#
# IP netfilter configuration
#
menu "IPv6: Netfilter Configuration"
depends on [31mCONFIG_INET[0m && [31mCONFIG_IPV6[0m && [31mCONFIG_NETFILTER[0m
config [31mCONFIG_NF_DEFRAG_IPV6[0m
tristate
default n
config [31mCONFIG_NF_CONNTRACK_IPV6[0m
tristate "IPv6 connection tracking support"
depends on [31mCONFIG_INET[0m && [31mCONFIG_IPV6[0m && [31mCONFIG_NF_CONNTRACK[0m
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
select [31mCONFIG_NF_DEFRAG_IPV6[0m
---help---
Connection tracking keeps a record of what packets have passed
through your machine, in order to figure out how they are related
into connections.
This is IPv6 support on Layer 3 independent connection tracking.
Layer 3 independent connection tracking is experimental scheme
which generalize ip_conntrack to support other layer 3 protocols.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_NF_SOCKET_IPV6[0m
tristate "IPv6 socket lookup support"
help
This option enables the IPv6 socket lookup infrastructure. This
is used by the ip6tables socket match.
if [31mCONFIG_NF_TABLES[0m
config [31mCONFIG_NF_TABLES_IPV6[0m
tristate "IPv6 nf_tables support"
help
This option enables the IPv6 support for nf_tables.
if [31mCONFIG_NF_TABLES_IPV6[0m
config [31mCONFIG_NFT_CHAIN_ROUTE_IPV6[0m
tristate "IPv6 nf_tables route chain support"
help
This option enables the "route" chain for IPv6 in nf_tables. This
chain type is used to force packet re-routing after mangling header
fields such as the source, destination, flowlabel, hop-limit and
the packet mark.
config [31mCONFIG_NFT_REJECT_IPV6[0m
select [31mCONFIG_NF_REJECT_IPV6[0m
default [31mCONFIG_NFT_REJECT[0m
tristate
config [31mCONFIG_NFT_DUP_IPV6[0m
tristate "IPv6 nf_tables packet duplication support"
depends on ![31mCONFIG_NF_CONNTRACK[0m || [31mCONFIG_NF_CONNTRACK[0m
select [31mCONFIG_NF_DUP_IPV6[0m
help
This module enables IPv6 packet duplication support for nf_tables.
config [31mCONFIG_NFT_FIB_IPV6[0m
tristate "nf_tables fib / ipv6 route lookup support"
select [31mCONFIG_NFT_FIB[0m
help
This module enables IPv6 FIB lookups, e.g. for reverse path filtering.
It also allows query of the FIB for the route type, e.g. local, unicast,
multicast or blackhole.
endif # [31mCONFIG_NF_TABLES_IPV6[0m
endif # [31mCONFIG_NF_TABLES[0m
config [31mCONFIG_NF_DUP_IPV6[0m
tristate "Netfilter IPv6 packet duplication to alternate destination"
depends on ![31mCONFIG_NF_CONNTRACK[0m || [31mCONFIG_NF_CONNTRACK[0m
help
This option enables the nf_dup_ipv6 core, which duplicates an IPv6
packet to be rerouted to another destination.
config [31mCONFIG_NF_REJECT_IPV6[0m
tristate "IPv6 packet rejection"
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
config [31mCONFIG_NF_LOG_IPV6[0m
tristate "IPv6 packet logging"
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
select [31mCONFIG_NF_LOG_COMMON[0m
config [31mCONFIG_NF_NAT_IPV6[0m
tristate "IPv6 NAT"
depends on [31mCONFIG_NF_CONNTRACK_IPV6[0m
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
select [31mCONFIG_NF_NAT[0m
help
The IPv6 NAT option allows masquerading, port forwarding and other
forms of full Network Address Port Translation. This can be
controlled by iptables or nft.
if [31mCONFIG_NF_NAT_IPV6[0m
config [31mCONFIG_NFT_CHAIN_NAT_IPV6[0m
depends on [31mCONFIG_NF_TABLES_IPV6[0m
tristate "IPv6 nf_tables nat chain support"
help
This option enables the "nat" chain for IPv6 in nf_tables. This
chain type is used to perform Network Address Translation (NAT)
packet transformations such as the source, destination address and
source and destination ports.
config [31mCONFIG_NF_NAT_MASQUERADE_IPV6[0m
tristate "IPv6 masquerade support"
help
This is the kernel functionality to provide NAT in the masquerade
flavour (automatic source address selection) for IPv6.
config [31mCONFIG_NFT_MASQ_IPV6[0m
tristate "IPv6 masquerade support for nf_tables"
depends on [31mCONFIG_NF_TABLES_IPV6[0m
depends on [31mCONFIG_NFT_MASQ[0m
select [31mCONFIG_NF_NAT_MASQUERADE_IPV6[0m
help
This is the expression that provides IPv4 masquerading support for
nf_tables.
config [31mCONFIG_NFT_REDIR_IPV6[0m
tristate "IPv6 redirect support for nf_tables"
depends on [31mCONFIG_NF_TABLES_IPV6[0m
depends on [31mCONFIG_NFT_REDIR[0m
select [31mCONFIG_NF_NAT_REDIRECT[0m
help
This is the expression that provides IPv4 redirect support for
nf_tables.
endif # [31mCONFIG_NF_NAT_IPV6[0m
config [31mCONFIG_IP6_NF_IPTABLES[0m
tristate "IP6 tables support (required for filtering)"
depends on [31mCONFIG_INET[0m && [31mCONFIG_IPV6[0m
select [31mCONFIG_NETFILTER_XTABLES[0m
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
help
ip6tables is a general, extensible packet identification framework.
Currently only the packet filtering and packet mangling subsystem
for IPv6 use this, but connection tracking is going to follow.
Say 'Y' or '[31mCONFIG_M[0m' here if you want to use either of those.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
if [31mCONFIG_IP6_NF_IPTABLES[0m
# The simple matches.
config [31mCONFIG_IP6_NF_MATCH_AH[0m
tristate '"ah" match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
This module allows one to match AH packets.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_EUI64[0m
tristate '"eui64" address check'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
This module performs checking on the IPv6 source address
Compares the last 64 bits with the EUI64 (delivered
from the [31mCONFIG_MAC[0m address) address
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_FRAG[0m
tristate '"frag" Fragmentation header match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
frag matching allows you to match packets based on the fragmentation
header of the packet.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_OPTS[0m
tristate '"hbh" hop-by-hop and "dst" opts header match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
This allows one to match packets based on the hop-by-hop
and destination options headers of a packet.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_HL[0m
tristate '"hl" hoplimit match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
select [31mCONFIG_NETFILTER_XT_MATCH_HL[0m
---help---
This is a backwards-compat option for the user's convenience
(e.g. when running oldconfig). It selects
CONFIG_NETFILTER_XT_MATCH_HL.
config [31mCONFIG_IP6_NF_MATCH_IPV6HEADER[0m
tristate '"ipv6header" IPv6 Extension Headers Match'
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
help
This module allows one to match packets based upon
the ipv6 extension headers.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_MH[0m
tristate '"mh" match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
This module allows one to match MH packets.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_RPFILTER[0m
tristate '"rpfilter" reverse path filter match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
depends on [31mCONFIG_IP6_NF_MANGLE[0m || [31mCONFIG_IP6_NF_RAW[0m
---help---
This option allows you to match packets whose replies would
go out via the interface the packet came in.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
The module will be called ip6t_rpfilter.
config [31mCONFIG_IP6_NF_MATCH_RT[0m
tristate '"rt" Routing header match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
rt matching allows you to match packets based on the routing
header of the packet.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
# The targets
config [31mCONFIG_IP6_NF_TARGET_HL[0m
tristate '"HL" hoplimit target support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m && [31mCONFIG_IP6_NF_MANGLE[0m
select [31mCONFIG_NETFILTER_XT_TARGET_HL[0m
---help---
This is a backwards-compatible option for the user's convenience
(e.g. when running oldconfig). It selects
CONFIG_NETFILTER_XT_TARGET_HL.
config [31mCONFIG_IP6_NF_FILTER[0m
tristate "Packet filtering"
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
help
Packet filtering defines a table `filter', which has a series of
rules for simple packet filtering at local input, forwarding and
local output. See the man page for iptables(8).
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_TARGET_REJECT[0m
tristate "REJECT target support"
depends on [31mCONFIG_IP6_NF_FILTER[0m
select [31mCONFIG_NF_REJECT_IPV6[0m
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
help
The REJECT target allows a filtering rule to specify that an ICMPv6
error should be issued in response to an incoming packet, rather
than silently being dropped.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_TARGET_SYNPROXY[0m
tristate "SYNPROXY target support"
depends on [31mCONFIG_NF_CONNTRACK[0m && [31mCONFIG_NETFILTER_ADVANCED[0m
select [31mCONFIG_NETFILTER_SYNPROXY[0m
select [31mCONFIG_SYN_COOKIES[0m
help
The SYNPROXY target allows you to intercept TCP connections and
establish them using syncookies before they are passed on to the
server. This allows to avoid conntrack and server resource usage
during SYN-flood attacks.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MANGLE[0m
tristate "Packet mangling"
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
help
This option adds a `mangle' table to iptables: see the man page for
iptables(8). This table is used for various packet alterations
which can effect how the packet is routed.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_RAW[0m
tristate 'raw table support (required for TRACE)'
help
This option adds a `raw' table to ip6tables. This table is the very
first in the netfilter framework and hooks in at the PREROUTING
and OUTPUT chains.
If you want to compile it as a module, say [31mCONFIG_M[0m here and read
<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
# security table for [31mCONFIG_MAC[0m policy
config [31mCONFIG_IP6_NF_SECURITY[0m
tristate "Security table"
depends on [31mCONFIG_SECURITY[0m
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
This option adds a `security' table to iptables, for use
with Mandatory Access Control ([31mCONFIG_MAC[0m) policy.
If unsure, say N.
config [31mCONFIG_IP6_NF_NAT[0m
tristate "ip6tables NAT support"
depends on [31mCONFIG_NF_CONNTRACK_IPV6[0m
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
select [31mCONFIG_NF_NAT[0m
select [31mCONFIG_NF_NAT_IPV6[0m
select [31mCONFIG_NETFILTER_XT_NAT[0m
help
This enables the `nat' table in ip6tables. This allows masquerading,
port forwarding and other forms of full Network Address Port
Translation.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
if [31mCONFIG_IP6_NF_NAT[0m
config [31mCONFIG_IP6_NF_TARGET_MASQUERADE[0m
tristate "MASQUERADE target support"
select [31mCONFIG_NF_NAT_MASQUERADE_IPV6[0m
help
Masquerading is a special case of NAT: all outgoing connections are
changed to seem to come from a particular interface's address, and
if the interface goes down, those connections are lost. This is
only useful for dialup accounts with dynamic IP address (ie. your IP
address will be different on next dialup).
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_TARGET_NPT[0m
tristate "NPT (Network Prefix translation) target support"
help
This option adds the `SNPT' and `DNPT' target, which perform
stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
endif # [31mCONFIG_IP6_NF_NAT[0m
endif # [31mCONFIG_IP6_NF_IPTABLES[0m
endmenu