| # |
| # IP netfilter configuration |
| # |
| |
| menu "IPv6: Netfilter Configuration" |
| depends on INET && IPV6 && NETFILTER |
| |
| config NF_CONNTRACK_IPV6 |
| tristate "IPv6 connection tracking support" |
| depends on INET && IPV6 && NF_CONNTRACK |
| default m if NETFILTER_ADVANCED=n |
| ---help--- |
| Connection tracking keeps a record of what packets have passed |
| through your machine, in order to figure out how they are related |
| into connections. |
| |
| This is IPv6 support on Layer 3 independent connection tracking. |
| Layer 3 independent connection tracking is experimental scheme |
| which generalize ip_conntrack to support other layer 3 protocols. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_QUEUE |
| tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)" |
| depends on INET && IPV6 && NETFILTER |
| depends on NETFILTER_ADVANCED |
| ---help--- |
| |
| This option adds a queue handler to the kernel for IPv6 |
| packets which enables users to receive the filtered packets |
| with QUEUE target using libipq. |
| |
| This option enables the old IPv6-only "ip6_queue" implementation |
| which has been obsoleted by the new "nfnetlink_queue" code (see |
| CONFIG_NETFILTER_NETLINK_QUEUE). |
| |
| (C) Fernando Anton 2001 |
| IPv64 Project - Work based in IPv64 draft by Arturo Azcorra. |
| Universidad Carlos III de Madrid |
| Universidad Politecnica de Alcala de Henares |
| email: <fanton@it.uc3m.es>. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_IPTABLES |
| tristate "IP6 tables support (required for filtering)" |
| depends on INET && IPV6 |
| select NETFILTER_XTABLES |
| default m if NETFILTER_ADVANCED=n |
| help |
| ip6tables is a general, extensible packet identification framework. |
| Currently only the packet filtering and packet mangling subsystem |
| for IPv6 use this, but connection tracking is going to follow. |
| Say 'Y' or 'M' here if you want to use either of those. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| # The simple matches. |
| config IP6_NF_MATCH_RT |
| tristate '"rt" Routing header match support' |
| depends on IP6_NF_IPTABLES |
| depends on NETFILTER_ADVANCED |
| help |
| rt matching allows you to match packets based on the routing |
| header of the packet. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_MATCH_OPTS |
| tristate '"hbh" hop-by-hop and "dst" opts header match support' |
| depends on IP6_NF_IPTABLES |
| depends on NETFILTER_ADVANCED |
| help |
| This allows one to match packets based on the hop-by-hop |
| and destination options headers of a packet. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_MATCH_FRAG |
| tristate '"frag" Fragmentation header match support' |
| depends on IP6_NF_IPTABLES |
| depends on NETFILTER_ADVANCED |
| help |
| frag matching allows you to match packets based on the fragmentation |
| header of the packet. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_MATCH_HL |
| tristate '"hl" match support' |
| depends on IP6_NF_IPTABLES |
| depends on NETFILTER_ADVANCED |
| help |
| HL matching allows you to match packets based on the hop |
| limit of the packet. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_MATCH_IPV6HEADER |
| tristate '"ipv6header" IPv6 Extension Headers Match' |
| depends on IP6_NF_IPTABLES |
| default m if NETFILTER_ADVANCED=n |
| help |
| This module allows one to match packets based upon |
| the ipv6 extension headers. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_MATCH_AH |
| tristate '"ah" match support' |
| depends on IP6_NF_IPTABLES |
| depends on NETFILTER_ADVANCED |
| help |
| This module allows one to match AH packets. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_MATCH_MH |
| tristate '"mh" match support' |
| depends on IP6_NF_IPTABLES |
| depends on NETFILTER_ADVANCED |
| help |
| This module allows one to match MH packets. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_MATCH_EUI64 |
| tristate '"eui64" address check' |
| depends on IP6_NF_IPTABLES |
| depends on NETFILTER_ADVANCED |
| help |
| This module performs checking on the IPv6 source address |
| Compares the last 64 bits with the EUI64 (delivered |
| from the MAC address) address |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| # The targets |
| config IP6_NF_TARGET_LOG |
| tristate "LOG target support" |
| depends on IP6_NF_IPTABLES |
| default m if NETFILTER_ADVANCED=n |
| help |
| This option adds a `LOG' target, which allows you to create rules in |
| any iptables table which records the packet header to the syslog. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_FILTER |
| tristate "Packet filtering" |
| depends on IP6_NF_IPTABLES |
| default m if NETFILTER_ADVANCED=n |
| help |
| Packet filtering defines a table `filter', which has a series of |
| rules for simple packet filtering at local input, forwarding and |
| local output. See the man page for iptables(8). |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_TARGET_REJECT |
| tristate "REJECT target support" |
| depends on IP6_NF_FILTER |
| default m if NETFILTER_ADVANCED=n |
| help |
| The REJECT target allows a filtering rule to specify that an ICMPv6 |
| error should be issued in response to an incoming packet, rather |
| than silently being dropped. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_MANGLE |
| tristate "Packet mangling" |
| depends on IP6_NF_IPTABLES |
| default m if NETFILTER_ADVANCED=n |
| help |
| This option adds a `mangle' table to iptables: see the man page for |
| iptables(8). This table is used for various packet alterations |
| which can effect how the packet is routed. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_TARGET_HL |
| tristate 'HL (hoplimit) target support' |
| depends on IP6_NF_MANGLE |
| depends on NETFILTER_ADVANCED |
| help |
| This option adds a `HL' target, which enables the user to decrement |
| the hoplimit value of the IPv6 header or set it to a given (lower) |
| value. |
| |
| While it is safe to decrement the hoplimit value, this option also |
| enables functionality to increment and set the hoplimit value of the |
| IPv6 header to arbitrary values. This is EXTREMELY DANGEROUS since |
| you can easily create immortal packets that loop forever on the |
| network. |
| |
| To compile it as a module, choose M here. If unsure, say N. |
| |
| config IP6_NF_RAW |
| tristate 'raw table support (required for TRACE)' |
| depends on IP6_NF_IPTABLES |
| depends on NETFILTER_ADVANCED |
| help |
| This option adds a `raw' table to ip6tables. This table is the very |
| first in the netfilter framework and hooks in at the PREROUTING |
| and OUTPUT chains. |
| |
| If you want to compile it as a module, say M here and read |
| <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. |
| |
| # security table for MAC policy |
| config IP6_NF_SECURITY |
| tristate "Security table" |
| depends on IP6_NF_IPTABLES |
| depends on SECURITY |
| depends on NETFILTER_ADVANCED |
| help |
| This option adds a `security' table to iptables, for use |
| with Mandatory Access Control (MAC) policy. |
| |
| If unsure, say N. |
| |
| endmenu |
| |