Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | # |
| 2 | # IP netfilter configuration |
| 3 | # |
| 4 | |
| 5 | menu "IPv6: Netfilter Configuration (EXPERIMENTAL)" |
| 6 | depends on INET && IPV6 && NETFILTER && EXPERIMENTAL |
| 7 | |
Yasuyuki Kozakai | 9bdf87d | 2005-11-14 15:26:58 -0800 | [diff] [blame] | 8 | config NF_CONNTRACK_IPV6 |
Patrick McHardy | a3c4797 | 2006-12-02 22:11:01 -0800 | [diff] [blame] | 9 | tristate "IPv6 connection tracking support (EXPERIMENTAL)" |
David S. Miller | 9b54d5c | 2006-12-17 14:37:23 -0800 | [diff] [blame] | 10 | depends on INET && IPV6 && EXPERIMENTAL && NF_CONNTRACK |
Yasuyuki Kozakai | 9bdf87d | 2005-11-14 15:26:58 -0800 | [diff] [blame] | 11 | ---help--- |
| 12 | Connection tracking keeps a record of what packets have passed |
| 13 | through your machine, in order to figure out how they are related |
| 14 | into connections. |
| 15 | |
| 16 | This is IPv6 support on Layer 3 independent connection tracking. |
| 17 | Layer 3 independent connection tracking is experimental scheme |
| 18 | which generalize ip_conntrack to support other layer 3 protocols. |
| 19 | |
| 20 | To compile it as a module, choose M here. If unsure, say N. |
| 21 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 22 | config IP6_NF_QUEUE |
Harald Welte | 7af4cc3 | 2005-08-09 19:44:15 -0700 | [diff] [blame] | 23 | tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)" |
David S. Miller | 9b54d5c | 2006-12-17 14:37:23 -0800 | [diff] [blame] | 24 | depends on INET && IPV6 && NETFILTER && EXPERIMENTAL |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 25 | ---help--- |
| 26 | |
| 27 | This option adds a queue handler to the kernel for IPv6 |
Harald Welte | 7af4cc3 | 2005-08-09 19:44:15 -0700 | [diff] [blame] | 28 | packets which enables users to receive the filtered packets |
| 29 | with QUEUE target using libipq. |
| 30 | |
| 31 | THis option enables the old IPv6-only "ip6_queue" implementation |
| 32 | which has been obsoleted by the new "nfnetlink_queue" code (see |
| 33 | CONFIG_NETFILTER_NETLINK_QUEUE). |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 34 | |
| 35 | (C) Fernando Anton 2001 |
| 36 | IPv64 Project - Work based in IPv64 draft by Arturo Azcorra. |
| 37 | Universidad Carlos III de Madrid |
| 38 | Universidad Politecnica de Alcala de Henares |
| 39 | email: <fanton@it.uc3m.es>. |
| 40 | |
| 41 | To compile it as a module, choose M here. If unsure, say N. |
| 42 | |
| 43 | config IP6_NF_IPTABLES |
Patrick McHardy | 844dc7c | 2006-10-30 15:12:16 -0800 | [diff] [blame] | 44 | tristate "IP6 tables support (required for filtering)" |
David S. Miller | 9b54d5c | 2006-12-17 14:37:23 -0800 | [diff] [blame] | 45 | depends on INET && IPV6 && EXPERIMENTAL && NETFILTER_XTABLES |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 46 | help |
| 47 | ip6tables is a general, extensible packet identification framework. |
| 48 | Currently only the packet filtering and packet mangling subsystem |
| 49 | for IPv6 use this, but connection tracking is going to follow. |
| 50 | Say 'Y' or 'M' here if you want to use either of those. |
| 51 | |
| 52 | To compile it as a module, choose M here. If unsure, say N. |
| 53 | |
| 54 | # The simple matches. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 55 | config IP6_NF_MATCH_RT |
| 56 | tristate "Routing header match support" |
| 57 | depends on IP6_NF_IPTABLES |
| 58 | help |
| 59 | rt matching allows you to match packets based on the routing |
| 60 | header of the packet. |
| 61 | |
| 62 | To compile it as a module, choose M here. If unsure, say N. |
| 63 | |
| 64 | config IP6_NF_MATCH_OPTS |
| 65 | tristate "Hop-by-hop and Dst opts header match support" |
| 66 | depends on IP6_NF_IPTABLES |
| 67 | help |
| 68 | This allows one to match packets based on the hop-by-hop |
| 69 | and destination options headers of a packet. |
| 70 | |
| 71 | To compile it as a module, choose M here. If unsure, say N. |
| 72 | |
| 73 | config IP6_NF_MATCH_FRAG |
| 74 | tristate "Fragmentation header match support" |
| 75 | depends on IP6_NF_IPTABLES |
| 76 | help |
| 77 | frag matching allows you to match packets based on the fragmentation |
| 78 | header of the packet. |
| 79 | |
| 80 | To compile it as a module, choose M here. If unsure, say N. |
| 81 | |
| 82 | config IP6_NF_MATCH_HL |
| 83 | tristate "HL match support" |
| 84 | depends on IP6_NF_IPTABLES |
| 85 | help |
| 86 | HL matching allows you to match packets based on the hop |
| 87 | limit of the packet. |
| 88 | |
| 89 | To compile it as a module, choose M here. If unsure, say N. |
| 90 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 91 | config IP6_NF_MATCH_OWNER |
| 92 | tristate "Owner match support" |
| 93 | depends on IP6_NF_IPTABLES |
| 94 | help |
| 95 | Packet owner matching allows you to match locally-generated packets |
| 96 | based on who created them: the user, group, process or session. |
| 97 | |
| 98 | To compile it as a module, choose M here. If unsure, say N. |
| 99 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 100 | config IP6_NF_MATCH_IPV6HEADER |
| 101 | tristate "IPv6 Extension Headers Match" |
| 102 | depends on IP6_NF_IPTABLES |
| 103 | help |
| 104 | This module allows one to match packets based upon |
| 105 | the ipv6 extension headers. |
| 106 | |
| 107 | To compile it as a module, choose M here. If unsure, say N. |
| 108 | |
Yasuyuki Kozakai | dc5ab2f | 2006-04-01 02:22:30 -0800 | [diff] [blame] | 109 | config IP6_NF_MATCH_AH |
| 110 | tristate "AH match support" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 111 | depends on IP6_NF_IPTABLES |
| 112 | help |
Yasuyuki Kozakai | dc5ab2f | 2006-04-01 02:22:30 -0800 | [diff] [blame] | 113 | This module allows one to match AH packets. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 114 | |
| 115 | To compile it as a module, choose M here. If unsure, say N. |
| 116 | |
Masahide NAKAMURA | a0ca215 | 2007-02-07 15:12:57 -0800 | [diff] [blame] | 117 | config IP6_NF_MATCH_MH |
| 118 | tristate "MH match support" |
| 119 | depends on IP6_NF_IPTABLES |
| 120 | help |
| 121 | This module allows one to match MH packets. |
| 122 | |
| 123 | To compile it as a module, choose M here. If unsure, say N. |
| 124 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 125 | config IP6_NF_MATCH_EUI64 |
| 126 | tristate "EUI64 address check" |
| 127 | depends on IP6_NF_IPTABLES |
| 128 | help |
| 129 | This module performs checking on the IPv6 source address |
| 130 | Compares the last 64 bits with the EUI64 (delivered |
| 131 | from the MAC address) address |
| 132 | |
| 133 | To compile it as a module, choose M here. If unsure, say N. |
| 134 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 135 | # The targets |
| 136 | config IP6_NF_FILTER |
| 137 | tristate "Packet filtering" |
| 138 | depends on IP6_NF_IPTABLES |
| 139 | help |
| 140 | Packet filtering defines a table `filter', which has a series of |
| 141 | rules for simple packet filtering at local input, forwarding and |
| 142 | local output. See the man page for iptables(8). |
| 143 | |
| 144 | To compile it as a module, choose M here. If unsure, say N. |
| 145 | |
| 146 | config IP6_NF_TARGET_LOG |
| 147 | tristate "LOG target support" |
| 148 | depends on IP6_NF_FILTER |
| 149 | help |
| 150 | This option adds a `LOG' target, which allows you to create rules in |
| 151 | any iptables table which records the packet header to the syslog. |
| 152 | |
| 153 | To compile it as a module, choose M here. If unsure, say N. |
| 154 | |
Patrick McHardy | 764d8a9 | 2005-08-21 23:31:06 -0700 | [diff] [blame] | 155 | config IP6_NF_TARGET_REJECT |
| 156 | tristate "REJECT target support" |
| 157 | depends on IP6_NF_FILTER |
| 158 | help |
| 159 | The REJECT target allows a filtering rule to specify that an ICMPv6 |
| 160 | error should be issued in response to an incoming packet, rather |
| 161 | than silently being dropped. |
| 162 | |
| 163 | To compile it as a module, choose M here. If unsure, say N. |
| 164 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 165 | config IP6_NF_MANGLE |
| 166 | tristate "Packet mangling" |
| 167 | depends on IP6_NF_IPTABLES |
| 168 | help |
| 169 | This option adds a `mangle' table to iptables: see the man page for |
| 170 | iptables(8). This table is used for various packet alterations |
| 171 | which can effect how the packet is routed. |
| 172 | |
| 173 | To compile it as a module, choose M here. If unsure, say N. |
| 174 | |
Harald Welte | 0ac4f89 | 2005-08-27 22:37:30 -0700 | [diff] [blame] | 175 | config IP6_NF_TARGET_HL |
| 176 | tristate 'HL (hoplimit) target support' |
| 177 | depends on IP6_NF_MANGLE |
| 178 | help |
| 179 | This option adds a `HL' target, which enables the user to decrement |
| 180 | the hoplimit value of the IPv6 header or set it to a given (lower) |
| 181 | value. |
| 182 | |
| 183 | While it is safe to decrement the hoplimit value, this option also |
| 184 | enables functionality to increment and set the hoplimit value of the |
| 185 | IPv6 header to arbitrary values. This is EXTREMELY DANGEROUS since |
| 186 | you can easily create immortal packets that loop forever on the |
| 187 | network. |
| 188 | |
| 189 | To compile it as a module, choose M here. If unsure, say N. |
| 190 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 191 | config IP6_NF_RAW |
| 192 | tristate 'raw table support (required for TRACE)' |
| 193 | depends on IP6_NF_IPTABLES |
| 194 | help |
| 195 | This option adds a `raw' table to ip6tables. This table is the very |
| 196 | first in the netfilter framework and hooks in at the PREROUTING |
| 197 | and OUTPUT chains. |
| 198 | |
| 199 | If you want to compile it as a module, say M here and read |
| 200 | <file:Documentation/modules.txt>. If unsure, say `N'. |
| 201 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 202 | endmenu |
| 203 | |