menu "Netfilter (Firewall/Filtering)" config ADK_KERNEL_NETFILTER bool default n config ADK_KERNEL_NETFILTER_ADVANCED bool default n config ADK_KERNEL_BRIDGE_NETFILTER bool default n config ADK_KERNEL_NETFILTER_XTABLES bool select ADK_KERNEL_NETFILTER select ADK_KERNEL_NETFILTER_ADVANCED default n config ADK_KERNEL_NETFILTER_DEBUG bool default n config ADK_KERNEL_IP_NF_MATCH_LAYER7_DEBUG bool default n config ADK_KERNEL_IP_NF_TARGET_MIRROR tristate default n config ADK_KERNEL_IP_NF_NAT_SNMP_BASIC tristate default n config ADK_KERNEL_IP_NF_TARGET_DSCP tristate default n config ADK_KERNEL_IP_NF_TARGET_MARK tristate default n config ADK_KERNEL_IP_NF_TARGET_CLASSIFY tristate default n config ADK_KERNEL_IP_NF_TARGET_IMQ tristate default n config ADK_KERNEL_IP_NF_TARGET_CONNMARK tristate default n config ADK_KERNEL_IP_NF_ARPTABLES tristate default n config ADK_KERNEL_IP_NF_COMPAT_IPCHAINS tristate default n config ADK_KERNEL_IP_NF_COMPAT_IPFWADM tristate default n config ADK_KERNEL_IP6_NF_QUEUE tristate default n config ADK_KERNEL_IP6_NF_IPTABLES tristate default n config ADK_KERNEL_IP_ROUTE_FWMARK bool default n config ADK_KERNEL_IP_NF_QUEUE tristate default n config ADK_KERNEL_IP_NF_MATCH_TIME tristate default n config ADK_KERNEL_IP_NF_MATCH_CONDITION tristate default n config ADK_KERNEL_IP_NF_MATCH_DSCP tristate default n config ADK_KERNEL_IP_NF_MATCH_AH_ESP tristate default n config ADK_KERNEL_IP_NF_MATCH_LENGTH tristate default n config ADK_KERNEL_IP_NF_MATCH_HELPER tristate default n # cannot be ADK_KERNEL_IP_NF_MATCH_STATE because # netfilter is built as a module -> this'll always be # a module, too config ADK_KPACKAGE_KMOD_IP_NF_MATCH_STATE tristate select ADK_KPACKAGE_KMOD_NETFILTER_XT_MATCH_STATE default n config ADK_KPACKAGE_KMOD_NETFILTER_XT_MATCH_STATE tristate default n # cannot be ADK_KERNEL_IP_NF_MATCH_CONNTRACK because # netfilter is built as a module -> this'll always be # a module, too config ADK_KPACKAGE_KMOD_IP_NF_MATCH_CONNTRACK tristate default n config ADK_KERNEL_IP_NF_MATCH_CONNMARK tristate default n config ADK_KERNEL_IP_NF_MATCH_UNCLEAN tristate default n config ADK_KERNEL_IP_NF_MATCH_STRING tristate default n menu "Core Netfilter Configuration" config ADK_KPACKAGE_KMOD_NF_CONNTRACK tristate 'Netfilter connection tracking support' select ADK_KERNEL_NETFILTER_XTABLES help Connection tracking keeps a record of what packets have passed through your machine, in order to figure out how they are related into connections. Layer 3 independent connection tracking is experimental scheme which generalize ip_conntrack to support other layer 3 protocols. config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_CLASSIFY tristate '"CLASSIFY" target support' select ADK_KERNEL_NETFILTER_XTABLES help This option adds a `CLASSIFY' target, which enables the user to set the priority of a packet. Some qdiscs can use this value for classification, among these are: atm, cbq, dsmark, pfifo_fast, htb, prio config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_CONNMARK tristate '"CONNMARK" target support' select ADK_KERNEL_NETFILTER_XTABLES select ADK_KPACKAGE_KMOD_NF_CONNTRACK help This option adds a `CONNMARK' target, which allows one to manipulate the connection mark value. Similar to the MARK target, but affects the connection mark value rather than the packet mark value. config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_MARK tristate '"MARK" target support' select ADK_KERNEL_NETFILTER_XTABLES help This option adds a `MARK' target, which allows you to create rules in the `mangle' table which alter the netfilter mark (nfmark) field associated with the packet prior to routing. This can change the routing method (see `Use netfilter MARK value as routing key') and can also be used by other subsystems to change their behavior. config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_NFQUEUE tristate '"NFQUEUE" target support' select ADK_KERNEL_NETFILTER_XTABLES help This target replaced the old obsolete QUEUE target. As opposed to QUEUE, it supports 65535 different queues, not just one. config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_TCPMSS tristate 'TCPMSS target' select ADK_KERNEL_NETFILTER_XTABLES help endmenu menu "IP: Netfilter Configuration" source target/linux/config/Config.in.netfilter.ip4 endmenu menu "IPv6: Netfilter Configuration" depends on ADK_ENABLE_IPV6 source target/linux/config/Config.in.netfilter.ip6 endmenu menu "Ethernet bridge firewalling" config ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES tristate 'Ethernet Bridge tables (ebtables) support' select ADK_KERNEL_BRIDGE_NETFILTER help ebtables is a general, extensible frame/packet identification framework. Say 'Y' or 'M' here if you want to do Ethernet filtering/NAT/brouting on the Ethernet bridge. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_BROUTE tristate "ebt: broute table support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help The ebtables broute table is used to define rules that decide between bridging and routing frames, giving Linux the functionality of a brouter. See the man page for ebtables(8) and examples on the ebtables website. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_T_FILTER tristate "ebt: filter table support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help The ebtables filter table is used to define frame filtering rules at local input, forwarding and local output. See the man page for ebtables(8). To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_T_NAT tristate "ebt: nat table support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help The ebtables nat table is used to define rules that alter the MAC source address (MAC SNAT) or the MAC destination address (MAC DNAT). See the man page for ebtables(8). To compile it as a module, choose M here. If unsure, say N. # # matches # config ADK_KPACKAGE_KMOD_BRIDGE_EBT_802_3 tristate "ebt: 802.3 filter support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds matching support for 802.3 Ethernet frames. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_AMONG tristate "ebt: among filter support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the among match, which allows matching the MAC source and/or destination address on a list of addresses. Optionally, MAC/IP address pairs can be matched, f.e. for anti-spoofing rules. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_ARP tristate "ebt: ARP filter support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the ARP match, which allows ARP and RARP header field filtering. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_IP tristate "ebt: IP filter support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the IP match, which allows basic IP header field filtering. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_IP6 tristate "ebt: IP6 filter support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES && ADK_KPACKAGE_KMOD_IPV6 help This option adds the IP6 match, which allows basic IPV6 header field filtering. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_LIMIT tristate "ebt: limit match support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the limit match, which allows you to control the rate at which a rule can be matched. This match is the equivalent of the iptables limit match. If you want to compile it as a module, say M here and read . If unsure, say `N'. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_MARK tristate "ebt: mark filter support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the mark match, which allows matching frames based on the 'nfmark' value in the frame. This can be set by the mark target. This value is the same as the one used in the iptables mark match and target. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_PKTTYPE tristate "ebt: packet type filter support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the packet type match, which allows matching on the type of packet based on its Ethernet "class" (as determined by the generic networking code): broadcast, multicast, for this host alone or for another host. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_STP tristate "ebt: STP filter support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the Spanning Tree Protocol match, which allows STP header field filtering. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_VLAN tristate "ebt: 802.1Q VLAN filter support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the 802.1Q vlan match, which allows the filtering of 802.1Q vlan fields. To compile it as a module, choose M here. If unsure, say N. # # targets # config ADK_KPACKAGE_KMOD_BRIDGE_EBT_ARPREPLY tristate "ebt: arp reply target support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the arp reply target, which allows automatically sending arp replies to arp requests. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_DNAT tristate "ebt: dnat target support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the MAC DNAT target, which allows altering the MAC destination address of frames. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_MARK_T tristate "ebt: mark target support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the mark target, which allows marking frames by setting the 'nfmark' value in the frame. This value is the same as the one used in the iptables mark match and target. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_REDIRECT tristate "ebt: redirect target support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the MAC redirect target, which allows altering the MAC destination address of a frame to that of the device it arrived on. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_SNAT tristate "ebt: snat target support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the MAC SNAT target, which allows altering the MAC source address of frames. To compile it as a module, choose M here. If unsure, say N. # # watchers # config ADK_KPACKAGE_KMOD_BRIDGE_EBT_LOG tristate "ebt: log support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option adds the log watcher, that you can use in any rule in any ebtables table. It records info about the frame header to the syslog. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_ULOG tristate "ebt: ulog support (OBSOLETE)" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option enables the old bridge-specific "ebt_ulog" implementation which has been obsoleted by the new "nfnetlink_log" code (see CONFIG_NETFILTER_NETLINK_LOG). This option adds the ulog watcher, that you can use in any rule in any ebtables table. The packet is passed to a userspace logging daemon using netlink multicast sockets. This differs from the log watcher in the sense that the complete packet is sent to userspace instead of a descriptive text and that netlink multicast sockets are used instead of the syslog. To compile it as a module, choose M here. If unsure, say N. config ADK_KPACKAGE_KMOD_BRIDGE_EBT_NFLOG tristate "ebt: nflog support" depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES help This option enables the nflog watcher, which allows to LOG messages through the netfilter logging API, which can use either the old LOG target, the old ULOG target or nfnetlink_log as backend. This option adds the nflog watcher, that you can use in any rule in any ebtables table. To compile it as a module, choose M here. If unsure, say N. endmenu source package/ipset/Config.in.kmod endmenu