Config.in.netfilter.ip4 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138
  1. config ADK_KPACKAGE_KMOD_NF_CONNTRACK_IPV4
  2. bool 'IPv4 connection tracking support (required for NAT)'
  3. select ADK_KPACKAGE_KMOD_NF_CONNTRACK
  4. help
  5. Connection tracking keeps a record of what packets have passed
  6. through your machine, in order to figure out how they are related
  7. into connections.
  8. config ADK_KPACKAGE_KMOD_IP_NF_CT_ACCT
  9. bool 'Connection tracking flow accounting'
  10. depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
  11. help
  12. If this option is enabled, the connection tracking code will
  13. keep per-flow packet and byte counters.
  14. Those counters can be used for flow-based accounting or the
  15. `connbytes' match.
  16. config ADK_KPACKAGE_KMOD_IP_NF_IPTABLES
  17. tristate 'IP tables support (required for filtering/masq/NAT)'
  18. select ADK_KERNEL_NETFILTER_XTABLES
  19. help
  20. iptables is a general, extensible packet identification framework.
  21. The packet filtering and full NAT (masquerading, port forwarding,
  22. etc) subsystems now use this: say `Y' or `M' here if you want to use
  23. either of those.
  24. config ADK_KPACKAGE_KMOD_IP_NF_FILTER
  25. tristate 'Packet Filtering'
  26. depends on ADK_KPACKAGE_KMOD_IP_NF_IPTABLES
  27. help
  28. Packet filtering defines a table `filter', which has a series of
  29. rules for simple packet filtering at local input, forwarding and
  30. local output. See the man page for iptables(8).
  31. config ADK_KPACKAGE_KMOD_FULL_NAT
  32. tristate "Meta package for Full NAT"
  33. select ADK_KPACKAGE_KMOD_NF_NAT if ADK_KERNEL_VERSION_3_4_87
  34. select ADK_KPACKAGE_KMOD_NF_NAT_IPV4 if ADK_KERNEL_VERSION_3_10_37
  35. select ADK_KPACKAGE_KMOD_NF_NAT_IPV4 if ADK_KERNEL_VERSION_3_11_10
  36. select ADK_KPACKAGE_KMOD_NF_NAT_IPV4 if ADK_KERNEL_VERSION_3_12_18
  37. select ADK_KPACKAGE_KMOD_NF_NAT_IPV4 if ADK_KERNEL_VERSION_3_13_11
  38. select ADK_KPACKAGE_KMOD_NF_NAT_IPV4 if ADK_KERNEL_VERSION_3_14_1
  39. config ADK_KPACKAGE_KMOD_NF_NAT
  40. tristate 'Full NAT'
  41. depends on ADK_KPACKAGE_KMOD_IP_NF_IPTABLES
  42. depends on ADK_KERNEL_VERSION_3_4_87
  43. help
  44. The Full NAT option allows masquerading, port forwarding and other
  45. forms of full Network Address Port Translation. It is controlled by
  46. the `nat' table in iptables: see the man page for iptables(8).
  47. config ADK_KPACKAGE_KMOD_NF_NAT_IPV4
  48. tristate 'Full NAT'
  49. depends on ADK_KPACKAGE_KMOD_IP_NF_IPTABLES
  50. depends on ADK_KERNEL_VERSION_3_10_37 \
  51. || ADK_KERNEL_VERSION_3_11_10 \
  52. || ADK_KERNEL_VERSION_3_12_18 \
  53. || ADK_KERNEL_VERSION_3_13_11 \
  54. || ADK_KERNEL_VERSION_3_14_1
  55. help
  56. The Full NAT option allows masquerading, port forwarding and other
  57. forms of full Network Address Port Translation. It is controlled by
  58. the `nat' table in iptables: see the man page for iptables(8).
  59. config ADK_KPACKAGE_KMOD_IP_NF_TARGET_MASQUERADE
  60. tristate 'MASQUERADE target support'
  61. depends on ADK_KPACKAGE_KMOD_FULL_NAT
  62. help
  63. Masquerading is a special case of NAT: all outgoing connections are
  64. changed to seem to come from a particular interface's address, and
  65. if the interface goes down, those connections are lost. This is
  66. only useful for dialup accounts with dynamic IP address (ie. your IP
  67. address will be different on next dialup).
  68. config ADK_KPACKAGE_KMOD_IP_NF_TARGET_REJECT
  69. tristate 'REJECT target support'
  70. depends on ADK_KPACKAGE_KMOD_IP_NF_FILTER
  71. help
  72. The REJECT target allows a filtering rule to specify that an ICMP
  73. error should be issued in response to an incoming packet, rather
  74. than silently being dropped.
  75. config ADK_KPACKAGE_KMOD_IP_NF_TARGET_ULOG
  76. tristate 'ULOG target support (ipv4 only)'
  77. depends on ADK_KPACKAGE_KMOD_IP_NF_FILTER
  78. help
  79. This option enables the old IPv4-only "ipt_ULOG" implementation
  80. which has been obsoleted by the new "nfnetlink_log" code (see
  81. CONFIG_NETFILTER_NETLINK_LOG).
  82. This option adds a `ULOG' target, which allows you to create rules in
  83. any iptables table. The packet is passed to a userspace logging
  84. daemon using netlink multicast sockets; unlike the LOG target
  85. which can only be viewed through syslog.
  86. The appropriate userspace logging daemon (ulogd) may be obtained from
  87. <http://www.gnumonks.org/projects/ulogd/>
  88. config ADK_KPACKAGE_KMOD_IP_NF_TARGET_REDIRECT
  89. tristate 'REDIRECT target support'
  90. depends on ADK_KPACKAGE_KMOD_FULL_NAT
  91. help
  92. REDIRECT is a special case of NAT: all incoming connections are
  93. mapped onto the incoming interface's address, causing the packets to
  94. come to the local machine instead of passing through. This is
  95. useful for transparent proxies.
  96. config ADK_KPACKAGE_KMOD_IP_NF_TARGET_NETMAP
  97. tristate 'NETMAP target support'
  98. depends on ADK_KPACKAGE_KMOD_FULL_NAT
  99. help
  100. NETMAP is an implementation of static 1:1 NAT mapping of network
  101. addresses. It maps the network address part, while keeping the host
  102. address part intact. It is similar to Fast NAT, except that
  103. Netfilter's connection tracking doesn't work well with Fast NAT.
  104. config ADK_KPACKAGE_KMOD_IP_NF_MANGLE
  105. tristate 'Packet mangling'
  106. depends on ADK_KPACKAGE_KMOD_FULL_NAT
  107. help
  108. This option adds a `mangle' table to iptables: see the man page for
  109. iptables(8). This table is used for various packet alterations
  110. which can effect how the packet is routed.
  111. config ADK_KPACKAGE_KMOD_IP_NF_TARGET_ECN
  112. tristate 'ECN target support'
  113. depends on ADK_KPACKAGE_KMOD_IP_NF_MANGLE
  114. help
  115. This option adds a `ECN' target, which can be used in the iptables mangle
  116. table.
  117. You can use this target to remove the ECN bits from the IPv4 header of
  118. an IP packet. This is particularly useful, if you need to work around
  119. existing ECN blackholes on the internet, but don't want to disable
  120. ECN support in general.