| 1 | # SPDX-License-Identifier: GPL-2.0-only |
| 2 | # |
| 3 | # IP netfilter configuration |
| 4 | # |
| 5 | |
| 6 | menu "IP: Netfilter Configuration" |
| 7 | depends on INET && NETFILTER |
| 8 | |
| 9 | config NF_DEFRAG_IPV4 |
| 10 | tristate |
| 11 | default n |
| 12 | |
| 13 | # old sockopt interface and eval loop |
| 14 | config IP_NF_IPTABLES_LEGACY |
| 15 | tristate "Legacy IP tables support" |
| 16 | depends on NETFILTER_XTABLES_LEGACY |
| 17 | depends on NETFILTER_XTABLES |
| 18 | default m if NETFILTER_XTABLES_LEGACY |
| 19 | help |
| 20 | iptables is a legacy packet classifier. |
| 21 | This is not needed if you are using iptables over nftables |
| 22 | (iptables-nft). |
| 23 | |
| 24 | config NF_SOCKET_IPV4 |
| 25 | tristate "IPv4 socket lookup support" |
| 26 | help |
| 27 | This option enables the IPv4 socket lookup infrastructure. This is |
| 28 | is required by the {ip,nf}tables socket match. |
| 29 | |
| 30 | config NF_TPROXY_IPV4 |
| 31 | tristate "IPv4 tproxy support" |
| 32 | |
| 33 | if NF_TABLES |
| 34 | |
| 35 | config NF_TABLES_IPV4 |
| 36 | bool "IPv4 nf_tables support" |
| 37 | help |
| 38 | This option enables the IPv4 support for nf_tables. |
| 39 | |
| 40 | if NF_TABLES_IPV4 |
| 41 | |
| 42 | config NFT_REJECT_IPV4 |
| 43 | select NF_REJECT_IPV4 |
| 44 | default NFT_REJECT |
| 45 | tristate |
| 46 | |
| 47 | config NFT_DUP_IPV4 |
| 48 | tristate "IPv4 nf_tables packet duplication support" |
| 49 | depends on !NF_CONNTRACK || NF_CONNTRACK |
| 50 | select NF_DUP_IPV4 |
| 51 | help |
| 52 | This module enables IPv4 packet duplication support for nf_tables. |
| 53 | |
| 54 | config NFT_FIB_IPV4 |
| 55 | select NFT_FIB |
| 56 | tristate "nf_tables fib / ip route lookup support" |
| 57 | help |
| 58 | This module enables IPv4 FIB lookups, e.g. for reverse path filtering. |
| 59 | It also allows query of the FIB for the route type, e.g. local, unicast, |
| 60 | multicast or blackhole. |
| 61 | |
| 62 | endif # NF_TABLES_IPV4 |
| 63 | |
| 64 | config NF_TABLES_ARP |
| 65 | bool "ARP nf_tables support" |
| 66 | select NETFILTER_FAMILY_ARP |
| 67 | help |
| 68 | This option enables the ARP support for nf_tables. |
| 69 | |
| 70 | endif # NF_TABLES |
| 71 | |
| 72 | config NF_DUP_IPV4 |
| 73 | tristate "Netfilter IPv4 packet duplication to alternate destination" |
| 74 | depends on !NF_CONNTRACK || NF_CONNTRACK |
| 75 | help |
| 76 | This option enables the nf_dup_ipv4 core, which duplicates an IPv4 |
| 77 | packet to be rerouted to another destination. |
| 78 | |
| 79 | config NF_LOG_ARP |
| 80 | tristate "ARP packet logging" |
| 81 | default m if NETFILTER_ADVANCED=n |
| 82 | select NF_LOG_SYSLOG |
| 83 | help |
| 84 | This is a backwards-compat option for the user's convenience |
| 85 | (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG. |
| 86 | |
| 87 | config NF_LOG_IPV4 |
| 88 | tristate "IPv4 packet logging" |
| 89 | default m if NETFILTER_ADVANCED=n |
| 90 | select NF_LOG_SYSLOG |
| 91 | help |
| 92 | This is a backwards-compat option for the user's convenience |
| 93 | (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG. |
| 94 | |
| 95 | config NF_REJECT_IPV4 |
| 96 | tristate "IPv4 packet rejection" |
| 97 | default m if NETFILTER_ADVANCED=n |
| 98 | |
| 99 | if NF_NAT |
| 100 | config NF_NAT_SNMP_BASIC |
| 101 | tristate "Basic SNMP-ALG support" |
| 102 | depends on NF_CONNTRACK_SNMP |
| 103 | depends on NETFILTER_ADVANCED |
| 104 | default NF_NAT && NF_CONNTRACK_SNMP |
| 105 | select ASN1 |
| 106 | help |
| 107 | |
| 108 | This module implements an Application Layer Gateway (ALG) for |
| 109 | SNMP payloads. In conjunction with NAT, it allows a network |
| 110 | management system to access multiple private networks with |
| 111 | conflicting addresses. It works by modifying IP addresses |
| 112 | inside SNMP payloads to match IP-layer NAT mapping. |
| 113 | |
| 114 | This is the "basic" form of SNMP-ALG, as described in RFC 2962 |
| 115 | |
| 116 | To compile it as a module, choose M here. If unsure, say N. |
| 117 | |
| 118 | config NF_NAT_PPTP |
| 119 | tristate |
| 120 | depends on NF_CONNTRACK |
| 121 | default NF_CONNTRACK_PPTP |
| 122 | |
| 123 | config NF_NAT_H323 |
| 124 | tristate |
| 125 | depends on NF_CONNTRACK |
| 126 | default NF_CONNTRACK_H323 |
| 127 | |
| 128 | endif # NF_NAT |
| 129 | |
| 130 | config IP_NF_IPTABLES |
| 131 | tristate "IP tables support (required for filtering/masq/NAT)" |
| 132 | default m if NETFILTER_ADVANCED=n |
| 133 | select NETFILTER_XTABLES |
| 134 | help |
| 135 | iptables is a general, extensible packet identification framework. |
| 136 | The packet filtering and full NAT (masquerading, port forwarding, |
| 137 | etc) subsystems now use this: say `Y' or `M' here if you want to use |
| 138 | either of those. |
| 139 | |
| 140 | To compile it as a module, choose M here. If unsure, say N. |
| 141 | |
| 142 | if IP_NF_IPTABLES |
| 143 | |
| 144 | # The matches. |
| 145 | config IP_NF_MATCH_AH |
| 146 | tristate '"ah" match support' |
| 147 | depends on NETFILTER_ADVANCED |
| 148 | help |
| 149 | This match extension allows you to match a range of SPIs |
| 150 | inside AH header of IPSec packets. |
| 151 | |
| 152 | To compile it as a module, choose M here. If unsure, say N. |
| 153 | |
| 154 | config IP_NF_MATCH_ECN |
| 155 | tristate '"ecn" match support' |
| 156 | depends on NETFILTER_ADVANCED |
| 157 | select NETFILTER_XT_MATCH_ECN |
| 158 | help |
| 159 | This is a backwards-compat option for the user's convenience |
| 160 | (e.g. when running oldconfig). It selects |
| 161 | CONFIG_NETFILTER_XT_MATCH_ECN. |
| 162 | |
| 163 | config IP_NF_MATCH_RPFILTER |
| 164 | tristate '"rpfilter" reverse path filter match support' |
| 165 | depends on NETFILTER_ADVANCED |
| 166 | depends on IP_NF_MANGLE || IP_NF_RAW || NFT_COMPAT |
| 167 | help |
| 168 | This option allows you to match packets whose replies would |
| 169 | go out via the interface the packet came in. |
| 170 | |
| 171 | To compile it as a module, choose M here. If unsure, say N. |
| 172 | The module will be called ipt_rpfilter. |
| 173 | |
| 174 | config IP_NF_MATCH_TTL |
| 175 | tristate '"ttl" match support' |
| 176 | depends on NETFILTER_ADVANCED |
| 177 | select NETFILTER_XT_MATCH_HL |
| 178 | help |
| 179 | This is a backwards-compat option for the user's convenience |
| 180 | (e.g. when running oldconfig). It selects |
| 181 | CONFIG_NETFILTER_XT_MATCH_HL. |
| 182 | |
| 183 | # `filter', generic and specific targets |
| 184 | config IP_NF_FILTER |
| 185 | tristate "Packet filtering" |
| 186 | default m if NETFILTER_ADVANCED=n || IP_NF_IPTABLES_LEGACY |
| 187 | depends on IP_NF_IPTABLES_LEGACY |
| 188 | help |
| 189 | Packet filtering defines a table `filter', which has a series of |
| 190 | rules for simple packet filtering at local input, forwarding and |
| 191 | local output. See the man page for iptables(8). |
| 192 | |
| 193 | To compile it as a module, choose M here. If unsure, say N. |
| 194 | |
| 195 | config IP_NF_TARGET_REJECT |
| 196 | tristate "REJECT target support" |
| 197 | depends on IP_NF_FILTER || NFT_COMPAT |
| 198 | select NF_REJECT_IPV4 |
| 199 | default m if NETFILTER_ADVANCED=n |
| 200 | help |
| 201 | The REJECT target allows a filtering rule to specify that an ICMP |
| 202 | error should be issued in response to an incoming packet, rather |
| 203 | than silently being dropped. |
| 204 | |
| 205 | To compile it as a module, choose M here. If unsure, say N. |
| 206 | |
| 207 | config IP_NF_TARGET_SYNPROXY |
| 208 | tristate "SYNPROXY target support" |
| 209 | depends on NF_CONNTRACK && NETFILTER_ADVANCED |
| 210 | select NETFILTER_SYNPROXY |
| 211 | select SYN_COOKIES |
| 212 | help |
| 213 | The SYNPROXY target allows you to intercept TCP connections and |
| 214 | establish them using syncookies before they are passed on to the |
| 215 | server. This allows to avoid conntrack and server resource usage |
| 216 | during SYN-flood attacks. |
| 217 | |
| 218 | To compile it as a module, choose M here. If unsure, say N. |
| 219 | |
| 220 | # NAT + specific targets: nf_conntrack |
| 221 | config IP_NF_NAT |
| 222 | tristate "iptables NAT support" |
| 223 | depends on NF_CONNTRACK |
| 224 | depends on IP_NF_IPTABLES_LEGACY |
| 225 | default m if NETFILTER_ADVANCED=n |
| 226 | select NF_NAT |
| 227 | select NETFILTER_XT_NAT |
| 228 | help |
| 229 | This enables the `nat' table in iptables. This allows masquerading, |
| 230 | port forwarding and other forms of full Network Address Port |
| 231 | Translation. |
| 232 | |
| 233 | To compile it as a module, choose M here. If unsure, say N. |
| 234 | |
| 235 | if IP_NF_NAT |
| 236 | |
| 237 | config IP_NF_TARGET_MASQUERADE |
| 238 | tristate "MASQUERADE target support" |
| 239 | select NETFILTER_XT_TARGET_MASQUERADE |
| 240 | help |
| 241 | This is a backwards-compat option for the user's convenience |
| 242 | (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE. |
| 243 | |
| 244 | config IP_NF_TARGET_NETMAP |
| 245 | tristate "NETMAP target support" |
| 246 | depends on NETFILTER_ADVANCED |
| 247 | select NETFILTER_XT_TARGET_NETMAP |
| 248 | help |
| 249 | This is a backwards-compat option for the user's convenience |
| 250 | (e.g. when running oldconfig). It selects |
| 251 | CONFIG_NETFILTER_XT_TARGET_NETMAP. |
| 252 | |
| 253 | config IP_NF_TARGET_REDIRECT |
| 254 | tristate "REDIRECT target support" |
| 255 | depends on NETFILTER_ADVANCED |
| 256 | select NETFILTER_XT_TARGET_REDIRECT |
| 257 | help |
| 258 | This is a backwards-compat option for the user's convenience |
| 259 | (e.g. when running oldconfig). It selects |
| 260 | CONFIG_NETFILTER_XT_TARGET_REDIRECT. |
| 261 | |
| 262 | endif # IP_NF_NAT |
| 263 | |
| 264 | # mangle + specific targets |
| 265 | config IP_NF_MANGLE |
| 266 | tristate "Packet mangling" |
| 267 | default m if NETFILTER_ADVANCED=n || IP_NF_IPTABLES_LEGACY |
| 268 | depends on IP_NF_IPTABLES_LEGACY |
| 269 | help |
| 270 | This option adds a `mangle' table to iptables: see the man page for |
| 271 | iptables(8). This table is used for various packet alterations |
| 272 | which can effect how the packet is routed. |
| 273 | |
| 274 | To compile it as a module, choose M here. If unsure, say N. |
| 275 | |
| 276 | config IP_NF_TARGET_ECN |
| 277 | tristate "ECN target support" |
| 278 | depends on IP_NF_MANGLE || NFT_COMPAT |
| 279 | depends on NETFILTER_ADVANCED |
| 280 | help |
| 281 | This option adds a `ECN' target, which can be used in the iptables mangle |
| 282 | table. |
| 283 | |
| 284 | You can use this target to remove the ECN bits from the IPv4 header of |
| 285 | an IP packet. This is particularly useful, if you need to work around |
| 286 | existing ECN blackholes on the internet, but don't want to disable |
| 287 | ECN support in general. |
| 288 | |
| 289 | To compile it as a module, choose M here. If unsure, say N. |
| 290 | |
| 291 | config IP_NF_TARGET_TTL |
| 292 | tristate '"TTL" target support' |
| 293 | depends on NETFILTER_ADVANCED && IP_NF_MANGLE |
| 294 | select NETFILTER_XT_TARGET_HL |
| 295 | help |
| 296 | This is a backwards-compatible option for the user's convenience |
| 297 | (e.g. when running oldconfig). It selects |
| 298 | CONFIG_NETFILTER_XT_TARGET_HL. |
| 299 | |
| 300 | # raw + specific targets |
| 301 | config IP_NF_RAW |
| 302 | tristate 'raw table support (required for NOTRACK/TRACE)' |
| 303 | depends on IP_NF_IPTABLES_LEGACY |
| 304 | help |
| 305 | This option adds a `raw' table to iptables. This table is the very |
| 306 | first in the netfilter framework and hooks in at the PREROUTING |
| 307 | and OUTPUT chains. |
| 308 | |
| 309 | If you want to compile it as a module, say M here and read |
| 310 | <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. |
| 311 | |
| 312 | # security table for MAC policy |
| 313 | config IP_NF_SECURITY |
| 314 | tristate "Security table" |
| 315 | depends on SECURITY |
| 316 | depends on NETFILTER_ADVANCED |
| 317 | depends on IP_NF_IPTABLES_LEGACY |
| 318 | help |
| 319 | This option adds a `security' table to iptables, for use |
| 320 | with Mandatory Access Control (MAC) policy. |
| 321 | |
| 322 | If unsure, say N. |
| 323 | |
| 324 | endif # IP_NF_IPTABLES |
| 325 | |
| 326 | # ARP tables |
| 327 | config IP_NF_ARPTABLES |
| 328 | tristate "Legacy ARPTABLES support" |
| 329 | depends on NETFILTER_XTABLES_LEGACY |
| 330 | depends on NETFILTER_XTABLES |
| 331 | default n |
| 332 | help |
| 333 | arptables is a legacy packet classifier. |
| 334 | This is not needed if you are using arptables over nftables |
| 335 | (iptables-nft). |
| 336 | |
| 337 | config NFT_COMPAT_ARP |
| 338 | tristate |
| 339 | depends on NF_TABLES_ARP && NFT_COMPAT |
| 340 | default m if NFT_COMPAT=m |
| 341 | default y if NFT_COMPAT=y |
| 342 | |
| 343 | config IP_NF_ARPFILTER |
| 344 | tristate "arptables-legacy packet filtering support" |
| 345 | select IP_NF_ARPTABLES |
| 346 | select NETFILTER_FAMILY_ARP |
| 347 | depends on NETFILTER_XTABLES_LEGACY |
| 348 | depends on NETFILTER_XTABLES |
| 349 | help |
| 350 | ARP packet filtering defines a table `filter', which has a series of |
| 351 | rules for simple ARP packet filtering at local input and |
| 352 | local output. This is only needed for arptables-legacy(8). |
| 353 | Neither arptables-nft nor nftables need this to work. |
| 354 | |
| 355 | To compile it as a module, choose M here. If unsure, say N. |
| 356 | |
| 357 | config IP_NF_ARP_MANGLE |
| 358 | tristate "ARP payload mangling" |
| 359 | depends on IP_NF_ARPTABLES || NFT_COMPAT_ARP |
| 360 | help |
| 361 | Allows altering the ARP packet payload: source and destination |
| 362 | hardware and network addresses. |
| 363 | |
| 364 | This option is needed by both arptables-legacy and arptables-nft. |
| 365 | It is not used by nftables. |
| 366 | |
| 367 | endmenu |
| 368 | |