From help-file :
Firewall based classifier CONFIG_NET_CLS_FW If you say Y here, you will be able to classify outgoing packets according to firewall criteria you specified. This code is also available as a module called cls_fw.o ( = code which can be inserted in and removed from the running kernel whenever you want). If you want to compile it as a module, say M here and read Documentation/modules.txt.