1# SPDX-License-Identifier: GPL-2.0-only 2# 3# IP netfilter configuration 4# 5 6menu "IP: Netfilter Configuration" 7 depends on INET && NETFILTER 8 9config NF_DEFRAG_IPV4 10 tristate 11 default n 12 13# old sockopt interface and eval loop 14config IP_NF_IPTABLES_LEGACY 15 tristate "Legacy IP tables support" 16 default n 17 select NETFILTER_XTABLES 18 help 19 iptables is a legacy packet classifier. 20 This is not needed if you are using iptables over nftables 21 (iptables-nft). 22 23config NF_SOCKET_IPV4 24 tristate "IPv4 socket lookup support" 25 help 26 This option enables the IPv4 socket lookup infrastructure. This is 27 is required by the {ip,nf}tables socket match. 28 29config NF_TPROXY_IPV4 30 tristate "IPv4 tproxy support" 31 32if NF_TABLES 33 34config NF_TABLES_IPV4 35 bool "IPv4 nf_tables support" 36 help 37 This option enables the IPv4 support for nf_tables. 38 39if NF_TABLES_IPV4 40 41config NFT_REJECT_IPV4 42 select NF_REJECT_IPV4 43 default NFT_REJECT 44 tristate 45 46config NFT_DUP_IPV4 47 tristate "IPv4 nf_tables packet duplication support" 48 depends on !NF_CONNTRACK || NF_CONNTRACK 49 select NF_DUP_IPV4 50 help 51 This module enables IPv4 packet duplication support for nf_tables. 52 53config NFT_FIB_IPV4 54 select NFT_FIB 55 tristate "nf_tables fib / ip route lookup support" 56 help 57 This module enables IPv4 FIB lookups, e.g. for reverse path filtering. 58 It also allows query of the FIB for the route type, e.g. local, unicast, 59 multicast or blackhole. 60 61endif # NF_TABLES_IPV4 62 63config NF_TABLES_ARP 64 bool "ARP nf_tables support" 65 select NETFILTER_FAMILY_ARP 66 help 67 This option enables the ARP support for nf_tables. 68 69endif # NF_TABLES 70 71config NF_DUP_IPV4 72 tristate "Netfilter IPv4 packet duplication to alternate destination" 73 depends on !NF_CONNTRACK || NF_CONNTRACK 74 help 75 This option enables the nf_dup_ipv4 core, which duplicates an IPv4 76 packet to be rerouted to another destination. 77 78config NF_LOG_ARP 79 tristate "ARP packet logging" 80 default m if NETFILTER_ADVANCED=n 81 select NF_LOG_SYSLOG 82 help 83 This is a backwards-compat option for the user's convenience 84 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG. 85 86config NF_LOG_IPV4 87 tristate "IPv4 packet logging" 88 default m if NETFILTER_ADVANCED=n 89 select NF_LOG_SYSLOG 90 help 91 This is a backwards-compat option for the user's convenience 92 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG. 93 94config NF_REJECT_IPV4 95 tristate "IPv4 packet rejection" 96 default m if NETFILTER_ADVANCED=n 97 98if NF_NAT 99config NF_NAT_SNMP_BASIC 100 tristate "Basic SNMP-ALG support" 101 depends on NF_CONNTRACK_SNMP 102 depends on NETFILTER_ADVANCED 103 default NF_NAT && NF_CONNTRACK_SNMP 104 select ASN1 105 help 106 107 This module implements an Application Layer Gateway (ALG) for 108 SNMP payloads. In conjunction with NAT, it allows a network 109 management system to access multiple private networks with 110 conflicting addresses. It works by modifying IP addresses 111 inside SNMP payloads to match IP-layer NAT mapping. 112 113 This is the "basic" form of SNMP-ALG, as described in RFC 2962 114 115 To compile it as a module, choose M here. If unsure, say N. 116 117config NF_NAT_PPTP 118 tristate 119 depends on NF_CONNTRACK 120 default NF_CONNTRACK_PPTP 121 122config NF_NAT_H323 123 tristate 124 depends on NF_CONNTRACK 125 default NF_CONNTRACK_H323 126 127endif # NF_NAT 128 129config IP_NF_IPTABLES 130 tristate "IP tables support (required for filtering/masq/NAT)" 131 default m if NETFILTER_ADVANCED=n 132 select NETFILTER_XTABLES 133 help 134 iptables is a general, extensible packet identification framework. 135 The packet filtering and full NAT (masquerading, port forwarding, 136 etc) subsystems now use this: say `Y' or `M' here if you want to use 137 either of those. 138 139 To compile it as a module, choose M here. If unsure, say N. 140 141if IP_NF_IPTABLES 142 143# The matches. 144config IP_NF_MATCH_AH 145 tristate '"ah" match support' 146 depends on NETFILTER_ADVANCED 147 help 148 This match extension allows you to match a range of SPIs 149 inside AH header of IPSec packets. 150 151 To compile it as a module, choose M here. If unsure, say N. 152 153config IP_NF_MATCH_ECN 154 tristate '"ecn" match support' 155 depends on NETFILTER_ADVANCED 156 select NETFILTER_XT_MATCH_ECN 157 help 158 This is a backwards-compat option for the user's convenience 159 (e.g. when running oldconfig). It selects 160 CONFIG_NETFILTER_XT_MATCH_ECN. 161 162config IP_NF_MATCH_RPFILTER 163 tristate '"rpfilter" reverse path filter match support' 164 depends on NETFILTER_ADVANCED 165 depends on IP_NF_MANGLE || IP_NF_RAW || NFT_COMPAT 166 help 167 This option allows you to match packets whose replies would 168 go out via the interface the packet came in. 169 170 To compile it as a module, choose M here. If unsure, say N. 171 The module will be called ipt_rpfilter. 172 173config IP_NF_MATCH_TTL 174 tristate '"ttl" match support' 175 depends on NETFILTER_ADVANCED 176 select NETFILTER_XT_MATCH_HL 177 help 178 This is a backwards-compat option for the user's convenience 179 (e.g. when running oldconfig). It selects 180 CONFIG_NETFILTER_XT_MATCH_HL. 181 182# `filter', generic and specific targets 183config IP_NF_FILTER 184 tristate "Packet filtering" 185 default m if NETFILTER_ADVANCED=n 186 select IP_NF_IPTABLES_LEGACY 187 help 188 Packet filtering defines a table `filter', which has a series of 189 rules for simple packet filtering at local input, forwarding and 190 local output. See the man page for iptables(8). 191 192 To compile it as a module, choose M here. If unsure, say N. 193 194config IP_NF_TARGET_REJECT 195 tristate "REJECT target support" 196 depends on IP_NF_FILTER || NFT_COMPAT 197 select NF_REJECT_IPV4 198 default m if NETFILTER_ADVANCED=n 199 help 200 The REJECT target allows a filtering rule to specify that an ICMP 201 error should be issued in response to an incoming packet, rather 202 than silently being dropped. 203 204 To compile it as a module, choose M here. If unsure, say N. 205 206config IP_NF_TARGET_SYNPROXY 207 tristate "SYNPROXY target support" 208 depends on NF_CONNTRACK && NETFILTER_ADVANCED 209 select NETFILTER_SYNPROXY 210 select SYN_COOKIES 211 help 212 The SYNPROXY target allows you to intercept TCP connections and 213 establish them using syncookies before they are passed on to the 214 server. This allows to avoid conntrack and server resource usage 215 during SYN-flood attacks. 216 217 To compile it as a module, choose M here. If unsure, say N. 218 219# NAT + specific targets: nf_conntrack 220config IP_NF_NAT 221 tristate "iptables NAT support" 222 depends on NF_CONNTRACK 223 default m if NETFILTER_ADVANCED=n 224 select NF_NAT 225 select NETFILTER_XT_NAT 226 select IP_NF_IPTABLES_LEGACY 227 help 228 This enables the `nat' table in iptables. This allows masquerading, 229 port forwarding and other forms of full Network Address Port 230 Translation. 231 232 To compile it as a module, choose M here. If unsure, say N. 233 234if IP_NF_NAT 235 236config IP_NF_TARGET_MASQUERADE 237 tristate "MASQUERADE target support" 238 select NETFILTER_XT_TARGET_MASQUERADE 239 help 240 This is a backwards-compat option for the user's convenience 241 (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE. 242 243config IP_NF_TARGET_NETMAP 244 tristate "NETMAP target support" 245 depends on NETFILTER_ADVANCED 246 select NETFILTER_XT_TARGET_NETMAP 247 help 248 This is a backwards-compat option for the user's convenience 249 (e.g. when running oldconfig). It selects 250 CONFIG_NETFILTER_XT_TARGET_NETMAP. 251 252config IP_NF_TARGET_REDIRECT 253 tristate "REDIRECT target support" 254 depends on NETFILTER_ADVANCED 255 select NETFILTER_XT_TARGET_REDIRECT 256 help 257 This is a backwards-compat option for the user's convenience 258 (e.g. when running oldconfig). It selects 259 CONFIG_NETFILTER_XT_TARGET_REDIRECT. 260 261endif # IP_NF_NAT 262 263# mangle + specific targets 264config IP_NF_MANGLE 265 tristate "Packet mangling" 266 default m if NETFILTER_ADVANCED=n 267 select IP_NF_IPTABLES_LEGACY 268 help 269 This option adds a `mangle' table to iptables: see the man page for 270 iptables(8). This table is used for various packet alterations 271 which can effect how the packet is routed. 272 273 To compile it as a module, choose M here. If unsure, say N. 274 275config IP_NF_TARGET_ECN 276 tristate "ECN target support" 277 depends on IP_NF_MANGLE || NFT_COMPAT 278 depends on NETFILTER_ADVANCED 279 help 280 This option adds a `ECN' target, which can be used in the iptables mangle 281 table. 282 283 You can use this target to remove the ECN bits from the IPv4 header of 284 an IP packet. This is particularly useful, if you need to work around 285 existing ECN blackholes on the internet, but don't want to disable 286 ECN support in general. 287 288 To compile it as a module, choose M here. If unsure, say N. 289 290config IP_NF_TARGET_TTL 291 tristate '"TTL" target support' 292 depends on NETFILTER_ADVANCED && IP_NF_MANGLE 293 select NETFILTER_XT_TARGET_HL 294 help 295 This is a backwards-compatible option for the user's convenience 296 (e.g. when running oldconfig). It selects 297 CONFIG_NETFILTER_XT_TARGET_HL. 298 299# raw + specific targets 300config IP_NF_RAW 301 tristate 'raw table support (required for NOTRACK/TRACE)' 302 select IP_NF_IPTABLES_LEGACY 303 help 304 This option adds a `raw' table to iptables. This table is the very 305 first in the netfilter framework and hooks in at the PREROUTING 306 and OUTPUT chains. 307 308 If you want to compile it as a module, say M here and read 309 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 310 311# security table for MAC policy 312config IP_NF_SECURITY 313 tristate "Security table" 314 depends on SECURITY 315 depends on NETFILTER_ADVANCED 316 select IP_NF_IPTABLES_LEGACY 317 help 318 This option adds a `security' table to iptables, for use 319 with Mandatory Access Control (MAC) policy. 320 321 If unsure, say N. 322 323endif # IP_NF_IPTABLES 324 325# ARP tables 326config IP_NF_ARPTABLES 327 tristate "Legacy ARPTABLES support" 328 depends on NETFILTER_XTABLES 329 default n 330 help 331 arptables is a legacy packet classifier. 332 This is not needed if you are using arptables over nftables 333 (iptables-nft). 334 335config NFT_COMPAT_ARP 336 tristate 337 depends on NF_TABLES_ARP && NFT_COMPAT 338 default m if NFT_COMPAT=m 339 default y if NFT_COMPAT=y 340 341config IP_NF_ARPFILTER 342 tristate "arptables-legacy packet filtering support" 343 select IP_NF_ARPTABLES 344 select NETFILTER_FAMILY_ARP 345 depends on NETFILTER_XTABLES 346 help 347 ARP packet filtering defines a table `filter', which has a series of 348 rules for simple ARP packet filtering at local input and 349 local output. This is only needed for arptables-legacy(8). 350 Neither arptables-nft nor nftables need this to work. 351 352 To compile it as a module, choose M here. If unsure, say N. 353 354config IP_NF_ARP_MANGLE 355 tristate "ARP payload mangling" 356 depends on IP_NF_ARPTABLES || NFT_COMPAT_ARP 357 help 358 Allows altering the ARP packet payload: source and destination 359 hardware and network addresses. 360 361 This option is needed by both arptables-legacy and arptables-nft. 362 It is not used by nftables. 363 364endmenu 365 366