# SPDX-License-Identifier: GPL-2.0-only
#
# IP netfilter configuration
#
menu "IPv6: Netfilter Configuration"
depends on [31mCONFIG_INET[0m && [31mCONFIG_IPV6[0m && [31mCONFIG_NETFILTER[0m
config [31mCONFIG_NF_SOCKET_IPV6[0m
tristate "IPv6 socket lookup support"
help
This option enables the IPv6 socket lookup infrastructure. This
is used by the {ip6,nf}tables socket match.
config [31mCONFIG_NF_TPROXY_IPV6[0m
tristate "IPv6 tproxy support"
if [31mCONFIG_NF_TABLES[0m
config [31mCONFIG_NF_TABLES_IPV6[0m
bool "IPv6 nf_tables support"
help
This option enables the IPv6 support for nf_tables.
if [31mCONFIG_NF_TABLES_IPV6[0m
config [31mCONFIG_NFT_REJECT_IPV6[0m
select [31mCONFIG_NF_REJECT_IPV6[0m
default [31mCONFIG_NFT_REJECT[0m
tristate
config [31mCONFIG_NFT_DUP_IPV6[0m
tristate "IPv6 nf_tables packet duplication support"
depends on ![31mCONFIG_NF_CONNTRACK[0m || [31mCONFIG_NF_CONNTRACK[0m
select [31mCONFIG_NF_DUP_IPV6[0m
help
This module enables IPv6 packet duplication support for nf_tables.
config [31mCONFIG_NFT_FIB_IPV6[0m
tristate "nf_tables fib / ipv6 route lookup support"
select [31mCONFIG_NFT_FIB[0m
help
This module enables IPv6 FIB lookups, e.g. for reverse path filtering.
It also allows query of the FIB for the route type, e.g. local, unicast,
multicast or blackhole.
endif # [31mCONFIG_NF_TABLES_IPV6[0m
endif # [31mCONFIG_NF_TABLES[0m
config [31mCONFIG_NF_FLOW_TABLE_IPV6[0m
tristate "Netfilter flow table IPv6 module"
depends on [31mCONFIG_NF_FLOW_TABLE[0m
help
This option adds the flow table IPv6 support.
To compile it as a module, choose [31mCONFIG_M[0m here.
config [31mCONFIG_NF_DUP_IPV6[0m
tristate "Netfilter IPv6 packet duplication to alternate destination"
depends on ![31mCONFIG_NF_CONNTRACK[0m || [31mCONFIG_NF_CONNTRACK[0m
help
This option enables the nf_dup_ipv6 core, which duplicates an IPv6
packet to be rerouted to another destination.
config [31mCONFIG_NF_REJECT_IPV6[0m
tristate "IPv6 packet rejection"
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
config [31mCONFIG_NF_LOG_IPV6[0m
tristate "IPv6 packet logging"
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
select [31mCONFIG_NF_LOG_COMMON[0m
config [31mCONFIG_IP6_NF_IPTABLES[0m
tristate "IP6 tables support (required for filtering)"
depends on [31mCONFIG_INET[0m && [31mCONFIG_IPV6[0m
select [31mCONFIG_NETFILTER_XTABLES[0m
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
help
ip6tables is a general, extensible packet identification framework.
Currently only the packet filtering and packet mangling subsystem
for IPv6 use this, but connection tracking is going to follow.
Say 'Y' or '[31mCONFIG_M[0m' here if you want to use either of those.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
if [31mCONFIG_IP6_NF_IPTABLES[0m
# The simple matches.
config [31mCONFIG_IP6_NF_MATCH_AH[0m
tristate '"ah" match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
This module allows one to match AH packets.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_EUI64[0m
tristate '"eui64" address check'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
This module performs checking on the IPv6 source address
Compares the last 64 bits with the EUI64 (delivered
from the [31mCONFIG_MAC[0m address) address
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_FRAG[0m
tristate '"frag" Fragmentation header match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
frag matching allows you to match packets based on the fragmentation
header of the packet.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_OPTS[0m
tristate '"hbh" hop-by-hop and "dst" opts header match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
This allows one to match packets based on the hop-by-hop
and destination options headers of a packet.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_HL[0m
tristate '"hl" hoplimit match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
select [31mCONFIG_NETFILTER_XT_MATCH_HL[0m
---help---
This is a backwards-compat option for the user's convenience
(e.g. when running oldconfig). It selects
CONFIG_NETFILTER_XT_MATCH_HL.
config [31mCONFIG_IP6_NF_MATCH_IPV6HEADER[0m
tristate '"ipv6header" IPv6 Extension Headers Match'
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
help
This module allows one to match packets based upon
the ipv6 extension headers.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_MH[0m
tristate '"mh" match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
This module allows one to match MH packets.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_RPFILTER[0m
tristate '"rpfilter" reverse path filter match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
depends on [31mCONFIG_IP6_NF_MANGLE[0m || [31mCONFIG_IP6_NF_RAW[0m
---help---
This option allows you to match packets whose replies would
go out via the interface the packet came in.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
The module will be called ip6t_rpfilter.
config [31mCONFIG_IP6_NF_MATCH_RT[0m
tristate '"rt" Routing header match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
rt matching allows you to match packets based on the routing
header of the packet.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MATCH_SRH[0m
tristate '"srh" Segment Routing header match support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
srh matching allows you to match packets based on the segment
routing header of the packet.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
# The targets
config [31mCONFIG_IP6_NF_TARGET_HL[0m
tristate '"HL" hoplimit target support'
depends on [31mCONFIG_NETFILTER_ADVANCED[0m && [31mCONFIG_IP6_NF_MANGLE[0m
select [31mCONFIG_NETFILTER_XT_TARGET_HL[0m
---help---
This is a backwards-compatible option for the user's convenience
(e.g. when running oldconfig). It selects
CONFIG_NETFILTER_XT_TARGET_HL.
config [31mCONFIG_IP6_NF_FILTER[0m
tristate "Packet filtering"
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
help
Packet filtering defines a table `filter', which has a series of
rules for simple packet filtering at local input, forwarding and
local output. See the man page for iptables(8).
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_TARGET_REJECT[0m
tristate "REJECT target support"
depends on [31mCONFIG_IP6_NF_FILTER[0m
select [31mCONFIG_NF_REJECT_IPV6[0m
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
help
The REJECT target allows a filtering rule to specify that an ICMPv6
error should be issued in response to an incoming packet, rather
than silently being dropped.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_TARGET_SYNPROXY[0m
tristate "SYNPROXY target support"
depends on [31mCONFIG_NF_CONNTRACK[0m && [31mCONFIG_NETFILTER_ADVANCED[0m
select [31mCONFIG_NETFILTER_SYNPROXY[0m
select [31mCONFIG_SYN_COOKIES[0m
help
The SYNPROXY target allows you to intercept TCP connections and
establish them using syncookies before they are passed on to the
server. This allows to avoid conntrack and server resource usage
during SYN-flood attacks.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_MANGLE[0m
tristate "Packet mangling"
default m if [31mCONFIG_NETFILTER_ADVANCED[0m=n
help
This option adds a `mangle' table to iptables: see the man page for
iptables(8). This table is used for various packet alterations
which can effect how the packet is routed.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_IP6_NF_RAW[0m
tristate 'raw table support (required for TRACE)'
help
This option adds a `raw' table to ip6tables. This table is the very
first in the netfilter framework and hooks in at the PREROUTING
and OUTPUT chains.
If you want to compile it as a module, say [31mCONFIG_M[0m here and read
<file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
# security table for [31mCONFIG_MAC[0m policy
config [31mCONFIG_IP6_NF_SECURITY[0m
tristate "Security table"
depends on [31mCONFIG_SECURITY[0m
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
help
This option adds a `security' table to iptables, for use
with Mandatory Access Control ([31mCONFIG_MAC[0m) policy.
If unsure, say N.
config [31mCONFIG_IP6_NF_NAT[0m
tristate "ip6tables NAT support"
depends on [31mCONFIG_NF_CONNTRACK[0m
depends on [31mCONFIG_NETFILTER_ADVANCED[0m
select [31mCONFIG_NF_NAT[0m
select [31mCONFIG_NETFILTER_XT_NAT[0m
help
This enables the `nat' table in ip6tables. This allows masquerading,
port forwarding and other forms of full Network Address Port
Translation.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
if [31mCONFIG_IP6_NF_NAT[0m
config [31mCONFIG_IP6_NF_TARGET_MASQUERADE[0m
tristate "MASQUERADE target support"
select [31mCONFIG_NETFILTER_XT_TARGET_MASQUERADE[0m
help
This is a backwards-compat option for the user's convenience
(e.g. when running oldconfig). It selects [31mCONFIG_NETFILTER_XT_TARGET_MASQUERADE[0m.
config [31mCONFIG_IP6_NF_TARGET_NPT[0m
tristate "NPT (Network Prefix translation) target support"
help
This option adds the `SNPT' and `DNPT' target, which perform
stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
endif # [31mCONFIG_IP6_NF_NAT[0m
endif # [31mCONFIG_IP6_NF_IPTABLES[0m
endmenu
config [31mCONFIG_NF_DEFRAG_IPV6[0m
tristate