Kconfig 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360
  1. # SPDX-License-Identifier: GPL-2.0-only
  2. #
  3. # IP netfilter configuration
  4. #
  5. menu "IP: Netfilter Configuration"
  6. depends on INET && NETFILTER
  7. config NF_DEFRAG_IPV4
  8. tristate
  9. default n
  10. config NF_SOCKET_IPV4
  11. tristate "IPv4 socket lookup support"
  12. help
  13. This option enables the IPv4 socket lookup infrastructure. This is
  14. is required by the {ip,nf}tables socket match.
  15. config NF_TPROXY_IPV4
  16. tristate "IPv4 tproxy support"
  17. if NF_TABLES
  18. config NF_TABLES_IPV4
  19. bool "IPv4 nf_tables support"
  20. help
  21. This option enables the IPv4 support for nf_tables.
  22. if NF_TABLES_IPV4
  23. config NFT_REJECT_IPV4
  24. select NF_REJECT_IPV4
  25. default NFT_REJECT
  26. tristate
  27. config NFT_DUP_IPV4
  28. tristate "IPv4 nf_tables packet duplication support"
  29. depends on !NF_CONNTRACK || NF_CONNTRACK
  30. select NF_DUP_IPV4
  31. help
  32. This module enables IPv4 packet duplication support for nf_tables.
  33. config NFT_FIB_IPV4
  34. select NFT_FIB
  35. tristate "nf_tables fib / ip route lookup support"
  36. help
  37. This module enables IPv4 FIB lookups, e.g. for reverse path filtering.
  38. It also allows query of the FIB for the route type, e.g. local, unicast,
  39. multicast or blackhole.
  40. endif # NF_TABLES_IPV4
  41. config NF_TABLES_ARP
  42. bool "ARP nf_tables support"
  43. select NETFILTER_FAMILY_ARP
  44. help
  45. This option enables the ARP support for nf_tables.
  46. endif # NF_TABLES
  47. config NF_FLOW_TABLE_IPV4
  48. tristate "Netfilter flow table IPv4 module"
  49. depends on NF_FLOW_TABLE
  50. help
  51. This option adds the flow table IPv4 support.
  52. To compile it as a module, choose M here.
  53. config NF_DUP_IPV4
  54. tristate "Netfilter IPv4 packet duplication to alternate destination"
  55. depends on !NF_CONNTRACK || NF_CONNTRACK
  56. help
  57. This option enables the nf_dup_ipv4 core, which duplicates an IPv4
  58. packet to be rerouted to another destination.
  59. config NF_LOG_ARP
  60. tristate "ARP packet logging"
  61. default m if NETFILTER_ADVANCED=n
  62. select NF_LOG_COMMON
  63. config NF_LOG_IPV4
  64. tristate "IPv4 packet logging"
  65. default m if NETFILTER_ADVANCED=n
  66. select NF_LOG_COMMON
  67. config NF_REJECT_IPV4
  68. tristate "IPv4 packet rejection"
  69. default m if NETFILTER_ADVANCED=n
  70. if NF_NAT
  71. config NF_NAT_SNMP_BASIC
  72. tristate "Basic SNMP-ALG support"
  73. depends on NF_CONNTRACK_SNMP
  74. depends on NETFILTER_ADVANCED
  75. default NF_NAT && NF_CONNTRACK_SNMP
  76. select ASN1
  77. help
  78. This module implements an Application Layer Gateway (ALG) for
  79. SNMP payloads. In conjunction with NAT, it allows a network
  80. management system to access multiple private networks with
  81. conflicting addresses. It works by modifying IP addresses
  82. inside SNMP payloads to match IP-layer NAT mapping.
  83. This is the "basic" form of SNMP-ALG, as described in RFC 2962
  84. To compile it as a module, choose M here. If unsure, say N.
  85. config NF_NAT_PPTP
  86. tristate
  87. depends on NF_CONNTRACK
  88. default NF_CONNTRACK_PPTP
  89. config NF_NAT_H323
  90. tristate
  91. depends on NF_CONNTRACK
  92. default NF_CONNTRACK_H323
  93. endif # NF_NAT
  94. config IP_NF_IPTABLES
  95. tristate "IP tables support (required for filtering/masq/NAT)"
  96. default m if NETFILTER_ADVANCED=n
  97. select NETFILTER_XTABLES
  98. help
  99. iptables is a general, extensible packet identification framework.
  100. The packet filtering and full NAT (masquerading, port forwarding,
  101. etc) subsystems now use this: say `Y' or `M' here if you want to use
  102. either of those.
  103. To compile it as a module, choose M here. If unsure, say N.
  104. if IP_NF_IPTABLES
  105. # The matches.
  106. config IP_NF_MATCH_AH
  107. tristate '"ah" match support'
  108. depends on NETFILTER_ADVANCED
  109. help
  110. This match extension allows you to match a range of SPIs
  111. inside AH header of IPSec packets.
  112. To compile it as a module, choose M here. If unsure, say N.
  113. config IP_NF_MATCH_ECN
  114. tristate '"ecn" match support'
  115. depends on NETFILTER_ADVANCED
  116. select NETFILTER_XT_MATCH_ECN
  117. help
  118. This is a backwards-compat option for the user's convenience
  119. (e.g. when running oldconfig). It selects
  120. CONFIG_NETFILTER_XT_MATCH_ECN.
  121. config IP_NF_MATCH_RPFILTER
  122. tristate '"rpfilter" reverse path filter match support'
  123. depends on NETFILTER_ADVANCED
  124. depends on IP_NF_MANGLE || IP_NF_RAW
  125. help
  126. This option allows you to match packets whose replies would
  127. go out via the interface the packet came in.
  128. To compile it as a module, choose M here. If unsure, say N.
  129. The module will be called ipt_rpfilter.
  130. config IP_NF_MATCH_TTL
  131. tristate '"ttl" match support'
  132. depends on NETFILTER_ADVANCED
  133. select NETFILTER_XT_MATCH_HL
  134. help
  135. This is a backwards-compat option for the user's convenience
  136. (e.g. when running oldconfig). It selects
  137. CONFIG_NETFILTER_XT_MATCH_HL.
  138. # `filter', generic and specific targets
  139. config IP_NF_FILTER
  140. tristate "Packet filtering"
  141. default m if NETFILTER_ADVANCED=n
  142. help
  143. Packet filtering defines a table `filter', which has a series of
  144. rules for simple packet filtering at local input, forwarding and
  145. local output. See the man page for iptables(8).
  146. To compile it as a module, choose M here. If unsure, say N.
  147. config IP_NF_TARGET_REJECT
  148. tristate "REJECT target support"
  149. depends on IP_NF_FILTER
  150. select NF_REJECT_IPV4
  151. default m if NETFILTER_ADVANCED=n
  152. help
  153. The REJECT target allows a filtering rule to specify that an ICMP
  154. error should be issued in response to an incoming packet, rather
  155. than silently being dropped.
  156. To compile it as a module, choose M here. If unsure, say N.
  157. config IP_NF_TARGET_SYNPROXY
  158. tristate "SYNPROXY target support"
  159. depends on NF_CONNTRACK && NETFILTER_ADVANCED
  160. select NETFILTER_SYNPROXY
  161. select SYN_COOKIES
  162. help
  163. The SYNPROXY target allows you to intercept TCP connections and
  164. establish them using syncookies before they are passed on to the
  165. server. This allows to avoid conntrack and server resource usage
  166. during SYN-flood attacks.
  167. To compile it as a module, choose M here. If unsure, say N.
  168. # NAT + specific targets: nf_conntrack
  169. config IP_NF_NAT
  170. tristate "iptables NAT support"
  171. depends on NF_CONNTRACK
  172. default m if NETFILTER_ADVANCED=n
  173. select NF_NAT
  174. select NETFILTER_XT_NAT
  175. help
  176. This enables the `nat' table in iptables. This allows masquerading,
  177. port forwarding and other forms of full Network Address Port
  178. Translation.
  179. To compile it as a module, choose M here. If unsure, say N.
  180. if IP_NF_NAT
  181. config IP_NF_TARGET_MASQUERADE
  182. tristate "MASQUERADE target support"
  183. select NETFILTER_XT_TARGET_MASQUERADE
  184. help
  185. This is a backwards-compat option for the user's convenience
  186. (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE.
  187. config IP_NF_TARGET_NETMAP
  188. tristate "NETMAP target support"
  189. depends on NETFILTER_ADVANCED
  190. select NETFILTER_XT_TARGET_NETMAP
  191. help
  192. This is a backwards-compat option for the user's convenience
  193. (e.g. when running oldconfig). It selects
  194. CONFIG_NETFILTER_XT_TARGET_NETMAP.
  195. config IP_NF_TARGET_REDIRECT
  196. tristate "REDIRECT target support"
  197. depends on NETFILTER_ADVANCED
  198. select NETFILTER_XT_TARGET_REDIRECT
  199. help
  200. This is a backwards-compat option for the user's convenience
  201. (e.g. when running oldconfig). It selects
  202. CONFIG_NETFILTER_XT_TARGET_REDIRECT.
  203. endif # IP_NF_NAT
  204. # mangle + specific targets
  205. config IP_NF_MANGLE
  206. tristate "Packet mangling"
  207. default m if NETFILTER_ADVANCED=n
  208. help
  209. This option adds a `mangle' table to iptables: see the man page for
  210. iptables(8). This table is used for various packet alterations
  211. which can effect how the packet is routed.
  212. To compile it as a module, choose M here. If unsure, say N.
  213. config IP_NF_TARGET_CLUSTERIP
  214. tristate "CLUSTERIP target support"
  215. depends on IP_NF_MANGLE
  216. depends on NF_CONNTRACK
  217. depends on NETFILTER_ADVANCED
  218. select NF_CONNTRACK_MARK
  219. select NETFILTER_FAMILY_ARP
  220. help
  221. The CLUSTERIP target allows you to build load-balancing clusters of
  222. network servers without having a dedicated load-balancing
  223. router/server/switch.
  224. To compile it as a module, choose M here. If unsure, say N.
  225. config IP_NF_TARGET_ECN
  226. tristate "ECN target support"
  227. depends on IP_NF_MANGLE
  228. depends on NETFILTER_ADVANCED
  229. help
  230. This option adds a `ECN' target, which can be used in the iptables mangle
  231. table.
  232. You can use this target to remove the ECN bits from the IPv4 header of
  233. an IP packet. This is particularly useful, if you need to work around
  234. existing ECN blackholes on the internet, but don't want to disable
  235. ECN support in general.
  236. To compile it as a module, choose M here. If unsure, say N.
  237. config IP_NF_TARGET_TTL
  238. tristate '"TTL" target support'
  239. depends on NETFILTER_ADVANCED && IP_NF_MANGLE
  240. select NETFILTER_XT_TARGET_HL
  241. help
  242. This is a backwards-compatible option for the user's convenience
  243. (e.g. when running oldconfig). It selects
  244. CONFIG_NETFILTER_XT_TARGET_HL.
  245. # raw + specific targets
  246. config IP_NF_RAW
  247. tristate 'raw table support (required for NOTRACK/TRACE)'
  248. help
  249. This option adds a `raw' table to iptables. This table is the very
  250. first in the netfilter framework and hooks in at the PREROUTING
  251. and OUTPUT chains.
  252. If you want to compile it as a module, say M here and read
  253. <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
  254. # security table for MAC policy
  255. config IP_NF_SECURITY
  256. tristate "Security table"
  257. depends on SECURITY
  258. depends on NETFILTER_ADVANCED
  259. help
  260. This option adds a `security' table to iptables, for use
  261. with Mandatory Access Control (MAC) policy.
  262. If unsure, say N.
  263. endif # IP_NF_IPTABLES
  264. # ARP tables
  265. config IP_NF_ARPTABLES
  266. tristate "ARP tables support"
  267. select NETFILTER_XTABLES
  268. select NETFILTER_FAMILY_ARP
  269. depends on NETFILTER_ADVANCED
  270. help
  271. arptables is a general, extensible packet identification framework.
  272. The ARP packet filtering and mangling (manipulation)subsystems
  273. use this: say Y or M here if you want to use either of those.
  274. To compile it as a module, choose M here. If unsure, say N.
  275. if IP_NF_ARPTABLES
  276. config IP_NF_ARPFILTER
  277. tristate "ARP packet filtering"
  278. help
  279. ARP packet filtering defines a table `filter', which has a series of
  280. rules for simple ARP packet filtering at local input and
  281. local output. On a bridge, you can also specify filtering rules
  282. for forwarded ARP packets. See the man page for arptables(8).
  283. To compile it as a module, choose M here. If unsure, say N.
  284. config IP_NF_ARP_MANGLE
  285. tristate "ARP payload mangling"
  286. help
  287. Allows altering the ARP packet payload: source and destination
  288. hardware and network addresses.
  289. endif # IP_NF_ARPTABLES
  290. endmenu