2 # IP netfilter configuration
5 menu "IP: Netfilter Configuration"
6 depends on INET && NETFILTER
8 config NF_CONNTRACK_IPV4
9 tristate "IPv4 support for new connection tracking (EXPERIMENTAL)"
10 depends on EXPERIMENTAL && NF_CONNTRACK
12 Connection tracking keeps a record of what packets have passed
13 through your machine, in order to figure out how they are related
16 This is IPv4 support on Layer 3 independent connection tracking.
17 Layer 3 independent connection tracking is experimental scheme
18 which generalize ip_conntrack to support other layer 3 protocols.
20 To compile it as a module, choose M here. If unsure, say N.
22 config NF_CONNTRACK_PROC_COMPAT
23 bool "proc/sysctl compatibility with old connection tracking"
24 depends on NF_CONNTRACK
27 This option enables /proc and sysctl compatibility with the old
28 layer 3 dependant connection tracking. This is needed to keep
29 old programs that have not been adapted to the new names working.
33 # connection tracking, helpers and protocols
34 config IP_NF_CONNTRACK
35 tristate "Connection tracking (required for masq/NAT)"
37 Connection tracking keeps a record of what packets have passed
38 through your machine, in order to figure out how they are related
41 This is required to do Masquerading or other kinds of Network
42 Address Translation (except for Fast NAT). It can also be used to
43 enhance packet filtering (see `Connection state match support'
46 To compile it as a module, choose M here. If unsure, say N.
49 bool "Connection tracking flow accounting"
50 depends on IP_NF_CONNTRACK
52 If this option is enabled, the connection tracking code will
53 keep per-flow packet and byte counters.
55 Those counters can be used for flow-based accounting or the
60 config IP_NF_CONNTRACK_MARK
61 bool 'Connection mark tracking support'
62 depends on IP_NF_CONNTRACK
64 This option enables support for connection marks, used by the
65 `CONNMARK' target and `connmark' match. Similar to the mark value
66 of packets, but this mark value is kept in the conntrack session
67 instead of the individual packets.
69 config IP_NF_CONNTRACK_SECMARK
70 bool 'Connection tracking security mark support'
71 depends on IP_NF_CONNTRACK && NETWORK_SECMARK
73 This option enables security markings to be applied to
74 connections. Typically they are copied to connections from
75 packets using the CONNSECMARK target and copied back from
76 connections to packets with the same target, with the packets
77 being originally labeled via SECMARK.
81 config IP_NF_CONNTRACK_EVENTS
82 bool "Connection tracking events (EXPERIMENTAL)"
83 depends on EXPERIMENTAL && IP_NF_CONNTRACK
85 If this option is enabled, the connection tracking code will
86 provide a notifier chain that can be used by other kernel code
87 to get notified about changes in the connection tracking state.
91 config IP_NF_CONNTRACK_NETLINK
92 tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
93 depends on EXPERIMENTAL && IP_NF_CONNTRACK && NETFILTER_NETLINK
94 depends on IP_NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
95 depends on IP_NF_NAT=n || IP_NF_NAT
97 This option enables support for a netlink-based userspace interface
100 config IP_NF_CT_PROTO_SCTP
101 tristate 'SCTP protocol connection tracking support (EXPERIMENTAL)'
102 depends on IP_NF_CONNTRACK && EXPERIMENTAL
104 With this option enabled, the connection tracking code will
105 be able to do state tracking on SCTP connections.
107 If you want to compile it as a module, say M here and read
108 <file:Documentation/modules.txt>. If unsure, say `N'.
111 tristate "FTP protocol support"
112 depends on IP_NF_CONNTRACK
114 Tracking FTP connections is problematic: special helpers are
115 required for tracking them, and doing masquerading and other forms
116 of Network Address Translation on them.
118 To compile it as a module, choose M here. If unsure, say Y.
121 tristate "IRC protocol support"
122 depends on IP_NF_CONNTRACK
124 There is a commonly-used extension to IRC called
125 Direct Client-to-Client Protocol (DCC). This enables users to send
126 files to each other, and also chat to each other without the need
127 of a server. DCC Sending is used anywhere you send files over IRC,
128 and DCC Chat is most commonly used by Eggdrop bots. If you are
129 using NAT, this extension will enable you to send files and initiate
130 chats. Note that you do NOT need this extension to get files or
131 have others initiate chats, or everything else in IRC.
133 To compile it as a module, choose M here. If unsure, say Y.
135 config IP_NF_NETBIOS_NS
136 tristate "NetBIOS name service protocol support (EXPERIMENTAL)"
137 depends on IP_NF_CONNTRACK && EXPERIMENTAL
139 NetBIOS name service requests are sent as broadcast messages from an
140 unprivileged port and responded to with unicast messages to the
141 same port. This make them hard to firewall properly because connection
142 tracking doesn't deal with broadcasts. This helper tracks locally
143 originating NetBIOS name service requests and the corresponding
144 responses. It relies on correct IP address configuration, specifically
145 netmask and broadcast address. When properly configured, the output
146 of "ip address show" should look similar to this:
148 $ ip -4 address show eth0
149 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
150 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
152 To compile it as a module, choose M here. If unsure, say N.
155 tristate "TFTP protocol support"
156 depends on IP_NF_CONNTRACK
158 TFTP connection tracking helper, this is required depending
159 on how restrictive your ruleset is.
160 If you are using a tftp client behind -j SNAT or -j MASQUERADING
163 To compile it as a module, choose M here. If unsure, say Y.
166 tristate "Amanda backup protocol support"
167 depends on IP_NF_CONNTRACK
169 select TEXTSEARCH_KMP
171 If you are running the Amanda backup package <http://www.amanda.org/>
172 on this machine or machines that will be MASQUERADED through this
173 machine, then you may want to enable this feature. This allows the
174 connection tracking and natting code to allow the sub-channels that
175 Amanda requires for communication of the backup data, messages and
178 To compile it as a module, choose M here. If unsure, say Y.
181 tristate 'PPTP protocol support'
182 depends on IP_NF_CONNTRACK
184 This module adds support for PPTP (Point to Point Tunnelling
185 Protocol, RFC2637) connection tracking and NAT.
187 If you are running PPTP sessions over a stateful firewall or NAT
188 box, you may want to enable this feature.
190 Please note that not all PPTP modes of operation are supported yet.
191 For more info, read top of the file
192 net/ipv4/netfilter/ip_conntrack_pptp.c
194 If you want to compile it as a module, say M here and read
195 Documentation/modules.txt. If unsure, say `N'.
198 tristate 'H.323 protocol support (EXPERIMENTAL)'
199 depends on IP_NF_CONNTRACK && EXPERIMENTAL
201 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
202 important VoIP protocols, it is widely used by voice hardware and
203 software including voice gateways, IP phones, Netmeeting, OpenPhone,
206 With this module you can support H.323 on a connection tracking/NAT
209 This module supports RAS, Fast Start, H.245 Tunnelling, Call
210 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
211 whiteboard, file transfer, etc. For more information, please
212 visit http://nath323.sourceforge.net/.
214 If you want to compile it as a module, say 'M' here and read
215 Documentation/modules.txt. If unsure, say 'N'.
218 tristate "SIP protocol support (EXPERIMENTAL)"
219 depends on IP_NF_CONNTRACK && EXPERIMENTAL
221 SIP is an application-layer control protocol that can establish,
222 modify, and terminate multimedia sessions (conferences) such as
223 Internet telephony calls. With the ip_conntrack_sip and
224 the ip_nat_sip modules you can support the protocol on a connection
225 tracking/NATing firewall.
227 To compile it as a module, choose M here. If unsure, say Y.
230 tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
232 Netfilter has the ability to queue packets to user space: the
233 netlink device can be used to access them using this driver.
235 This option enables the old IPv4-only "ip_queue" implementation
236 which has been obsoleted by the new "nfnetlink_queue" code (see
237 CONFIG_NETFILTER_NETLINK_QUEUE).
239 To compile it as a module, choose M here. If unsure, say N.
241 config IP_NF_IPTABLES
242 tristate "IP tables support (required for filtering/masq/NAT)"
243 depends on NETFILTER_XTABLES
245 iptables is a general, extensible packet identification framework.
246 The packet filtering and full NAT (masquerading, port forwarding,
247 etc) subsystems now use this: say `Y' or `M' here if you want to use
250 To compile it as a module, choose M here. If unsure, say N.
253 config IP_NF_MATCH_IPRANGE
254 tristate "IP range match support"
255 depends on IP_NF_IPTABLES
257 This option makes possible to match IP addresses against IP address
260 To compile it as a module, choose M here. If unsure, say N.
262 config IP_NF_MATCH_TOS
263 tristate "TOS match support"
264 depends on IP_NF_IPTABLES
266 TOS matching allows you to match packets based on the Type Of
267 Service fields of the IP packet.
269 To compile it as a module, choose M here. If unsure, say N.
271 config IP_NF_MATCH_RECENT
272 tristate "recent match support"
273 depends on IP_NF_IPTABLES
275 This match is used for creating one or many lists of recently
276 used addresses and then matching against that/those list(s).
278 Short options are available by using 'iptables -m recent -h'
279 Official Website: <http://snowman.net/projects/ipt_recent/>
281 To compile it as a module, choose M here. If unsure, say N.
283 config IP_NF_MATCH_ECN
284 tristate "ECN match support"
285 depends on IP_NF_IPTABLES
287 This option adds a `ECN' match, which allows you to match against
288 the IPv4 and TCP header ECN fields.
290 To compile it as a module, choose M here. If unsure, say N.
292 config IP_NF_MATCH_AH
293 tristate "AH match support"
294 depends on IP_NF_IPTABLES
296 This match extension allows you to match a range of SPIs
297 inside AH header of IPSec packets.
299 To compile it as a module, choose M here. If unsure, say N.
301 config IP_NF_MATCH_TTL
302 tristate "TTL match support"
303 depends on IP_NF_IPTABLES
305 This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
306 to match packets by their TTL value.
308 To compile it as a module, choose M here. If unsure, say N.
310 config IP_NF_MATCH_OWNER
311 tristate "Owner match support"
312 depends on IP_NF_IPTABLES
314 Packet owner matching allows you to match locally-generated packets
315 based on who created them: the user, group, process or session.
317 To compile it as a module, choose M here. If unsure, say N.
319 config IP_NF_MATCH_ADDRTYPE
320 tristate 'address type match support'
321 depends on IP_NF_IPTABLES
323 This option allows you to match what routing thinks of an address,
324 eg. UNICAST, LOCAL, BROADCAST, ...
326 If you want to compile it as a module, say M here and read
327 <file:Documentation/modules.txt>. If unsure, say `N'.
329 config IP_NF_MATCH_HASHLIMIT
330 tristate 'hashlimit match support'
331 depends on IP_NF_IPTABLES
333 This option adds a new iptables `hashlimit' match.
335 As opposed to `limit', this match dynamically creates a hash table
336 of limit buckets, based on your selection of source/destination
337 ip addresses and/or ports.
339 It enables you to express policies like `10kpps for any given
340 destination IP' or `500pps from any given source IP' with a single
343 # `filter', generic and specific targets
345 tristate "Packet filtering"
346 depends on IP_NF_IPTABLES
348 Packet filtering defines a table `filter', which has a series of
349 rules for simple packet filtering at local input, forwarding and
350 local output. See the man page for iptables(8).
352 To compile it as a module, choose M here. If unsure, say N.
354 config IP_NF_TARGET_REJECT
355 tristate "REJECT target support"
356 depends on IP_NF_FILTER
358 The REJECT target allows a filtering rule to specify that an ICMP
359 error should be issued in response to an incoming packet, rather
360 than silently being dropped.
362 To compile it as a module, choose M here. If unsure, say N.
364 config IP_NF_TARGET_LOG
365 tristate "LOG target support"
366 depends on IP_NF_IPTABLES
368 This option adds a `LOG' target, which allows you to create rules in
369 any iptables table which records the packet header to the syslog.
371 To compile it as a module, choose M here. If unsure, say N.
373 config IP_NF_TARGET_ULOG
374 tristate "ULOG target support"
375 depends on IP_NF_IPTABLES
378 This option enables the old IPv4-only "ipt_ULOG" implementation
379 which has been obsoleted by the new "nfnetlink_log" code (see
380 CONFIG_NETFILTER_NETLINK_LOG).
382 This option adds a `ULOG' target, which allows you to create rules in
383 any iptables table. The packet is passed to a userspace logging
384 daemon using netlink multicast sockets; unlike the LOG target
385 which can only be viewed through syslog.
387 The appropriate userspace logging daemon (ulogd) may be obtained from
388 <http://www.gnumonks.org/projects/ulogd/>
390 To compile it as a module, choose M here. If unsure, say N.
392 config IP_NF_TARGET_TCPMSS
393 tristate "TCPMSS target support"
394 depends on IP_NF_IPTABLES
396 This option adds a `TCPMSS' target, which allows you to alter the
397 MSS value of TCP SYN packets, to control the maximum size for that
398 connection (usually limiting it to your outgoing interface's MTU
401 This is used to overcome criminally braindead ISPs or servers which
402 block ICMP Fragmentation Needed packets. The symptoms of this
403 problem are that everything works fine from your Linux
404 firewall/router, but machines behind it can never exchange large
406 1) Web browsers connect, then hang with no data received.
407 2) Small mail works fine, but large emails hang.
408 3) ssh works fine, but scp hangs after initial handshaking.
410 Workaround: activate this option and add a rule to your firewall
413 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
414 -j TCPMSS --clamp-mss-to-pmtu
416 To compile it as a module, choose M here. If unsure, say N.
418 # NAT + specific targets
421 depends on IP_NF_IPTABLES && IP_NF_CONNTRACK
423 The Full NAT option allows masquerading, port forwarding and other
424 forms of full Network Address Port Translation. It is controlled by
425 the `nat' table in iptables: see the man page for iptables(8).
427 To compile it as a module, choose M here. If unsure, say N.
429 config IP_NF_NAT_NEEDED
431 depends on IP_NF_NAT != n
434 config IP_NF_TARGET_MASQUERADE
435 tristate "MASQUERADE target support"
438 Masquerading is a special case of NAT: all outgoing connections are
439 changed to seem to come from a particular interface's address, and
440 if the interface goes down, those connections are lost. This is
441 only useful for dialup accounts with dynamic IP address (ie. your IP
442 address will be different on next dialup).
444 To compile it as a module, choose M here. If unsure, say N.
446 config IP_NF_TARGET_REDIRECT
447 tristate "REDIRECT target support"
450 REDIRECT is a special case of NAT: all incoming connections are
451 mapped onto the incoming interface's address, causing the packets to
452 come to the local machine instead of passing through. This is
453 useful for transparent proxies.
455 To compile it as a module, choose M here. If unsure, say N.
457 config IP_NF_TARGET_NETMAP
458 tristate "NETMAP target support"
461 NETMAP is an implementation of static 1:1 NAT mapping of network
462 addresses. It maps the network address part, while keeping the host
463 address part intact. It is similar to Fast NAT, except that
464 Netfilter's connection tracking doesn't work well with Fast NAT.
466 To compile it as a module, choose M here. If unsure, say N.
468 config IP_NF_TARGET_SAME
469 tristate "SAME target support"
472 This option adds a `SAME' target, which works like the standard SNAT
473 target, but attempts to give clients the same IP for all connections.
475 To compile it as a module, choose M here. If unsure, say N.
477 config IP_NF_NAT_SNMP_BASIC
478 tristate "Basic SNMP-ALG support (EXPERIMENTAL)"
479 depends on EXPERIMENTAL && IP_NF_NAT
482 This module implements an Application Layer Gateway (ALG) for
483 SNMP payloads. In conjunction with NAT, it allows a network
484 management system to access multiple private networks with
485 conflicting addresses. It works by modifying IP addresses
486 inside SNMP payloads to match IP-layer NAT mapping.
488 This is the "basic" form of SNMP-ALG, as described in RFC 2962
490 To compile it as a module, choose M here. If unsure, say N.
494 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
495 default IP_NF_NAT if IP_NF_IRC=y
496 default m if IP_NF_IRC=m
498 # If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
499 # or $CONFIG_IP_NF_FTP (m or y), whichever is weaker. Argh.
502 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
503 default IP_NF_NAT if IP_NF_FTP=y
504 default m if IP_NF_FTP=m
506 config IP_NF_NAT_TFTP
508 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
509 default IP_NF_NAT if IP_NF_TFTP=y
510 default m if IP_NF_TFTP=m
512 config IP_NF_NAT_AMANDA
514 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
515 default IP_NF_NAT if IP_NF_AMANDA=y
516 default m if IP_NF_AMANDA=m
518 config IP_NF_NAT_PPTP
520 depends on IP_NF_NAT!=n && IP_NF_PPTP!=n
521 default IP_NF_NAT if IP_NF_PPTP=y
522 default m if IP_NF_PPTP=m
524 config IP_NF_NAT_H323
526 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
527 default IP_NF_NAT if IP_NF_H323=y
528 default m if IP_NF_H323=m
532 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
533 default IP_NF_NAT if IP_NF_SIP=y
534 default m if IP_NF_SIP=m
536 # mangle + specific targets
538 tristate "Packet mangling"
539 depends on IP_NF_IPTABLES
541 This option adds a `mangle' table to iptables: see the man page for
542 iptables(8). This table is used for various packet alterations
543 which can effect how the packet is routed.
545 To compile it as a module, choose M here. If unsure, say N.
547 config IP_NF_TARGET_TOS
548 tristate "TOS target support"
549 depends on IP_NF_MANGLE
551 This option adds a `TOS' target, which allows you to create rules in
552 the `mangle' table which alter the Type Of Service field of an IP
553 packet prior to routing.
555 To compile it as a module, choose M here. If unsure, say N.
557 config IP_NF_TARGET_ECN
558 tristate "ECN target support"
559 depends on IP_NF_MANGLE
561 This option adds a `ECN' target, which can be used in the iptables mangle
564 You can use this target to remove the ECN bits from the IPv4 header of
565 an IP packet. This is particularly useful, if you need to work around
566 existing ECN blackholes on the internet, but don't want to disable
567 ECN support in general.
569 To compile it as a module, choose M here. If unsure, say N.
571 config IP_NF_TARGET_TTL
572 tristate 'TTL target support'
573 depends on IP_NF_MANGLE
575 This option adds a `TTL' target, which enables the user to modify
576 the TTL value of the IP header.
578 While it is safe to decrement/lower the TTL, this target also enables
579 functionality to increment and set the TTL value of the IP header to
580 arbitrary values. This is EXTREMELY DANGEROUS since you can easily
581 create immortal packets that loop forever on the network.
583 To compile it as a module, choose M here. If unsure, say N.
585 config IP_NF_TARGET_CLUSTERIP
586 tristate "CLUSTERIP target support (EXPERIMENTAL)"
587 depends on IP_NF_MANGLE && EXPERIMENTAL
588 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK_IPV4)
590 The CLUSTERIP target allows you to build load-balancing clusters of
591 network servers without having a dedicated load-balancing
592 router/server/switch.
594 To compile it as a module, choose M here. If unsure, say N.
596 # raw + specific targets
598 tristate 'raw table support (required for NOTRACK/TRACE)'
599 depends on IP_NF_IPTABLES
601 This option adds a `raw' table to iptables. This table is the very
602 first in the netfilter framework and hooks in at the PREROUTING
605 If you want to compile it as a module, say M here and read
606 <file:Documentation/modules.txt>. If unsure, say `N'.
609 config IP_NF_ARPTABLES
610 tristate "ARP tables support"
611 depends on NETFILTER_XTABLES
613 arptables is a general, extensible packet identification framework.
614 The ARP packet filtering and mangling (manipulation)subsystems
615 use this: say Y or M here if you want to use either of those.
617 To compile it as a module, choose M here. If unsure, say N.
619 config IP_NF_ARPFILTER
620 tristate "ARP packet filtering"
621 depends on IP_NF_ARPTABLES
623 ARP packet filtering defines a table `filter', which has a series of
624 rules for simple ARP packet filtering at local input and
625 local output. On a bridge, you can also specify filtering rules
626 for forwarded ARP packets. See the man page for arptables(8).
628 To compile it as a module, choose M here. If unsure, say N.
630 config IP_NF_ARP_MANGLE
631 tristate "ARP payload mangling"
632 depends on IP_NF_ARPTABLES
634 Allows altering the ARP packet payload: source and destination
635 hardware and network addresses.