1 # SPDX-License-Identifier: GPL-2.0-only
3 # IP netfilter configuration
6 menu "IP: Netfilter Configuration"
7 depends on INET && NETFILTER
14 tristate "IPv4 socket lookup support"
16 This option enables the IPv4 socket lookup infrastructure. This is
17 is required by the {ip,nf}tables socket match.
20 tristate "IPv4 tproxy support"
25 bool "IPv4 nf_tables support"
27 This option enables the IPv4 support for nf_tables.
31 config NFT_REJECT_IPV4
37 tristate "IPv4 nf_tables packet duplication support"
38 depends on !NF_CONNTRACK || NF_CONNTRACK
41 This module enables IPv4 packet duplication support for nf_tables.
45 tristate "nf_tables fib / ip route lookup support"
47 This module enables IPv4 FIB lookups, e.g. for reverse path filtering.
48 It also allows query of the FIB for the route type, e.g. local, unicast,
49 multicast or blackhole.
51 endif # NF_TABLES_IPV4
54 bool "ARP nf_tables support"
55 select NETFILTER_FAMILY_ARP
57 This option enables the ARP support for nf_tables.
62 tristate "Netfilter IPv4 packet duplication to alternate destination"
63 depends on !NF_CONNTRACK || NF_CONNTRACK
65 This option enables the nf_dup_ipv4 core, which duplicates an IPv4
66 packet to be rerouted to another destination.
69 tristate "ARP packet logging"
70 default m if NETFILTER_ADVANCED=n
73 This is a backwards-compat option for the user's convenience
74 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG.
77 tristate "IPv4 packet logging"
78 default m if NETFILTER_ADVANCED=n
81 This is a backwards-compat option for the user's convenience
82 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG.
85 tristate "IPv4 packet rejection"
86 default m if NETFILTER_ADVANCED=n
89 config NF_NAT_SNMP_BASIC
90 tristate "Basic SNMP-ALG support"
91 depends on NF_CONNTRACK_SNMP
92 depends on NETFILTER_ADVANCED
93 default NF_NAT && NF_CONNTRACK_SNMP
97 This module implements an Application Layer Gateway (ALG) for
98 SNMP payloads. In conjunction with NAT, it allows a network
99 management system to access multiple private networks with
100 conflicting addresses. It works by modifying IP addresses
101 inside SNMP payloads to match IP-layer NAT mapping.
103 This is the "basic" form of SNMP-ALG, as described in RFC 2962
105 To compile it as a module, choose M here. If unsure, say N.
109 depends on NF_CONNTRACK
110 default NF_CONNTRACK_PPTP
114 depends on NF_CONNTRACK
115 default NF_CONNTRACK_H323
119 config IP_NF_IPTABLES
120 tristate "IP tables support (required for filtering/masq/NAT)"
121 default m if NETFILTER_ADVANCED=n
122 select NETFILTER_XTABLES
124 iptables is a general, extensible packet identification framework.
125 The packet filtering and full NAT (masquerading, port forwarding,
126 etc) subsystems now use this: say `Y' or `M' here if you want to use
129 To compile it as a module, choose M here. If unsure, say N.
134 config IP_NF_MATCH_AH
135 tristate '"ah" match support'
136 depends on NETFILTER_ADVANCED
138 This match extension allows you to match a range of SPIs
139 inside AH header of IPSec packets.
141 To compile it as a module, choose M here. If unsure, say N.
143 config IP_NF_MATCH_ECN
144 tristate '"ecn" match support'
145 depends on NETFILTER_ADVANCED
146 select NETFILTER_XT_MATCH_ECN
148 This is a backwards-compat option for the user's convenience
149 (e.g. when running oldconfig). It selects
150 CONFIG_NETFILTER_XT_MATCH_ECN.
152 config IP_NF_MATCH_RPFILTER
153 tristate '"rpfilter" reverse path filter match support'
154 depends on NETFILTER_ADVANCED
155 depends on IP_NF_MANGLE || IP_NF_RAW
157 This option allows you to match packets whose replies would
158 go out via the interface the packet came in.
160 To compile it as a module, choose M here. If unsure, say N.
161 The module will be called ipt_rpfilter.
163 config IP_NF_MATCH_TTL
164 tristate '"ttl" match support'
165 depends on NETFILTER_ADVANCED
166 select NETFILTER_XT_MATCH_HL
168 This is a backwards-compat option for the user's convenience
169 (e.g. when running oldconfig). It selects
170 CONFIG_NETFILTER_XT_MATCH_HL.
172 # `filter', generic and specific targets
174 tristate "Packet filtering"
175 default m if NETFILTER_ADVANCED=n
177 Packet filtering defines a table `filter', which has a series of
178 rules for simple packet filtering at local input, forwarding and
179 local output. See the man page for iptables(8).
181 To compile it as a module, choose M here. If unsure, say N.
183 config IP_NF_TARGET_REJECT
184 tristate "REJECT target support"
185 depends on IP_NF_FILTER
186 select NF_REJECT_IPV4
187 default m if NETFILTER_ADVANCED=n
189 The REJECT target allows a filtering rule to specify that an ICMP
190 error should be issued in response to an incoming packet, rather
191 than silently being dropped.
193 To compile it as a module, choose M here. If unsure, say N.
195 config IP_NF_TARGET_SYNPROXY
196 tristate "SYNPROXY target support"
197 depends on NF_CONNTRACK && NETFILTER_ADVANCED
198 select NETFILTER_SYNPROXY
201 The SYNPROXY target allows you to intercept TCP connections and
202 establish them using syncookies before they are passed on to the
203 server. This allows to avoid conntrack and server resource usage
204 during SYN-flood attacks.
206 To compile it as a module, choose M here. If unsure, say N.
208 # NAT + specific targets: nf_conntrack
210 tristate "iptables NAT support"
211 depends on NF_CONNTRACK
212 default m if NETFILTER_ADVANCED=n
214 select NETFILTER_XT_NAT
216 This enables the `nat' table in iptables. This allows masquerading,
217 port forwarding and other forms of full Network Address Port
220 To compile it as a module, choose M here. If unsure, say N.
224 config IP_NF_TARGET_MASQUERADE
225 tristate "MASQUERADE target support"
226 select NETFILTER_XT_TARGET_MASQUERADE
228 This is a backwards-compat option for the user's convenience
229 (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE.
231 config IP_NF_TARGET_NETMAP
232 tristate "NETMAP target support"
233 depends on NETFILTER_ADVANCED
234 select NETFILTER_XT_TARGET_NETMAP
236 This is a backwards-compat option for the user's convenience
237 (e.g. when running oldconfig). It selects
238 CONFIG_NETFILTER_XT_TARGET_NETMAP.
240 config IP_NF_TARGET_REDIRECT
241 tristate "REDIRECT target support"
242 depends on NETFILTER_ADVANCED
243 select NETFILTER_XT_TARGET_REDIRECT
245 This is a backwards-compat option for the user's convenience
246 (e.g. when running oldconfig). It selects
247 CONFIG_NETFILTER_XT_TARGET_REDIRECT.
251 # mangle + specific targets
253 tristate "Packet mangling"
254 default m if NETFILTER_ADVANCED=n
256 This option adds a `mangle' table to iptables: see the man page for
257 iptables(8). This table is used for various packet alterations
258 which can effect how the packet is routed.
260 To compile it as a module, choose M here. If unsure, say N.
262 config IP_NF_TARGET_CLUSTERIP
263 tristate "CLUSTERIP target support"
264 depends on IP_NF_MANGLE
265 depends on NF_CONNTRACK
266 depends on NETFILTER_ADVANCED
267 select NF_CONNTRACK_MARK
268 select NETFILTER_FAMILY_ARP
270 The CLUSTERIP target allows you to build load-balancing clusters of
271 network servers without having a dedicated load-balancing
272 router/server/switch.
274 To compile it as a module, choose M here. If unsure, say N.
276 config IP_NF_TARGET_ECN
277 tristate "ECN target support"
278 depends on IP_NF_MANGLE
279 depends on NETFILTER_ADVANCED
281 This option adds a `ECN' target, which can be used in the iptables mangle
284 You can use this target to remove the ECN bits from the IPv4 header of
285 an IP packet. This is particularly useful, if you need to work around
286 existing ECN blackholes on the internet, but don't want to disable
287 ECN support in general.
289 To compile it as a module, choose M here. If unsure, say N.
291 config IP_NF_TARGET_TTL
292 tristate '"TTL" target support'
293 depends on NETFILTER_ADVANCED && IP_NF_MANGLE
294 select NETFILTER_XT_TARGET_HL
296 This is a backwards-compatible option for the user's convenience
297 (e.g. when running oldconfig). It selects
298 CONFIG_NETFILTER_XT_TARGET_HL.
300 # raw + specific targets
302 tristate 'raw table support (required for NOTRACK/TRACE)'
304 This option adds a `raw' table to iptables. This table is the very
305 first in the netfilter framework and hooks in at the PREROUTING
308 If you want to compile it as a module, say M here and read
309 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
311 # security table for MAC policy
312 config IP_NF_SECURITY
313 tristate "Security table"
315 depends on NETFILTER_ADVANCED
317 This option adds a `security' table to iptables, for use
318 with Mandatory Access Control (MAC) policy.
322 endif # IP_NF_IPTABLES
325 config IP_NF_ARPTABLES
326 tristate "ARP tables support"
327 select NETFILTER_XTABLES
328 select NETFILTER_FAMILY_ARP
329 depends on NETFILTER_ADVANCED
331 arptables is a general, extensible packet identification framework.
332 The ARP packet filtering and mangling (manipulation)subsystems
333 use this: say Y or M here if you want to use either of those.
335 To compile it as a module, choose M here. If unsure, say N.
339 config IP_NF_ARPFILTER
340 tristate "ARP packet filtering"
342 ARP packet filtering defines a table `filter', which has a series of
343 rules for simple ARP packet filtering at local input and
344 local output. On a bridge, you can also specify filtering rules
345 for forwarded ARP packets. See the man page for arptables(8).
347 To compile it as a module, choose M here. If unsure, say N.
349 config IP_NF_ARP_MANGLE
350 tristate "ARP payload mangling"
352 Allows altering the ARP packet payload: source and destination
353 hardware and network addresses.
355 endif # IP_NF_ARPTABLES