1 # SPDX-License-Identifier: GPL-2.0-only
3 # IP netfilter configuration
6 menu "IPv6: Netfilter Configuration"
7 depends on INET && IPV6 && NETFILTER
10 tristate "IPv6 socket lookup support"
12 This option enables the IPv6 socket lookup infrastructure. This
13 is used by the {ip6,nf}tables socket match.
16 tristate "IPv6 tproxy support"
21 bool "IPv6 nf_tables support"
23 This option enables the IPv6 support for nf_tables.
27 config NFT_REJECT_IPV6
33 tristate "IPv6 nf_tables packet duplication support"
34 depends on !NF_CONNTRACK || NF_CONNTRACK
37 This module enables IPv6 packet duplication support for nf_tables.
40 tristate "nf_tables fib / ipv6 route lookup support"
43 This module enables IPv6 FIB lookups, e.g. for reverse path filtering.
44 It also allows query of the FIB for the route type, e.g. local, unicast,
45 multicast or blackhole.
47 endif # NF_TABLES_IPV6
51 tristate "Netfilter IPv6 packet duplication to alternate destination"
52 depends on !NF_CONNTRACK || NF_CONNTRACK
54 This option enables the nf_dup_ipv6 core, which duplicates an IPv6
55 packet to be rerouted to another destination.
58 tristate "IPv6 packet rejection"
59 default m if NETFILTER_ADVANCED=n
62 tristate "IPv6 packet logging"
63 default m if NETFILTER_ADVANCED=n
66 This is a backwards-compat option for the user's convenience
67 (e.g. when running oldconfig). It selects CONFIG_NF_LOG_SYSLOG.
69 config IP6_NF_IPTABLES
70 tristate "IP6 tables support (required for filtering)"
71 depends on INET && IPV6
72 select NETFILTER_XTABLES
73 default m if NETFILTER_ADVANCED=n
75 ip6tables is a general, extensible packet identification framework.
76 Currently only the packet filtering and packet mangling subsystem
77 for IPv6 use this, but connection tracking is going to follow.
78 Say 'Y' or 'M' here if you want to use either of those.
80 To compile it as a module, choose M here. If unsure, say N.
85 config IP6_NF_MATCH_AH
86 tristate '"ah" match support'
87 depends on NETFILTER_ADVANCED
89 This module allows one to match AH packets.
91 To compile it as a module, choose M here. If unsure, say N.
93 config IP6_NF_MATCH_EUI64
94 tristate '"eui64" address check'
95 depends on NETFILTER_ADVANCED
97 This module performs checking on the IPv6 source address
98 Compares the last 64 bits with the EUI64 (delivered
99 from the MAC address) address
101 To compile it as a module, choose M here. If unsure, say N.
103 config IP6_NF_MATCH_FRAG
104 tristate '"frag" Fragmentation header match support'
105 depends on NETFILTER_ADVANCED
107 frag matching allows you to match packets based on the fragmentation
108 header of the packet.
110 To compile it as a module, choose M here. If unsure, say N.
112 config IP6_NF_MATCH_OPTS
113 tristate '"hbh" hop-by-hop and "dst" opts header match support'
114 depends on NETFILTER_ADVANCED
116 This allows one to match packets based on the hop-by-hop
117 and destination options headers of a packet.
119 To compile it as a module, choose M here. If unsure, say N.
121 config IP6_NF_MATCH_HL
122 tristate '"hl" hoplimit match support'
123 depends on NETFILTER_ADVANCED
124 select NETFILTER_XT_MATCH_HL
126 This is a backwards-compat option for the user's convenience
127 (e.g. when running oldconfig). It selects
128 CONFIG_NETFILTER_XT_MATCH_HL.
130 config IP6_NF_MATCH_IPV6HEADER
131 tristate '"ipv6header" IPv6 Extension Headers Match'
132 default m if NETFILTER_ADVANCED=n
134 This module allows one to match packets based upon
135 the ipv6 extension headers.
137 To compile it as a module, choose M here. If unsure, say N.
139 config IP6_NF_MATCH_MH
140 tristate '"mh" match support'
141 depends on NETFILTER_ADVANCED
143 This module allows one to match MH packets.
145 To compile it as a module, choose M here. If unsure, say N.
147 config IP6_NF_MATCH_RPFILTER
148 tristate '"rpfilter" reverse path filter match support'
149 depends on NETFILTER_ADVANCED
150 depends on IP6_NF_MANGLE || IP6_NF_RAW
152 This option allows you to match packets whose replies would
153 go out via the interface the packet came in.
155 To compile it as a module, choose M here. If unsure, say N.
156 The module will be called ip6t_rpfilter.
158 config IP6_NF_MATCH_RT
159 tristate '"rt" Routing header match support'
160 depends on NETFILTER_ADVANCED
162 rt matching allows you to match packets based on the routing
163 header of the packet.
165 To compile it as a module, choose M here. If unsure, say N.
167 config IP6_NF_MATCH_SRH
168 tristate '"srh" Segment Routing header match support'
169 depends on NETFILTER_ADVANCED
171 srh matching allows you to match packets based on the segment
172 routing header of the packet.
174 To compile it as a module, choose M here. If unsure, say N.
177 config IP6_NF_TARGET_HL
178 tristate '"HL" hoplimit target support'
179 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
180 select NETFILTER_XT_TARGET_HL
182 This is a backwards-compatible option for the user's convenience
183 (e.g. when running oldconfig). It selects
184 CONFIG_NETFILTER_XT_TARGET_HL.
187 tristate "Packet filtering"
188 default m if NETFILTER_ADVANCED=n
190 Packet filtering defines a table `filter', which has a series of
191 rules for simple packet filtering at local input, forwarding and
192 local output. See the man page for iptables(8).
194 To compile it as a module, choose M here. If unsure, say N.
196 config IP6_NF_TARGET_REJECT
197 tristate "REJECT target support"
198 depends on IP6_NF_FILTER
199 select NF_REJECT_IPV6
200 default m if NETFILTER_ADVANCED=n
202 The REJECT target allows a filtering rule to specify that an ICMPv6
203 error should be issued in response to an incoming packet, rather
204 than silently being dropped.
206 To compile it as a module, choose M here. If unsure, say N.
208 config IP6_NF_TARGET_SYNPROXY
209 tristate "SYNPROXY target support"
210 depends on NF_CONNTRACK && NETFILTER_ADVANCED
211 select NETFILTER_SYNPROXY
214 The SYNPROXY target allows you to intercept TCP connections and
215 establish them using syncookies before they are passed on to the
216 server. This allows to avoid conntrack and server resource usage
217 during SYN-flood attacks.
219 To compile it as a module, choose M here. If unsure, say N.
222 tristate "Packet mangling"
223 default m if NETFILTER_ADVANCED=n
225 This option adds a `mangle' table to iptables: see the man page for
226 iptables(8). This table is used for various packet alterations
227 which can effect how the packet is routed.
229 To compile it as a module, choose M here. If unsure, say N.
232 tristate 'raw table support (required for TRACE)'
234 This option adds a `raw' table to ip6tables. This table is the very
235 first in the netfilter framework and hooks in at the PREROUTING
238 If you want to compile it as a module, say M here and read
239 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
241 # security table for MAC policy
242 config IP6_NF_SECURITY
243 tristate "Security table"
245 depends on NETFILTER_ADVANCED
247 This option adds a `security' table to iptables, for use
248 with Mandatory Access Control (MAC) policy.
253 tristate "ip6tables NAT support"
254 depends on NF_CONNTRACK
255 depends on NETFILTER_ADVANCED
257 select NETFILTER_XT_NAT
259 This enables the `nat' table in ip6tables. This allows masquerading,
260 port forwarding and other forms of full Network Address Port
263 To compile it as a module, choose M here. If unsure, say N.
267 config IP6_NF_TARGET_MASQUERADE
268 tristate "MASQUERADE target support"
269 select NETFILTER_XT_TARGET_MASQUERADE
271 This is a backwards-compat option for the user's convenience
272 (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE.
274 config IP6_NF_TARGET_NPT
275 tristate "NPT (Network Prefix translation) target support"
277 This option adds the `SNPT' and `DNPT' target, which perform
278 stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
280 To compile it as a module, choose M here. If unsure, say N.
284 endif # IP6_NF_IPTABLES
287 config NF_DEFRAG_IPV6