2 # IP netfilter configuration
5 menu "IP: Netfilter Configuration"
6 depends on INET && NETFILTER
8 config NF_CONNTRACK_IPV4
9 tristate "IPv4 support for new connection tracking (EXPERIMENTAL)"
10 depends on EXPERIMENTAL && NF_CONNTRACK
12 Connection tracking keeps a record of what packets have passed
13 through your machine, in order to figure out how they are related
16 This is IPv4 support on Layer 3 independent connection tracking.
17 Layer 3 independent connection tracking is experimental scheme
18 which generalize ip_conntrack to support other layer 3 protocols.
20 To compile it as a module, choose M here. If unsure, say N.
22 config NF_CONNTRACK_PROC_COMPAT
23 bool "proc/sysctl compatibility with old connection tracking"
24 depends on NF_CONNTRACK
27 This option enables /proc and sysctl compatibility with the old
28 layer 3 dependant connection tracking. This is needed to keep
29 old programs that have not been adapted to the new names working.
33 # connection tracking, helpers and protocols
34 config IP_NF_CONNTRACK
35 tristate "Connection tracking (required for masq/NAT)"
37 Connection tracking keeps a record of what packets have passed
38 through your machine, in order to figure out how they are related
41 This is required to do Masquerading or other kinds of Network
42 Address Translation (except for Fast NAT). It can also be used to
43 enhance packet filtering (see `Connection state match support'
46 To compile it as a module, choose M here. If unsure, say N.
49 bool "Connection tracking flow accounting"
50 depends on IP_NF_CONNTRACK
52 If this option is enabled, the connection tracking code will
53 keep per-flow packet and byte counters.
55 Those counters can be used for flow-based accounting or the
60 config IP_NF_CONNTRACK_MARK
61 bool 'Connection mark tracking support'
62 depends on IP_NF_CONNTRACK
64 This option enables support for connection marks, used by the
65 `CONNMARK' target and `connmark' match. Similar to the mark value
66 of packets, but this mark value is kept in the conntrack session
67 instead of the individual packets.
69 config IP_NF_CONNTRACK_SECMARK
70 bool 'Connection tracking security mark support'
71 depends on IP_NF_CONNTRACK && NETWORK_SECMARK
73 This option enables security markings to be applied to
74 connections. Typically they are copied to connections from
75 packets using the CONNSECMARK target and copied back from
76 connections to packets with the same target, with the packets
77 being originally labeled via SECMARK.
81 config IP_NF_CONNTRACK_EVENTS
82 bool "Connection tracking events (EXPERIMENTAL)"
83 depends on EXPERIMENTAL && IP_NF_CONNTRACK
85 If this option is enabled, the connection tracking code will
86 provide a notifier chain that can be used by other kernel code
87 to get notified about changes in the connection tracking state.
91 config IP_NF_CONNTRACK_NETLINK
92 tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
93 depends on EXPERIMENTAL && IP_NF_CONNTRACK && NETFILTER_NETLINK
94 depends on IP_NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
95 depends on IP_NF_NAT=n || IP_NF_NAT
97 This option enables support for a netlink-based userspace interface
100 config IP_NF_CT_PROTO_SCTP
101 tristate 'SCTP protocol connection tracking support (EXPERIMENTAL)'
102 depends on IP_NF_CONNTRACK && EXPERIMENTAL
104 With this option enabled, the connection tracking code will
105 be able to do state tracking on SCTP connections.
107 If you want to compile it as a module, say M here and read
108 <file:Documentation/modules.txt>. If unsure, say `N'.
111 tristate "FTP protocol support"
112 depends on IP_NF_CONNTRACK
114 Tracking FTP connections is problematic: special helpers are
115 required for tracking them, and doing masquerading and other forms
116 of Network Address Translation on them.
118 To compile it as a module, choose M here. If unsure, say Y.
121 tristate "IRC protocol support"
122 depends on IP_NF_CONNTRACK
124 There is a commonly-used extension to IRC called
125 Direct Client-to-Client Protocol (DCC). This enables users to send
126 files to each other, and also chat to each other without the need
127 of a server. DCC Sending is used anywhere you send files over IRC,
128 and DCC Chat is most commonly used by Eggdrop bots. If you are
129 using NAT, this extension will enable you to send files and initiate
130 chats. Note that you do NOT need this extension to get files or
131 have others initiate chats, or everything else in IRC.
133 To compile it as a module, choose M here. If unsure, say Y.
135 config IP_NF_NETBIOS_NS
136 tristate "NetBIOS name service protocol support (EXPERIMENTAL)"
137 depends on IP_NF_CONNTRACK && EXPERIMENTAL
139 NetBIOS name service requests are sent as broadcast messages from an
140 unprivileged port and responded to with unicast messages to the
141 same port. This make them hard to firewall properly because connection
142 tracking doesn't deal with broadcasts. This helper tracks locally
143 originating NetBIOS name service requests and the corresponding
144 responses. It relies on correct IP address configuration, specifically
145 netmask and broadcast address. When properly configured, the output
146 of "ip address show" should look similar to this:
148 $ ip -4 address show eth0
149 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
150 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
152 To compile it as a module, choose M here. If unsure, say N.
155 tristate "TFTP protocol support"
156 depends on IP_NF_CONNTRACK
158 TFTP connection tracking helper, this is required depending
159 on how restrictive your ruleset is.
160 If you are using a tftp client behind -j SNAT or -j MASQUERADING
163 To compile it as a module, choose M here. If unsure, say Y.
166 tristate "Amanda backup protocol support"
167 depends on IP_NF_CONNTRACK
169 select TEXTSEARCH_KMP
171 If you are running the Amanda backup package <http://www.amanda.org/>
172 on this machine or machines that will be MASQUERADED through this
173 machine, then you may want to enable this feature. This allows the
174 connection tracking and natting code to allow the sub-channels that
175 Amanda requires for communication of the backup data, messages and
178 To compile it as a module, choose M here. If unsure, say Y.
181 tristate 'PPTP protocol support'
182 depends on IP_NF_CONNTRACK
184 This module adds support for PPTP (Point to Point Tunnelling
185 Protocol, RFC2637) connection tracking and NAT.
187 If you are running PPTP sessions over a stateful firewall or NAT
188 box, you may want to enable this feature.
190 Please note that not all PPTP modes of operation are supported yet.
191 For more info, read top of the file
192 net/ipv4/netfilter/ip_conntrack_pptp.c
194 If you want to compile it as a module, say M here and read
195 Documentation/modules.txt. If unsure, say `N'.
198 tristate 'H.323 protocol support (EXPERIMENTAL)'
199 depends on IP_NF_CONNTRACK && EXPERIMENTAL
201 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
202 important VoIP protocols, it is widely used by voice hardware and
203 software including voice gateways, IP phones, Netmeeting, OpenPhone,
206 With this module you can support H.323 on a connection tracking/NAT
209 This module supports RAS, Fast Start, H.245 Tunnelling, Call
210 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
211 whiteboard, file transfer, etc. For more information, please
212 visit http://nath323.sourceforge.net/.
214 If you want to compile it as a module, say 'M' here and read
215 Documentation/modules.txt. If unsure, say 'N'.
218 tristate "SIP protocol support (EXPERIMENTAL)"
219 depends on IP_NF_CONNTRACK && EXPERIMENTAL
221 SIP is an application-layer control protocol that can establish,
222 modify, and terminate multimedia sessions (conferences) such as
223 Internet telephony calls. With the ip_conntrack_sip and
224 the ip_nat_sip modules you can support the protocol on a connection
225 tracking/NATing firewall.
227 To compile it as a module, choose M here. If unsure, say Y.
230 tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
232 Netfilter has the ability to queue packets to user space: the
233 netlink device can be used to access them using this driver.
235 This option enables the old IPv4-only "ip_queue" implementation
236 which has been obsoleted by the new "nfnetlink_queue" code (see
237 CONFIG_NETFILTER_NETLINK_QUEUE).
239 To compile it as a module, choose M here. If unsure, say N.
241 config IP_NF_IPTABLES
242 tristate "IP tables support (required for filtering/masq/NAT)"
243 depends on NETFILTER_XTABLES
245 iptables is a general, extensible packet identification framework.
246 The packet filtering and full NAT (masquerading, port forwarding,
247 etc) subsystems now use this: say `Y' or `M' here if you want to use
250 To compile it as a module, choose M here. If unsure, say N.
253 config IP_NF_MATCH_IPRANGE
254 tristate "IP range match support"
255 depends on IP_NF_IPTABLES
257 This option makes possible to match IP addresses against IP address
260 To compile it as a module, choose M here. If unsure, say N.
262 config IP_NF_MATCH_TOS
263 tristate "TOS match support"
264 depends on IP_NF_IPTABLES
266 TOS matching allows you to match packets based on the Type Of
267 Service fields of the IP packet.
269 To compile it as a module, choose M here. If unsure, say N.
271 config IP_NF_MATCH_RECENT
272 tristate "recent match support"
273 depends on IP_NF_IPTABLES
275 This match is used for creating one or many lists of recently
276 used addresses and then matching against that/those list(s).
278 Short options are available by using 'iptables -m recent -h'
279 Official Website: <http://snowman.net/projects/ipt_recent/>
281 To compile it as a module, choose M here. If unsure, say N.
283 config IP_NF_MATCH_ECN
284 tristate "ECN match support"
285 depends on IP_NF_IPTABLES
287 This option adds a `ECN' match, which allows you to match against
288 the IPv4 and TCP header ECN fields.
290 To compile it as a module, choose M here. If unsure, say N.
292 config IP_NF_MATCH_AH
293 tristate "AH match support"
294 depends on IP_NF_IPTABLES
296 This match extension allows you to match a range of SPIs
297 inside AH header of IPSec packets.
299 To compile it as a module, choose M here. If unsure, say N.
301 config IP_NF_MATCH_TTL
302 tristate "TTL match support"
303 depends on IP_NF_IPTABLES
305 This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
306 to match packets by their TTL value.
308 To compile it as a module, choose M here. If unsure, say N.
310 config IP_NF_MATCH_OWNER
311 tristate "Owner match support"
312 depends on IP_NF_IPTABLES
314 Packet owner matching allows you to match locally-generated packets
315 based on who created them: the user, group, process or session.
317 To compile it as a module, choose M here. If unsure, say N.
319 config IP_NF_MATCH_ADDRTYPE
320 tristate 'address type match support'
321 depends on IP_NF_IPTABLES
323 This option allows you to match what routing thinks of an address,
324 eg. UNICAST, LOCAL, BROADCAST, ...
326 If you want to compile it as a module, say M here and read
327 <file:Documentation/modules.txt>. If unsure, say `N'.
329 # `filter', generic and specific targets
331 tristate "Packet filtering"
332 depends on IP_NF_IPTABLES
334 Packet filtering defines a table `filter', which has a series of
335 rules for simple packet filtering at local input, forwarding and
336 local output. See the man page for iptables(8).
338 To compile it as a module, choose M here. If unsure, say N.
340 config IP_NF_TARGET_REJECT
341 tristate "REJECT target support"
342 depends on IP_NF_FILTER
344 The REJECT target allows a filtering rule to specify that an ICMP
345 error should be issued in response to an incoming packet, rather
346 than silently being dropped.
348 To compile it as a module, choose M here. If unsure, say N.
350 config IP_NF_TARGET_LOG
351 tristate "LOG target support"
352 depends on IP_NF_IPTABLES
354 This option adds a `LOG' target, which allows you to create rules in
355 any iptables table which records the packet header to the syslog.
357 To compile it as a module, choose M here. If unsure, say N.
359 config IP_NF_TARGET_ULOG
360 tristate "ULOG target support"
361 depends on IP_NF_IPTABLES
364 This option enables the old IPv4-only "ipt_ULOG" implementation
365 which has been obsoleted by the new "nfnetlink_log" code (see
366 CONFIG_NETFILTER_NETLINK_LOG).
368 This option adds a `ULOG' target, which allows you to create rules in
369 any iptables table. The packet is passed to a userspace logging
370 daemon using netlink multicast sockets; unlike the LOG target
371 which can only be viewed through syslog.
373 The appropriate userspace logging daemon (ulogd) may be obtained from
374 <http://www.gnumonks.org/projects/ulogd/>
376 To compile it as a module, choose M here. If unsure, say N.
378 config IP_NF_TARGET_TCPMSS
379 tristate "TCPMSS target support"
380 depends on IP_NF_IPTABLES
382 This option adds a `TCPMSS' target, which allows you to alter the
383 MSS value of TCP SYN packets, to control the maximum size for that
384 connection (usually limiting it to your outgoing interface's MTU
387 This is used to overcome criminally braindead ISPs or servers which
388 block ICMP Fragmentation Needed packets. The symptoms of this
389 problem are that everything works fine from your Linux
390 firewall/router, but machines behind it can never exchange large
392 1) Web browsers connect, then hang with no data received.
393 2) Small mail works fine, but large emails hang.
394 3) ssh works fine, but scp hangs after initial handshaking.
396 Workaround: activate this option and add a rule to your firewall
399 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
400 -j TCPMSS --clamp-mss-to-pmtu
402 To compile it as a module, choose M here. If unsure, say N.
404 # NAT + specific targets
407 depends on IP_NF_IPTABLES && IP_NF_CONNTRACK
409 The Full NAT option allows masquerading, port forwarding and other
410 forms of full Network Address Port Translation. It is controlled by
411 the `nat' table in iptables: see the man page for iptables(8).
413 To compile it as a module, choose M here. If unsure, say N.
415 config IP_NF_NAT_NEEDED
417 depends on IP_NF_NAT != n
420 config IP_NF_TARGET_MASQUERADE
421 tristate "MASQUERADE target support"
424 Masquerading is a special case of NAT: all outgoing connections are
425 changed to seem to come from a particular interface's address, and
426 if the interface goes down, those connections are lost. This is
427 only useful for dialup accounts with dynamic IP address (ie. your IP
428 address will be different on next dialup).
430 To compile it as a module, choose M here. If unsure, say N.
432 config IP_NF_TARGET_REDIRECT
433 tristate "REDIRECT target support"
436 REDIRECT is a special case of NAT: all incoming connections are
437 mapped onto the incoming interface's address, causing the packets to
438 come to the local machine instead of passing through. This is
439 useful for transparent proxies.
441 To compile it as a module, choose M here. If unsure, say N.
443 config IP_NF_TARGET_NETMAP
444 tristate "NETMAP target support"
447 NETMAP is an implementation of static 1:1 NAT mapping of network
448 addresses. It maps the network address part, while keeping the host
449 address part intact. It is similar to Fast NAT, except that
450 Netfilter's connection tracking doesn't work well with Fast NAT.
452 To compile it as a module, choose M here. If unsure, say N.
454 config IP_NF_TARGET_SAME
455 tristate "SAME target support"
458 This option adds a `SAME' target, which works like the standard SNAT
459 target, but attempts to give clients the same IP for all connections.
461 To compile it as a module, choose M here. If unsure, say N.
463 config IP_NF_NAT_SNMP_BASIC
464 tristate "Basic SNMP-ALG support (EXPERIMENTAL)"
465 depends on EXPERIMENTAL && IP_NF_NAT
468 This module implements an Application Layer Gateway (ALG) for
469 SNMP payloads. In conjunction with NAT, it allows a network
470 management system to access multiple private networks with
471 conflicting addresses. It works by modifying IP addresses
472 inside SNMP payloads to match IP-layer NAT mapping.
474 This is the "basic" form of SNMP-ALG, as described in RFC 2962
476 To compile it as a module, choose M here. If unsure, say N.
480 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
481 default IP_NF_NAT if IP_NF_IRC=y
482 default m if IP_NF_IRC=m
484 # If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
485 # or $CONFIG_IP_NF_FTP (m or y), whichever is weaker. Argh.
488 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
489 default IP_NF_NAT if IP_NF_FTP=y
490 default m if IP_NF_FTP=m
492 config IP_NF_NAT_TFTP
494 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
495 default IP_NF_NAT if IP_NF_TFTP=y
496 default m if IP_NF_TFTP=m
498 config IP_NF_NAT_AMANDA
500 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
501 default IP_NF_NAT if IP_NF_AMANDA=y
502 default m if IP_NF_AMANDA=m
504 config IP_NF_NAT_PPTP
506 depends on IP_NF_NAT!=n && IP_NF_PPTP!=n
507 default IP_NF_NAT if IP_NF_PPTP=y
508 default m if IP_NF_PPTP=m
510 config IP_NF_NAT_H323
512 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
513 default IP_NF_NAT if IP_NF_H323=y
514 default m if IP_NF_H323=m
518 depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
519 default IP_NF_NAT if IP_NF_SIP=y
520 default m if IP_NF_SIP=m
522 # mangle + specific targets
524 tristate "Packet mangling"
525 depends on IP_NF_IPTABLES
527 This option adds a `mangle' table to iptables: see the man page for
528 iptables(8). This table is used for various packet alterations
529 which can effect how the packet is routed.
531 To compile it as a module, choose M here. If unsure, say N.
533 config IP_NF_TARGET_TOS
534 tristate "TOS target support"
535 depends on IP_NF_MANGLE
537 This option adds a `TOS' target, which allows you to create rules in
538 the `mangle' table which alter the Type Of Service field of an IP
539 packet prior to routing.
541 To compile it as a module, choose M here. If unsure, say N.
543 config IP_NF_TARGET_ECN
544 tristate "ECN target support"
545 depends on IP_NF_MANGLE
547 This option adds a `ECN' target, which can be used in the iptables mangle
550 You can use this target to remove the ECN bits from the IPv4 header of
551 an IP packet. This is particularly useful, if you need to work around
552 existing ECN blackholes on the internet, but don't want to disable
553 ECN support in general.
555 To compile it as a module, choose M here. If unsure, say N.
557 config IP_NF_TARGET_TTL
558 tristate 'TTL target support'
559 depends on IP_NF_MANGLE
561 This option adds a `TTL' target, which enables the user to modify
562 the TTL value of the IP header.
564 While it is safe to decrement/lower the TTL, this target also enables
565 functionality to increment and set the TTL value of the IP header to
566 arbitrary values. This is EXTREMELY DANGEROUS since you can easily
567 create immortal packets that loop forever on the network.
569 To compile it as a module, choose M here. If unsure, say N.
571 config IP_NF_TARGET_CLUSTERIP
572 tristate "CLUSTERIP target support (EXPERIMENTAL)"
573 depends on IP_NF_MANGLE && EXPERIMENTAL
574 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK_IPV4)
576 The CLUSTERIP target allows you to build load-balancing clusters of
577 network servers without having a dedicated load-balancing
578 router/server/switch.
580 To compile it as a module, choose M here. If unsure, say N.
582 # raw + specific targets
584 tristate 'raw table support (required for NOTRACK/TRACE)'
585 depends on IP_NF_IPTABLES
587 This option adds a `raw' table to iptables. This table is the very
588 first in the netfilter framework and hooks in at the PREROUTING
591 If you want to compile it as a module, say M here and read
592 <file:Documentation/modules.txt>. If unsure, say `N'.
595 config IP_NF_ARPTABLES
596 tristate "ARP tables support"
597 depends on NETFILTER_XTABLES
599 arptables is a general, extensible packet identification framework.
600 The ARP packet filtering and mangling (manipulation)subsystems
601 use this: say Y or M here if you want to use either of those.
603 To compile it as a module, choose M here. If unsure, say N.
605 config IP_NF_ARPFILTER
606 tristate "ARP packet filtering"
607 depends on IP_NF_ARPTABLES
609 ARP packet filtering defines a table `filter', which has a series of
610 rules for simple ARP packet filtering at local input and
611 local output. On a bridge, you can also specify filtering rules
612 for forwarded ARP packets. See the man page for arptables(8).
614 To compile it as a module, choose M here. If unsure, say N.
616 config IP_NF_ARP_MANGLE
617 tristate "ARP payload mangling"
618 depends on IP_NF_ARPTABLES
620 Allows altering the ARP packet payload: source and destination
621 hardware and network addresses.