2 # IP netfilter configuration
5 menu "IPv6: Netfilter Configuration"
6 depends on INET && IPV6 && NETFILTER
12 config NF_CONNTRACK_IPV6
13 tristate "IPv6 connection tracking support"
14 depends on INET && IPV6 && NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
22 This is IPv6 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
26 To compile it as a module, choose M here. If unsure, say N.
29 tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
30 depends on INET && IPV6 && NETFILTER
31 depends on NETFILTER_ADVANCED
34 This option adds a queue handler to the kernel for IPv6
35 packets which enables users to receive the filtered packets
36 with QUEUE target using libipq.
38 This option enables the old IPv6-only "ip6_queue" implementation
39 which has been obsoleted by the new "nfnetlink_queue" code (see
40 CONFIG_NETFILTER_NETLINK_QUEUE).
42 (C) Fernando Anton 2001
43 IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
44 Universidad Carlos III de Madrid
45 Universidad Politecnica de Alcala de Henares
46 email: <fanton@it.uc3m.es>.
48 To compile it as a module, choose M here. If unsure, say N.
50 config IP6_NF_IPTABLES
51 tristate "IP6 tables support (required for filtering)"
52 depends on INET && IPV6
53 select NETFILTER_XTABLES
54 default m if NETFILTER_ADVANCED=n
56 ip6tables is a general, extensible packet identification framework.
57 Currently only the packet filtering and packet mangling subsystem
58 for IPv6 use this, but connection tracking is going to follow.
59 Say 'Y' or 'M' here if you want to use either of those.
61 To compile it as a module, choose M here. If unsure, say N.
66 config IP6_NF_MATCH_AH
67 tristate '"ah" match support'
68 depends on NETFILTER_ADVANCED
70 This module allows one to match AH packets.
72 To compile it as a module, choose M here. If unsure, say N.
74 config IP6_NF_MATCH_EUI64
75 tristate '"eui64" address check'
76 depends on NETFILTER_ADVANCED
78 This module performs checking on the IPv6 source address
79 Compares the last 64 bits with the EUI64 (delivered
80 from the MAC address) address
82 To compile it as a module, choose M here. If unsure, say N.
84 config IP6_NF_MATCH_FRAG
85 tristate '"frag" Fragmentation header match support'
86 depends on NETFILTER_ADVANCED
88 frag matching allows you to match packets based on the fragmentation
91 To compile it as a module, choose M here. If unsure, say N.
93 config IP6_NF_MATCH_OPTS
94 tristate '"hbh" hop-by-hop and "dst" opts header match support'
95 depends on NETFILTER_ADVANCED
97 This allows one to match packets based on the hop-by-hop
98 and destination options headers of a packet.
100 To compile it as a module, choose M here. If unsure, say N.
102 config IP6_NF_MATCH_HL
103 tristate '"hl" hoplimit match support'
104 depends on NETFILTER_ADVANCED
105 select NETFILTER_XT_MATCH_HL
107 This is a backwards-compat option for the user's convenience
108 (e.g. when running oldconfig). It selects
109 CONFIG_NETFILTER_XT_MATCH_HL.
111 config IP6_NF_MATCH_IPV6HEADER
112 tristate '"ipv6header" IPv6 Extension Headers Match'
113 default m if NETFILTER_ADVANCED=n
115 This module allows one to match packets based upon
116 the ipv6 extension headers.
118 To compile it as a module, choose M here. If unsure, say N.
120 config IP6_NF_MATCH_MH
121 tristate '"mh" match support'
122 depends on NETFILTER_ADVANCED
124 This module allows one to match MH packets.
126 To compile it as a module, choose M here. If unsure, say N.
128 config IP6_NF_MATCH_RPFILTER
129 tristate '"rpfilter" reverse path filter match support'
130 depends on NETFILTER_ADVANCED
132 This option allows you to match packets whose replies would
133 go out via the interface the packet came in.
135 To compile it as a module, choose M here. If unsure, say N.
136 The module will be called ip6t_rpfilter.
138 config IP6_NF_MATCH_RT
139 tristate '"rt" Routing header match support'
140 depends on NETFILTER_ADVANCED
142 rt matching allows you to match packets based on the routing
143 header of the packet.
145 To compile it as a module, choose M here. If unsure, say N.
148 config IP6_NF_TARGET_HL
149 tristate '"HL" hoplimit target support'
150 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
151 select NETFILTER_XT_TARGET_HL
153 This is a backwards-compatible option for the user's convenience
154 (e.g. when running oldconfig). It selects
155 CONFIG_NETFILTER_XT_TARGET_HL.
158 tristate "Packet filtering"
159 default m if NETFILTER_ADVANCED=n
161 Packet filtering defines a table `filter', which has a series of
162 rules for simple packet filtering at local input, forwarding and
163 local output. See the man page for iptables(8).
165 To compile it as a module, choose M here. If unsure, say N.
167 config IP6_NF_TARGET_REJECT
168 tristate "REJECT target support"
169 depends on IP6_NF_FILTER
170 default m if NETFILTER_ADVANCED=n
172 The REJECT target allows a filtering rule to specify that an ICMPv6
173 error should be issued in response to an incoming packet, rather
174 than silently being dropped.
176 To compile it as a module, choose M here. If unsure, say N.
179 tristate "Packet mangling"
180 default m if NETFILTER_ADVANCED=n
182 This option adds a `mangle' table to iptables: see the man page for
183 iptables(8). This table is used for various packet alterations
184 which can effect how the packet is routed.
186 To compile it as a module, choose M here. If unsure, say N.
189 tristate 'raw table support (required for TRACE)'
191 This option adds a `raw' table to ip6tables. This table is the very
192 first in the netfilter framework and hooks in at the PREROUTING
195 If you want to compile it as a module, say M here and read
196 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
198 # security table for MAC policy
199 config IP6_NF_SECURITY
200 tristate "Security table"
202 depends on NETFILTER_ADVANCED
204 This option adds a `security' table to iptables, for use
205 with Mandatory Access Control (MAC) policy.
209 endif # IP6_NF_IPTABLES