2 # IP netfilter configuration
5 menu "IPv6: Netfilter Configuration"
6 depends on INET && IPV6 && NETFILTER
12 config NF_CONNTRACK_IPV6
13 tristate "IPv6 connection tracking support"
14 depends on INET && IPV6 && NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
22 This is IPv6 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
26 To compile it as a module, choose M here. If unsure, say N.
28 config IP6_NF_IPTABLES
29 tristate "IP6 tables support (required for filtering)"
30 depends on INET && IPV6
31 select NETFILTER_XTABLES
32 default m if NETFILTER_ADVANCED=n
34 ip6tables is a general, extensible packet identification framework.
35 Currently only the packet filtering and packet mangling subsystem
36 for IPv6 use this, but connection tracking is going to follow.
37 Say 'Y' or 'M' here if you want to use either of those.
39 To compile it as a module, choose M here. If unsure, say N.
44 config IP6_NF_MATCH_AH
45 tristate '"ah" match support'
46 depends on NETFILTER_ADVANCED
48 This module allows one to match AH packets.
50 To compile it as a module, choose M here. If unsure, say N.
52 config IP6_NF_MATCH_EUI64
53 tristate '"eui64" address check'
54 depends on NETFILTER_ADVANCED
56 This module performs checking on the IPv6 source address
57 Compares the last 64 bits with the EUI64 (delivered
58 from the MAC address) address
60 To compile it as a module, choose M here. If unsure, say N.
62 config IP6_NF_MATCH_FRAG
63 tristate '"frag" Fragmentation header match support'
64 depends on NETFILTER_ADVANCED
66 frag matching allows you to match packets based on the fragmentation
69 To compile it as a module, choose M here. If unsure, say N.
71 config IP6_NF_MATCH_OPTS
72 tristate '"hbh" hop-by-hop and "dst" opts header match support'
73 depends on NETFILTER_ADVANCED
75 This allows one to match packets based on the hop-by-hop
76 and destination options headers of a packet.
78 To compile it as a module, choose M here. If unsure, say N.
80 config IP6_NF_MATCH_HL
81 tristate '"hl" hoplimit match support'
82 depends on NETFILTER_ADVANCED
83 select NETFILTER_XT_MATCH_HL
85 This is a backwards-compat option for the user's convenience
86 (e.g. when running oldconfig). It selects
87 CONFIG_NETFILTER_XT_MATCH_HL.
89 config IP6_NF_MATCH_IPV6HEADER
90 tristate '"ipv6header" IPv6 Extension Headers Match'
91 default m if NETFILTER_ADVANCED=n
93 This module allows one to match packets based upon
94 the ipv6 extension headers.
96 To compile it as a module, choose M here. If unsure, say N.
98 config IP6_NF_MATCH_MH
99 tristate '"mh" match support'
100 depends on NETFILTER_ADVANCED
102 This module allows one to match MH packets.
104 To compile it as a module, choose M here. If unsure, say N.
106 config IP6_NF_MATCH_RPFILTER
107 tristate '"rpfilter" reverse path filter match support'
108 depends on NETFILTER_ADVANCED && (IP6_NF_MANGLE || IP6_NF_RAW)
110 This option allows you to match packets whose replies would
111 go out via the interface the packet came in.
113 To compile it as a module, choose M here. If unsure, say N.
114 The module will be called ip6t_rpfilter.
116 config IP6_NF_MATCH_RT
117 tristate '"rt" Routing header match support'
118 depends on NETFILTER_ADVANCED
120 rt matching allows you to match packets based on the routing
121 header of the packet.
123 To compile it as a module, choose M here. If unsure, say N.
126 config IP6_NF_TARGET_HL
127 tristate '"HL" hoplimit target support'
128 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
129 select NETFILTER_XT_TARGET_HL
131 This is a backwards-compatible option for the user's convenience
132 (e.g. when running oldconfig). It selects
133 CONFIG_NETFILTER_XT_TARGET_HL.
136 tristate "Packet filtering"
137 default m if NETFILTER_ADVANCED=n
139 Packet filtering defines a table `filter', which has a series of
140 rules for simple packet filtering at local input, forwarding and
141 local output. See the man page for iptables(8).
143 To compile it as a module, choose M here. If unsure, say N.
145 config IP6_NF_TARGET_REJECT
146 tristate "REJECT target support"
147 depends on IP6_NF_FILTER
148 default m if NETFILTER_ADVANCED=n
150 The REJECT target allows a filtering rule to specify that an ICMPv6
151 error should be issued in response to an incoming packet, rather
152 than silently being dropped.
154 To compile it as a module, choose M here. If unsure, say N.
156 config IP6_NF_TARGET_SYNPROXY
157 tristate "SYNPROXY target support"
158 depends on NF_CONNTRACK && NETFILTER_ADVANCED
159 select NETFILTER_SYNPROXY
162 The SYNPROXY target allows you to intercept TCP connections and
163 establish them using syncookies before they are passed on to the
164 server. This allows to avoid conntrack and server resource usage
165 during SYN-flood attacks.
167 To compile it as a module, choose M here. If unsure, say N.
170 tristate "Packet mangling"
171 default m if NETFILTER_ADVANCED=n
173 This option adds a `mangle' table to iptables: see the man page for
174 iptables(8). This table is used for various packet alterations
175 which can effect how the packet is routed.
177 To compile it as a module, choose M here. If unsure, say N.
180 tristate 'raw table support (required for TRACE)'
182 This option adds a `raw' table to ip6tables. This table is the very
183 first in the netfilter framework and hooks in at the PREROUTING
186 If you want to compile it as a module, say M here and read
187 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
189 # security table for MAC policy
190 config IP6_NF_SECURITY
191 tristate "Security table"
193 depends on NETFILTER_ADVANCED
195 This option adds a `security' table to iptables, for use
196 with Mandatory Access Control (MAC) policy.
202 depends on NF_CONNTRACK_IPV6
203 depends on NETFILTER_ADVANCED
206 The IPv6 NAT option allows masquerading, port forwarding and other
207 forms of full Network Address Port Translation. It is controlled by
208 the `nat' table in ip6tables, see the man page for ip6tables(8).
210 To compile it as a module, choose M here. If unsure, say N.
214 config IP6_NF_TARGET_MASQUERADE
215 tristate "MASQUERADE target support"
217 Masquerading is a special case of NAT: all outgoing connections are
218 changed to seem to come from a particular interface's address, and
219 if the interface goes down, those connections are lost. This is
220 only useful for dialup accounts with dynamic IP address (ie. your IP
221 address will be different on next dialup).
223 To compile it as a module, choose M here. If unsure, say N.
225 config IP6_NF_TARGET_NPT
226 tristate "NPT (Network Prefix translation) target support"
228 This option adds the `SNPT' and `DNPT' target, which perform
229 stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
231 To compile it as a module, choose M here. If unsure, say N.
235 endif # IP6_NF_IPTABLES