_REDIRECT
252 help
253 This is a backwards-compat option for the user's convenience
254 (e.g. when running oldconfig). It selects
255 CONFIG_NETFILTER_XT_TARGET_REDIRECT.
256
257endif # IP_NF_NAT
258
259# mangle + specific targets
260config IP_NF_MANGLE
261 tristate "Packet mangling"
262 default m if NETFILTER_ADVANCED=n
263 help
264 This option adds a `mangle' table to iptables: see the man page for
265 iptables(8). This table is used for various packet alterations
266 which can effect how the packet is routed.
267
268 To compile it as a module, choose M here. If unsure, say N.
269
270config IP_NF_TARGET_CLUSTERIP
271 tristate "CLUSTERIP target support"
272 depends on IP_NF_MANGLE
273 depends on NF_CONNTRACK
274 depends on NETFILTER_ADVANCED
275 select NF_CONNTRACK_MARK
276 select NETFILTER_FAMILY_ARP
277 help
278 The CLUSTERIP target allows you to build load-balancing clusters of
279 network servers without having a dedicated load-balancing
280 router/server/switch.
281
282 To compile it as a module, choose M here. If unsure, say N.
283
284config IP_NF_TARGET_ECN
285 tristate "ECN target support"
286 depends on IP_NF_MANGLE
287 depends on NETFILTER_ADVANCED
288 help
289 This option adds a `ECN' target, which can be used in the iptables mangle
290 table.
291
292 You can use this target to remove the ECN bits from the IPv4 header of
293 an IP packet. This is particularly useful, if you need to work around
294 existing ECN blackholes on the internet, but don't want to disable
295 ECN support in general.
296
297 To compile it as a module, choose M here. If unsure, say N.
298
299config IP_NF_TARGET_TTL
300 tristate '"TTL" target support'
301 depends on NETFILTER_ADVANCED && IP_NF_MANGLE
302 select NETFILTER_XT_TARGET_HL
303 help
304 This is a backwards-compatible option for the user's convenience
305 (e.g. when running oldconfig). It selects
306 CONFIG_NETFILTER_XT_TARGET_HL.
307
308# raw + specific targets
309config IP_NF_RAW
310 tristate 'raw table support (required for NOTRACK/TRACE)'
311 help
312 This option adds a `raw' table to iptables. This table is the very
313 first in the netfilter framework and hooks in at the PREROUTING
314 and OUTPUT chains.
315
316 If you want to compile it as a module, say M here and read
317 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
318
319# security table for MAC policy
320config IP_NF_SECURITY
321 tristate "Security table"
322 depends on SECURITY
323 depends on NETFILTER_ADVANCED
324 help
325 This option adds a `security' table to iptables, for use
326 with Mandatory Access Control (MAC) policy.
327
328 If unsure, say N.
329
330endif # IP_NF_IPTABLES
331
332# ARP tables
333config IP_NF_ARPTABLES
334 tristate "ARP tables support"
335 select NETFILTER_XTABLES
336 select NETFILTER_FAMILY_ARP
337 depends on NETFILTER_ADVANCED
338 help
339 arptables is a general, extensible packet identification framework.
340 The ARP packet filtering and mangling (manipulation)subsystems
341 use this: say Y or M here if you want to use either of those.
342
343 To compile it as a module, choose M here. If unsure, say N.
344
345if IP_NF_ARPTABLES
346
347config IP_NF_ARPFILTER
348 tristate "ARP packet filtering"
349 help
350 ARP packet filtering defines a table `filter', which has a series of
351 rules for simple ARP packet filtering at local input and
352 local output. On a bridge, you can also specify filtering rules
353 for forwarded ARP packets. See the man page for arptables(8).
354
355 To compile it as a module, choose M here. If unsure, say N.
356
357config IP_NF_ARP_MANGLE
358 tristate "ARP payload mangling"
359 help
360 Allows altering the ARP packet payload: source and destination
361 hardware and network addresses.
362
363endif # IP_NF_ARPTABLES
364
365endmenu
366