1menu "Core Netfilter Configuration" 2 depends on NET && INET && NETFILTER 3 4config NETFILTER_INGRESS 5 bool "Netfilter ingress support" 6 default y 7 select NET_INGRESS 8 help 9 This allows you to classify packets from ingress using the Netfilter 10 infrastructure. 11 12config NETFILTER_NETLINK 13 tristate 14 15config NETFILTER_FAMILY_BRIDGE 16 bool 17 18config NETFILTER_FAMILY_ARP 19 bool 20 21config NETFILTER_NETLINK_ACCT 22tristate "Netfilter NFACCT over NFNETLINK interface" 23 depends on NETFILTER_ADVANCED 24 select NETFILTER_NETLINK 25 help 26 If this option is enabled, the kernel will include support 27 for extended accounting via NFNETLINK. 28 29config NETFILTER_NETLINK_QUEUE 30 tristate "Netfilter NFQUEUE over NFNETLINK interface" 31 depends on NETFILTER_ADVANCED 32 select NETFILTER_NETLINK 33 help 34 If this option is enabled, the kernel will include support 35 for queueing packets via NFNETLINK. 36 37config NETFILTER_NETLINK_LOG 38 tristate "Netfilter LOG over NFNETLINK interface" 39 default m if NETFILTER_ADVANCED=n 40 select NETFILTER_NETLINK 41 help 42 If this option is enabled, the kernel will include support 43 for logging packets via NFNETLINK. 44 45 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 46 and is also scheduled to replace the old syslog-based ipt_LOG 47 and ip6t_LOG modules. 48 49config NETFILTER_NETLINK_OSF 50 tristate "Netfilter OSF over NFNETLINK interface" 51 depends on NETFILTER_ADVANCED 52 select NETFILTER_NETLINK 53 help 54 If this option is enabled, the kernel will include support 55 for passive OS fingerprint via NFNETLINK. 56 57config NF_CONNTRACK 58 tristate "Netfilter connection tracking support" 59 default m if NETFILTER_ADVANCED=n 60 select NF_DEFRAG_IPV4 61 select NF_DEFRAG_IPV6 if IPV6 != n 62 help 63 Connection tracking keeps a record of what packets have passed 64 through your machine, in order to figure out how they are related 65 into connections. 66 67 This is required to do Masquerading or other kinds of Network 68 Address Translation. It can also be used to enhance packet 69 filtering (see `Connection state match support' below). 70 71 To compile it as a module, choose M here. If unsure, say N. 72 73config NF_LOG_COMMON 74 tristate 75 76config NF_LOG_NETDEV 77 tristate "Netdev packet logging" 78 select NF_LOG_COMMON 79 80if NF_CONNTRACK 81config NETFILTER_CONNCOUNT 82 tristate 83 84config NF_CONNTRACK_MARK 85 bool 'Connection mark tracking support' 86 depends on NETFILTER_ADVANCED 87 help 88 This option enables support for connection marks, used by the 89 `CONNMARK' target and `connmark' match. Similar to the mark value 90 of packets, but this mark value is kept in the conntrack session 91 instead of the individual packets. 92 93config NF_CONNTRACK_SECMARK 94 bool 'Connection tracking security mark support' 95 depends on NETWORK_SECMARK 96 default m if NETFILTER_ADVANCED=n 97 help 98 This option enables security markings to be applied to 99 connections. Typically they are copied to connections from 100 packets using the CONNSECMARK target and copied back from 101 connections to packets with the same target, with the packets 102 being originally labeled via SECMARK. 103 104 If unsure, say 'N'. 105 106config NF_CONNTRACK_ZONES 107 bool 'Connection tracking zones' 108 depends on NETFILTER_ADVANCED 109 help 110 This option enables support for connection tracking zones. 111 Normally, each connection needs to have a unique system wide 112 identity. Connection tracking zones allow to have multiple 113 connections using the same identity, as long as they are 114 contained in different zones. 115 116 If unsure, say `N'. 117 118config NF_CONNTRACK_PROCFS 119 bool "Supply CT list in procfs (OBSOLETE)" 120 default y 121 depends on PROC_FS 122 ---help--- 123 This option enables for the list of known conntrack entries 124 to be shown in procfs under net/netfilter/nf_conntrack. This 125 is considered obsolete in favor of using the conntrack(8) 126 tool which uses Netlink. 127 128config NF_CONNTRACK_EVENTS 129 bool "Connection tracking events" 130 depends on NETFILTER_ADVANCED 131 help 132 If this option is enabled, the connection tracking code will 133 provide a notifier chain that can be used by other kernel code 134 to get notified about changes in the connection tracking state. 135 136 If unsure, say `N'. 137 138config NF_CONNTRACK_TIMEOUT 139 bool 'Connection tracking timeout' 140 depends on NETFILTER_ADVANCED 141 help 142 This option enables support for connection tracking timeout 143 extension. This allows you to attach timeout policies to flow 144 via the CT target. 145 146 If unsure, say `N'. 147 148config NF_CONNTRACK_TIMESTAMP 149 bool 'Connection tracking timestamping' 150 depends on NETFILTER_ADVANCED 151 help 152 This option enables support for connection tracking timestamping. 153 This allows you to store the flow start-time and to obtain 154 the flow-stop time (once it has been destroyed) via Connection 155 tracking events. 156 157 If unsure, say `N'. 158 159config NF_CONNTRACK_LABELS 160 bool "Connection tracking labels" 161 help 162 This option enables support for assigning user-defined flag bits 163 to connection tracking entries. It can be used with xtables connlabel 164 match and the nftables ct expression. 165 166config NF_CT_PROTO_DCCP 167 bool 'DCCP protocol connection tracking support' 168 depends on NETFILTER_ADVANCED 169 default y 170 help 171 With this option enabled, the layer 3 independent connection 172 tracking code will be able to do state tracking on DCCP connections. 173 174 If unsure, say Y. 175 176config NF_CT_PROTO_GRE 177 bool 178 179config NF_CT_PROTO_SCTP 180 bool 'SCTP protocol connection tracking support' 181 depends on NETFILTER_ADVANCED 182 default y 183 select LIBCRC32C 184 help 185 With this option enabled, the layer 3 independent connection 186 tracking code will be able to do state tracking on SCTP connections. 187 188 If unsure, say Y. 189 190config NF_CT_PROTO_UDPLITE 191 bool 'UDP-Lite protocol connection tracking support' 192 depends on NETFILTER_ADVANCED 193 default y 194 help 195 With this option enabled, the layer 3 independent connection 196 tracking code will be able to do state tracking on UDP-Lite 197 connections. 198 199 If unsure, say Y. 200 201config NF_CONNTRACK_AMANDA 202 tristate "Amanda backup protocol support" 203 depends on NETFILTER_ADVANCED 204 select TEXTSEARCH 205 select TEXTSEARCH_KMP 206 help 207 If you are running the Amanda backup package <http://www.amanda.org/> 208 on this machine or machines that will be MASQUERADED through this 209 machine, then you may want to enable this feature. This allows the 210 connection tracking and natting code to allow the sub-channels that 211 Amanda requires for communication of the backup data, messages and 212 index. 213 214 To compile it as a module, choose M here. If unsure, say N. 215 216config NF_CONNTRACK_FTP 217 tristate "FTP protocol support" 218 default m if NETFILTER_ADVANCED=n 219 help 220 Tracking FTP connections is problematic: special helpers are 221 required for tracking them, and doing masquerading and other forms 222 of Network Address Translation on them. 223 224 This is FTP support on Layer 3 independent connection tracking. 225 Layer 3 independent connection tracking is experimental scheme 226 which generalize ip_conntrack to support other layer 3 protocols. 227 228 To compile it as a module, choose M here. If unsure, say N. 229 230config NF_CONNTRACK_H323 231 tristate "H.323 protocol support" 232 depends on IPV6 || IPV6=n 233 depends on NETFILTER_ADVANCED 234 help 235 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 236 important VoIP protocols, it is widely used by voice hardware and 237 software including voice gateways, IP phones, Netmeeting, OpenPhone, 238 Gnomemeeting, etc. 239 240 With this module you can support H.323 on a connection tracking/NAT 241 firewall. 242 243 This module supports RAS, Fast Start, H.245 Tunnelling, Call 244 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 245 whiteboard, file transfer, etc. For more information, please 246 visit http://nath323.sourceforge.net/. 247 248 To compile it as a module, choose M here. If unsure, say N. 249 250config NF_CONNTRACK_IRC 251 tristate "IRC protocol support" 252 default m if NETFILTER_ADVANCED=n 253 help 254 There is a commonly-used extension to IRC called 255 Direct Client-to-Client Protocol (DCC). This enables users to send 256 files to each other, and also chat to each other without the need 257 of a server. DCC Sending is used anywhere you send files over IRC, 258 and DCC Chat is most commonly used by Eggdrop bots. If you are 259 using NAT, this extension will enable you to send files and initiate 260 chats. Note that you do NOT need this extension to get files or 261 have others initiate chats, or everything else in IRC. 262 263 To compile it as a module, choose M here. If unsure, say N. 264 265config NF_CONNTRACK_BROADCAST 266 tristate 267 268config NF_CONNTRACK_NETBIOS_NS 269 tristate "NetBIOS name service protocol support" 270 select NF_CONNTRACK_BROADCAST 271 help 272 NetBIOS name service requests are sent as broadcast messages from an 273 unprivileged port and responded to with unicast messages to the 274 same port. This make them hard to firewall properly because connection 275 tracking doesn't deal with broadcasts. This helper tracks locally 276 originating NetBIOS name service requests and the corresponding 277 responses. It relies on correct IP address configuration, specifically 278 netmask and broadcast address. When properly configured, the output 279 of "ip address show" should look similar to this: 280 281 $ ip -4 address show eth0 282 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 283 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 284 285 To compile it as a module, choose M here. If unsure, say N. 286 287config NF_CONNTRACK_SNMP 288 tristate "SNMP service protocol support" 289 depends on NETFILTER_ADVANCED 290 select NF_CONNTRACK_BROADCAST 291 help 292 SNMP service requests are sent as broadcast messages from an 293 unprivileged port and responded to with unicast messages to the 294 same port. This make them hard to firewall properly because connection 295 tracking doesn't deal with broadcasts. This helper tracks locally 296 originating SNMP service requests and the corresponding 297 responses. It relies on correct IP address configuration, specifically 298 netmask and broadcast address. 299 300 To compile it as a module, choose M here. If unsure, say N. 301 302config NF_CONNTRACK_PPTP 303 tristate "PPtP protocol support" 304 depends on NETFILTER_ADVANCED 305 select NF_CT_PROTO_GRE 306 help 307 This module adds support for PPTP (Point to Point Tunnelling 308 Protocol, RFC2637) connection tracking and NAT. 309 310 If you are running PPTP sessions over a stateful firewall or NAT 311 box, you may want to enable this feature. 312 313 Please note that not all PPTP modes of operation are supported yet. 314 Specifically these limitations exist: 315 - Blindly assumes that control connections are always established 316 in PNS->PAC direction. This is a violation of RFC2637. 317 - Only supports a single call within each session 318 319 To compile it as a module, choose M here. If unsure, say N. 320 321config NF_CONNTRACK_SANE 322 tristate "SANE protocol support" 323 depends on NETFILTER_ADVANCED 324 help 325 SANE is a protocol for remote access to scanners as implemented 326 by the 'saned' daemon. Like FTP, it uses separate control and 327 data connections. 328 329 With this module you can support SANE on a connection tracking 330 firewall. 331 332 To compile it as a module, choose M here. If unsure, say N. 333 334config NF_CONNTRACK_SIP 335 tristate "SIP protocol support" 336 default m if NETFILTER_ADVANCED=n 337 help 338 SIP is an application-layer control protocol that can establish, 339 modify, and terminate multimedia sessions (conferences) such as 340 Internet telephony calls. With the ip_conntrack_sip and 341 the nf_nat_sip modules you can support the protocol on a connection 342 tracking/NATing firewall. 343 344 To compile it as a module, choose M here. If unsure, say N. 345 346config NF_CONNTRACK_TFTP 347 tristate "TFTP protocol support" 348 depends on NETFILTER_ADVANCED 349 help 350 TFTP connection tracking helper, this is required depending 351 on how restrictive your ruleset is. 352 If you are using a tftp client behind -j SNAT or -j MASQUERADING 353 you will need this. 354 355 To compile it as a module, choose M here. If unsure, say N. 356 357config NF_CT_NETLINK 358 tristate 'Connection tracking netlink interface' 359 select NETFILTER_NETLINK 360 default m if NETFILTER_ADVANCED=n 361 help 362 This option enables support for a netlink-based userspace interface 363 364config NF_CT_NETLINK_TIMEOUT 365 tristate 'Connection tracking timeout tuning via Netlink' 366 select NETFILTER_NETLINK 367 depends on NETFILTER_ADVANCED 368 depends on NF_CONNTRACK_TIMEOUT 369 help 370 This option enables support for connection tracking timeout 371 fine-grain tuning. This allows you to attach specific timeout 372 policies to flows, instead of using the global timeout policy. 373 374 If unsure, say `N'. 375 376config NF_CT_NETLINK_HELPER 377 tristate 'Connection tracking helpers in user-space via Netlink' 378 select NETFILTER_NETLINK 379 depends on NF_CT_NETLINK 380 depends on NETFILTER_NETLINK_QUEUE 381 depends on NETFILTER_NETLINK_GLUE_CT 382 depends on NETFILTER_ADVANCED 383 help 384 This option enables the user-space connection tracking helpers 385 infrastructure. 386 387 If unsure, say `N'. 388 389config NETFILTER_NETLINK_GLUE_CT 390 bool "NFQUEUE and NFLOG integration with Connection Tracking" 391 default n 392 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 393 help 394 If this option is enabled, NFQUEUE and NFLOG can include 395 Connection Tracking information together with the packet is 396 the enqueued via NFNETLINK. 397 398config NF_NAT 399 tristate "Network Address Translation support" 400 depends on NF_CONNTRACK 401 default m if NETFILTER_ADVANCED=n 402 help 403 The NAT option allows masquerading, port forwarding and other 404 forms of full Network Address Port Translation. This can be 405 controlled by iptables, ip6tables or nft. 406 407config NF_NAT_NEEDED 408 bool 409 depends on NF_NAT 410 default y 411 412config NF_NAT_AMANDA 413 tristate 414 depends on NF_CONNTRACK && NF_NAT 415 default NF_NAT && NF_CONNTRACK_AMANDA 416 417config NF_NAT_FTP 418 tristate 419 depends on NF_CONNTRACK && NF_NAT 420 default NF_NAT && NF_CONNTRACK_FTP 421 422config NF_NAT_IRC 423 tristate 424 depends on NF_CONNTRACK && NF_NAT 425 default NF_NAT && NF_CONNTRACK_IRC 426 427config NF_NAT_SIP 428 tristate 429 depends on NF_CONNTRACK && NF_NAT 430 default NF_NAT && NF_CONNTRACK_SIP 431 432config NF_NAT_TFTP 433 tristate 434 depends on NF_CONNTRACK && NF_NAT 435 default NF_NAT && NF_CONNTRACK_TFTP 436 437config NF_NAT_REDIRECT 438 bool 439 440config NF_NAT_MASQUERADE 441 bool 442 443config NETFILTER_SYNPROXY 444 tristate 445 446endif # NF_CONNTRACK 447 448config NF_TABLES 449 select NETFILTER_NETLINK 450 tristate "Netfilter nf_tables support" 451 help 452 nftables is the new packet classification framework that intends to 453 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 454 provides a pseudo-state machine with an extensible instruction-set 455 (also known as expressions) that the userspace 'nft' utility 456 (http://www.netfilter.org/projects/nftables) uses to build the 457 rule-set. It also comes with the generic set infrastructure that 458 allows you to construct mappings between matchings and actions 459 for performance lookups. 460 461 To compile it as a module, choose M here. 462 463if NF_TABLES 464 465config NF_TABLES_SET 466 tristate "Netfilter nf_tables set infrastructure" 467 help 468 This option enables the nf_tables set infrastructure that allows to 469 look up for elements in a set and to build one-way mappings between 470 matchings and actions. 471 472config NF_TABLES_INET 473 depends on IPV6 474 select NF_TABLES_IPV4 475 select NF_TABLES_IPV6 476 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support" 477 help 478 This option enables support for a mixed IPv4/IPv6 "inet" table. 479 480config NF_TABLES_NETDEV 481 bool "Netfilter nf_tables netdev tables support" 482 help 483 This option enables support for the "netdev" table. 484 485config NFT_NUMGEN 486 tristate "Netfilter nf_tables number generator module" 487 help 488 This option adds the number generator expression used to perform 489 incremental counting and random numbers bound to a upper limit. 490 491config NFT_CT 492 depends on NF_CONNTRACK 493 tristate "Netfilter nf_tables conntrack module" 494 help 495 This option adds the "ct" expression that you can use to match 496 connection tracking information such as the flow state. 497 498config NFT_FLOW_OFFLOAD 499 depends on NF_CONNTRACK && NF_FLOW_TABLE 500 tristate "Netfilter nf_tables hardware flow offload module" 501 help 502 This option adds the "flow_offload" expression that you can use to 503 choose what flows are placed into the hardware. 504 505config NFT_COUNTER 506 tristate "Netfilter nf_tables counter module" 507 help 508 This option adds the "counter" expression that you can use to 509 include packet and byte counters in a rule. 510 511config NFT_CONNLIMIT 512 tristate "Netfilter nf_tables connlimit module" 513 depends on NF_CONNTRACK 514 depends on NETFILTER_ADVANCED 515 select NETFILTER_CONNCOUNT 516 help 517 This option adds the "connlimit" expression that you can use to 518 ratelimit rule matchings per connections. 519 520config NFT_LOG 521 tristate "Netfilter nf_tables log module" 522 help 523 This option adds the "log" expression that you can use to log 524 packets matching some criteria. 525 526config NFT_LIMIT 527 tristate "Netfilter nf_tables limit module" 528 help 529 This option adds the "limit" expression that you can use to 530 ratelimit rule matchings. 531 532config NFT_MASQ 533 depends on NF_CONNTRACK 534 depends on NF_NAT 535 select NF_NAT_MASQUERADE 536 tristate "Netfilter nf_tables masquerade support" 537 help 538 This option adds the "masquerade" expression that you can use 539 to perform NAT in the masquerade flavour. 540 541config NFT_REDIR 542 depends on NF_CONNTRACK 543 depends on NF_NAT 544 tristate "Netfilter nf_tables redirect support" 545 select NF_NAT_REDIRECT 546 help 547 This options adds the "redirect" expression that you can use 548 to perform NAT in the redirect flavour. 549 550config NFT_NAT 551 depends on NF_CONNTRACK 552 select NF_NAT 553 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6 554 tristate "Netfilter nf_tables nat module" 555 help 556 This option adds the "nat" expression that you can use to perform 557 typical Network Address Translation (NAT) packet transformations. 558 559config NFT_TUNNEL 560 tristate "Netfilter nf_tables tunnel module" 561 help 562 This option adds the "tunnel" expression that you can use to set 563 tunneling policies. 564 565config NFT_OBJREF 566 tristate "Netfilter nf_tables stateful object reference module" 567 help 568 This option adds the "objref" expression that allows you to refer to 569 stateful objects, such as counters and quotas. 570 571config NFT_QUEUE 572 depends on NETFILTER_NETLINK_QUEUE 573 tristate "Netfilter nf_tables queue module" 574 help 575 This is required if you intend to use the userspace queueing 576 infrastructure (also known as NFQUEUE) from nftables. 577 578config NFT_QUOTA 579 tristate "Netfilter nf_tables quota module" 580 help 581 This option adds the "quota" expression that you can use to match 582 enforce bytes quotas. 583 584config NFT_REJECT 585 default m if NETFILTER_ADVANCED=n 586 tristate "Netfilter nf_tables reject support" 587 depends on !NF_TABLES_INET || (IPV6!=m || m) 588 help 589 This option adds the "reject" expression that you can use to 590 explicitly deny and notify via TCP reset/ICMP informational errors 591 unallowed traffic. 592 593config NFT_REJECT_INET 594 depends on NF_TABLES_INET 595 default NFT_REJECT 596 tristate 597 598config NFT_COMPAT 599 depends on NETFILTER_XTABLES 600 tristate "Netfilter x_tables over nf_tables module" 601 help 602 This is required if you intend to use any of existing 603 x_tables match/target extensions over the nf_tables 604 framework. 605 606config NFT_HASH 607 tristate "Netfilter nf_tables hash module" 608 help 609 This option adds the "hash" expression that you can use to perform 610 a hash operation on registers. 611 612config NFT_FIB 613 tristate 614 615config NFT_FIB_INET 616 depends on NF_TABLES_INET 617 depends on NFT_FIB_IPV4 618 depends on NFT_FIB_IPV6 619 tristate "Netfilter nf_tables fib inet support" 620 help 621 This option allows using the FIB expression from the inet table. 622 The lookup will be delegated to the IPv4 or IPv6 FIB depending 623 on the protocol of the packet. 624 625config NFT_XFRM 626 tristate "Netfilter nf_tables xfrm/IPSec security association matching" 627 depends on XFRM 628 help 629 This option adds an expression that you can use to extract properties 630 of a packets security association. 631 632config NFT_SOCKET 633 tristate "Netfilter nf_tables socket match support" 634 depends on IPV6 || IPV6=n 635 select NF_SOCKET_IPV4 636 select NF_SOCKET_IPV6 if NF_TABLES_IPV6 637 help 638 This option allows matching for the presence or absence of a 639 corresponding socket and its attributes. 640 641config NFT_OSF 642 tristate "Netfilter nf_tables passive OS fingerprint support" 643 depends on NETFILTER_ADVANCED 644 select NETFILTER_NETLINK_OSF 645 help 646 This option allows matching packets from an specific OS. 647 648config NFT_TPROXY 649 tristate "Netfilter nf_tables tproxy support" 650 depends on IPV6 || IPV6=n 651 select NF_DEFRAG_IPV4 652 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6 653 select NF_TPROXY_IPV4 654 select NF_TPROXY_IPV6 if NF_TABLES_IPV6 655 help 656 This makes transparent proxy support available in nftables. 657 658if NF_TABLES_NETDEV 659 660config NF_DUP_NETDEV 661 tristate "Netfilter packet duplication support" 662 help 663 This option enables the generic packet duplication infrastructure 664 for Netfilter. 665 666config NFT_DUP_NETDEV 667 tristate "Netfilter nf_tables netdev packet duplication support" 668 select NF_DUP_NETDEV 669 help 670 This option enables packet duplication for the "netdev" family. 671 672config NFT_FWD_NETDEV 673 tristate "Netfilter nf_tables netdev packet forwarding support" 674 select NF_DUP_NETDEV 675 help 676 This option enables packet forwarding for the "netdev" family. 677 678config NFT_FIB_NETDEV 679 depends on NFT_FIB_IPV4 680 depends on NFT_FIB_IPV6 681 tristate "Netfilter nf_tables netdev fib lookups support" 682 help 683 This option allows using the FIB expression from the netdev table. 684 The lookup will be delegated to the IPv4 or IPv6 FIB depending 685 on the protocol of the packet. 686 687endif # NF_TABLES_NETDEV 688 689endif # NF_TABLES 690 691config NF_FLOW_TABLE_INET 692 tristate "Netfilter flow table mixed IPv4/IPv6 module" 693 depends on NF_FLOW_TABLE 694 help 695 This option adds the flow table mixed IPv4/IPv6 support. 696 697 To compile it as a module, choose M here. 698 699config NF_FLOW_TABLE 700 tristate "Netfilter flow table module" 701 depends on NETFILTER_INGRESS 702 depends on NF_CONNTRACK 703 depends on NF_TABLES 704 help 705 This option adds the flow table core infrastructure. 706 707 To compile it as a module, choose M here. 708 709config NETFILTER_XTABLES 710 tristate "Netfilter Xtables support (required for ip_tables)" 711 default m if NETFILTER_ADVANCED=n 712 help 713 This is required if you intend to use any of ip_tables, 714 ip6_tables or arp_tables. 715 716if NETFILTER_XTABLES 717 718comment "Xtables combined modules" 719 720config NETFILTER_XT_MARK 721 tristate 'nfmark target and match support' 722 default m if NETFILTER_ADVANCED=n 723 ---help--- 724 This option adds the "MARK" target and "mark" match. 725 726 Netfilter mark matching allows you to match packets based on the 727 "nfmark" value in the packet. 728 The target allows you to create rules in the "mangle" table which alter 729 the netfilter mark (nfmark) field associated with the packet. 730 731 Prior to routing, the nfmark can influence the routing method and can 732 also be used by other subsystems to change their behavior. 733 734config NETFILTER_XT_CONNMARK 735 tristate 'ctmark target and match support' 736 depends on NF_CONNTRACK 737 depends on NETFILTER_ADVANCED 738 select NF_CONNTRACK_MARK 739 ---help--- 740 This option adds the "CONNMARK" target and "connmark" match. 741 742 Netfilter allows you to store a mark value per connection (a.k.a. 743 ctmark), similarly to the packet mark (nfmark). Using this 744 target and match, you can set and match on this mark. 745 746config NETFILTER_XT_SET 747 tristate 'set target and match support' 748 depends on IP_SET 749 depends on NETFILTER_ADVANCED 750 help 751 This option adds the "SET" target and "set" match. 752 753 Using this target and match, you can add/delete and match 754 elements in the sets created by ipset(8). 755 756 To compile it as a module, choose M here. If unsure, say N. 757 758# alphabetically ordered list of targets 759 760comment "Xtables targets" 761 762config NETFILTER_XT_TARGET_AUDIT 763 tristate "AUDIT target support" 764 depends on AUDIT 765 depends on NETFILTER_ADVANCED 766 ---help--- 767 This option adds a 'AUDIT' target, which can be used to create 768 audit records for packets dropped/accepted. 769 770 To compileit as a module, choose M here. If unsure, say N. 771 772config NETFILTER_XT_TARGET_CHECKSUM 773 tristate "CHECKSUM target support" 774 depends on IP_NF_MANGLE || IP6_NF_MANGLE 775 depends on NETFILTER_ADVANCED 776 ---help--- 777 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 778 table to work around buggy DHCP clients in virtualized environments. 779 780 Some old DHCP clients drop packets because they are not aware 781 that the checksum would normally be offloaded to hardware and 782 thus should be considered valid. 783 This target can be used to fill in the checksum using iptables 784 when such packets are sent via a virtual network device. 785 786 To compile it as a module, choose M here. If unsure, say N. 787 788config NETFILTER_XT_TARGET_CLASSIFY 789 tristate '"CLASSIFY" target support' 790 depends on NETFILTER_ADVANCED 791 help 792 This option adds a `CLASSIFY' target, which enables the user to set 793 the priority of a packet. Some qdiscs can use this value for 794 classification, among these are: 795 796 atm, cbq, dsmark, pfifo_fast, htb, prio 797 798 To compile it as a module, choose M here. If unsure, say N. 799 800config NETFILTER_XT_TARGET_CONNMARK 801 tristate '"CONNMARK" target support' 802 depends on NF_CONNTRACK 803 depends on NETFILTER_ADVANCED 804 select NETFILTER_XT_CONNMARK 805 ---help--- 806 This is a backwards-compat option for the user's convenience 807 (e.g. when running oldconfig). It selects 808 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 809 810config NETFILTER_XT_TARGET_CONNSECMARK 811 tristate '"CONNSECMARK" target support' 812 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 813 default m if NETFILTER_ADVANCED=n 814 help 815 The CONNSECMARK target copies security markings from packets 816 to connections, and restores security markings from connections 817 to packets (if the packets are not already marked). This would 818 normally be used in conjunction with the SECMARK target. 819 820 To compile it as a module, choose M here. If unsure, say N. 821 822config NETFILTER_XT_TARGET_CT 823 tristate '"CT" target support' 824 depends on NF_CONNTRACK 825 depends on IP_NF_RAW || IP6_NF_RAW 826 depends on NETFILTER_ADVANCED 827 help 828 This options adds a `CT' target, which allows to specify initial 829 connection tracking parameters like events to be delivered and 830 the helper to be used. 831 832 To compile it as a module, choose M here. If unsure, say N. 833 834config NETFILTER_XT_TARGET_DSCP 835 tristate '"DSCP" and "TOS" target support' 836 depends on IP_NF_MANGLE || IP6_NF_MANGLE 837 depends on NETFILTER_ADVANCED 838 help 839 This option adds a `DSCP' target, which allows you to manipulate 840 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 841 842 The DSCP field can have any value between 0x0 and 0x3f inclusive. 843 844 It also adds the "TOS" target, which allows you to create rules in 845 the "mangle" table which alter the Type Of Service field of an IPv4 846 or the Priority field of an IPv6 packet, prior to routing. 847 848 To compile it as a module, choose M here. If unsure, say N. 849 850config NETFILTER_XT_TARGET_HL 851 tristate '"HL" hoplimit target support' 852 depends on IP_NF_MANGLE || IP6_NF_MANGLE 853 depends on NETFILTER_ADVANCED 854 ---help--- 855 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 856 targets, which enable the user to change the 857 hoplimit/time-to-live value of the IP header. 858 859 While it is safe to decrement the hoplimit/TTL value, the 860 modules also allow to increment and set the hoplimit value of 861 the header to arbitrary values. This is EXTREMELY DANGEROUS 862 since you can easily create immortal packets that loop 863 forever on the network. 864 865config NETFILTER_XT_TARGET_HMARK 866 tristate '"HMARK" target support' 867 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 868 depends on NETFILTER_ADVANCED 869 ---help--- 870 This option adds the "HMARK" target. 871 872 The target allows you to create rules in the "raw" and "mangle" tables 873 which set the skbuff mark by means of hash calculation within a given 874 range. The nfmark can influence the routing method and can also be used 875 by other subsystems to change their behaviour. 876 877 To compile it as a module, choose M here. If unsure, say N. 878 879config NETFILTER_XT_TARGET_IDLETIMER 880 tristate "IDLETIMER target support" 881 depends on NETFILTER_ADVANCED 882 help 883 884 This option adds the `IDLETIMER' target. Each matching packet 885 resets the timer associated with label specified when the rule is 886 added. When the timer expires, it triggers a sysfs notification. 887 The remaining time for expiration can be read via sysfs. 888 889 To compile it as a module, choose M here. If unsure, say N. 890 891config NETFILTER_XT_TARGET_LED 892 tristate '"LED" target support' 893 depends on LEDS_CLASS && LEDS_TRIGGERS 894 depends on NETFILTER_ADVANCED 895 help 896 This option adds a `LED' target, which allows you to blink LEDs in 897 response to particular packets passing through your machine. 898 899 This can be used to turn a spare LED into a network activity LED, 900 which only flashes in response to FTP transfers, for example. Or 901 you could have an LED which lights up for a minute or two every time 902 somebody connects to your machine via SSH. 903 904 You will need support for the "led" class to make this work. 905 906 To create an LED trigger for incoming SSH traffic: 907 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 908 909 Then attach the new trigger to an LED on your system: 910 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 911 912 For more information on the LEDs available on your system, see 913 Documentation/leds/leds-class.txt 914 915config NETFILTER_XT_TARGET_LOG 916 tristate "LOG target support" 917 select NF_LOG_COMMON 918 select NF_LOG_IPV4 919 select NF_LOG_IPV6 if IP6_NF_IPTABLES 920 default m if NETFILTER_ADVANCED=n 921 help 922 This option adds a `LOG' target, which allows you to create rules in 923 any iptables table which records the packet header to the syslog. 924 925 To compile it as a module, choose M here. If unsure, say N. 926 927config NETFILTER_XT_TARGET_MARK 928 tristate '"MARK" target support' 929 depends on NETFILTER_ADVANCED 930 select NETFILTER_XT_MARK 931 ---help--- 932 This is a backwards-compat option for the user's convenience 933 (e.g. when running oldconfig). It selects 934 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 935 936config NETFILTER_XT_NAT 937 tristate '"SNAT and DNAT" targets support' 938 depends on NF_NAT 939 ---help--- 940 This option enables the SNAT and DNAT targets. 941 942 To compile it as a module, choose M here. If unsure, say N. 943 944config NETFILTER_XT_TARGET_NETMAP 945 tristate '"NETMAP" target support' 946 depends on NF_NAT 947 ---help--- 948 NETMAP is an implementation of static 1:1 NAT mapping of network 949 addresses. It maps the network address part, while keeping the host 950 address part intact. 951 952 To compile it as a module, choose M here. If unsure, say N. 953 954config NETFILTER_XT_TARGET_NFLOG 955 tristate '"NFLOG" target support' 956 default m if NETFILTER_ADVANCED=n 957 select NETFILTER_NETLINK_LOG 958 help 959 This option enables the NFLOG target, which allows to LOG 960 messages through nfnetlink_log. 961 962 To compile it as a module, choose M here. If unsure, say N. 963 964config NETFILTER_XT_TARGET_NFQUEUE 965 tristate '"NFQUEUE" target Support' 966 depends on NETFILTER_ADVANCED 967 select NETFILTER_NETLINK_QUEUE 968 help 969 This target replaced the old obsolete QUEUE target. 970 971 As opposed to QUEUE, it supports 65535 different queues, 972 not just one. 973 974 To compile it as a module, choose M here. If unsure, say N. 975 976config NETFILTER_XT_TARGET_NOTRACK 977 tristate '"NOTRACK" target support (DEPRECATED)' 978 depends on NF_CONNTRACK 979 depends on IP_NF_RAW || IP6_NF_RAW 980 depends on NETFILTER_ADVANCED 981 select NETFILTER_XT_TARGET_CT 982 983config NETFILTER_XT_TARGET_RATEEST 984 tristate '"RATEEST" target support' 985 depends on NETFILTER_ADVANCED 986 help 987 This option adds a `RATEEST' target, which allows to measure 988 rates similar to TC estimators. The `rateest' match can be 989 used to match on the measured rates. 990 991 To compile it as a module, choose M here. If unsure, say N. 992 993config NETFILTER_XT_TARGET_REDIRECT 994 tristate "REDIRECT target support" 995 depends on NF_NAT 996 select NF_NAT_REDIRECT 997 ---help--- 998 REDIRECT is a special case of NAT: all incoming connections are 999 mapped onto the incoming interface's address, causing the packets to 1000 come to the local machine instead of passing through. This is 1001 useful for transparent proxies. 1002 1003 To compile it as a module, choose M here. If unsure, say N. 1004 1005config NETFILTER_XT_TARGET_TEE 1006 tristate '"TEE" - packet cloning to alternate destination' 1007 depends on NETFILTER_ADVANCED 1008 depends on IPV6 || IPV6=n 1009 depends on !NF_CONNTRACK || NF_CONNTRACK 1010 select NF_DUP_IPV4 1011 select NF_DUP_IPV6 if IP6_NF_IPTABLES 1012 ---help--- 1013 This option adds a "TEE" target with which a packet can be cloned and 1014 this clone be rerouted to another nexthop. 1015 1016config NETFILTER_XT_TARGET_TPROXY 1017 tristate '"TPROXY" target transparent proxying support' 1018 depends on NETFILTER_XTABLES 1019 depends on NETFILTER_ADVANCED 1020 depends on IPV6 || IPV6=n 1021 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1022 depends on IP_NF_MANGLE 1023 select NF_DEFRAG_IPV4 1024 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1025 select NF_TPROXY_IPV4 1026 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES 1027 help 1028 This option adds a `TPROXY' target, which is somewhat similar to 1029 REDIRECT. It can only be used in the mangle table and is useful 1030 to redirect traffic to a transparent proxy. It does _not_ depend 1031 on Netfilter connection tracking and NAT, unlike REDIRECT. 1032 For it to work you will have to configure certain iptables rules 1033 and use policy routing. For more information on how to set it up 1034 see Documentation/networking/tproxy.txt. 1035 1036 To compile it as a module, choose M here. If unsure, say N. 1037 1038config NETFILTER_XT_TARGET_TRACE 1039 tristate '"TRACE" target support' 1040 depends on IP_NF_RAW || IP6_NF_RAW 1041 depends on NETFILTER_ADVANCED 1042 help 1043 The TRACE target allows you to mark packets so that the kernel 1044 will log every rule which match the packets as those traverse 1045 the tables, chains, rules. 1046 1047 If you want to compile it as a module, say M here and read 1048 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1049 1050config NETFILTER_XT_TARGET_SECMARK 1051 tristate '"SECMARK" target support' 1052 depends on NETWORK_SECMARK 1053 default m if NETFILTER_ADVANCED=n 1054 help 1055 The SECMARK target allows security marking of network 1056 packets, for use with security subsystems. 1057 1058 To compile it as a module, choose M here. If unsure, say N. 1059 1060config NETFILTER_XT_TARGET_TCPMSS 1061 tristate '"TCPMSS" target support' 1062 depends on IPV6 || IPV6=n 1063 default m if NETFILTER_ADVANCED=n 1064 ---help--- 1065 This option adds a `TCPMSS' target, which allows you to alter the 1066 MSS value of TCP SYN packets, to control the maximum size for that 1067 connection (usually limiting it to your outgoing interface's MTU 1068 minus 40). 1069 1070 This is used to overcome criminally braindead ISPs or servers which 1071 block ICMP Fragmentation Needed packets. The symptoms of this 1072 problem are that everything works fine from your Linux 1073 firewall/router, but machines behind it can never exchange large 1074 packets: 1075 1) Web browsers connect, then hang with no data received. 1076 2) Small mail works fine, but large emails hang. 1077 3) ssh works fine, but scp hangs after initial handshaking. 1078 1079 Workaround: activate this option and add a rule to your firewall 1080 configuration like: 1081 1082 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1083 -j TCPMSS --clamp-mss-to-pmtu 1084 1085 To compile it as a module, choose M here. If unsure, say N. 1086 1087config NETFILTER_XT_TARGET_TCPOPTSTRIP 1088 tristate '"TCPOPTSTRIP" target support' 1089 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1090 depends on NETFILTER_ADVANCED 1091 help 1092 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1093 TCP options from TCP packets. 1094 1095# alphabetically ordered list of matches 1096 1097comment "Xtables matches" 1098 1099config NETFILTER_XT_MATCH_ADDRTYPE 1100 tristate '"addrtype" address type match support' 1101 default m if NETFILTER_ADVANCED=n 1102 ---help--- 1103 This option allows you to match what routing thinks of an address, 1104 eg. UNICAST, LOCAL, BROADCAST, ... 1105 1106 If you want to compile it as a module, say M here and read 1107 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1108 1109config NETFILTER_XT_MATCH_BPF 1110 tristate '"bpf" match support' 1111 depends on NETFILTER_ADVANCED 1112 help 1113 BPF matching applies a linux socket filter to each packet and 1114 accepts those for which the filter returns non-zero. 1115 1116 To compile it as a module, choose M here. If unsure, say N. 1117 1118config NETFILTER_XT_MATCH_CGROUP 1119 tristate '"control group" match support' 1120 depends on NETFILTER_ADVANCED 1121 depends on CGROUPS 1122 select CGROUP_NET_CLASSID 1123 ---help--- 1124 Socket/process control group matching allows you to match locally 1125 generated packets based on which net_cls control group processes 1126 belong to. 1127 1128config NETFILTER_XT_MATCH_CLUSTER 1129 tristate '"cluster" match support' 1130 depends on NF_CONNTRACK 1131 depends on NETFILTER_ADVANCED 1132 ---help--- 1133 This option allows you to build work-load-sharing clusters of 1134 network servers/stateful firewalls without having a dedicated 1135 load-balancing router/server/switch. Basically, this match returns 1136 true when the packet must be handled by this cluster node. Thus, 1137 all nodes see all packets and this match decides which node handles 1138 what packets. The work-load sharing algorithm is based on source 1139 address hashing. 1140 1141 If you say Y or M here, try `iptables -m cluster --help` for 1142 more information. 1143 1144config NETFILTER_XT_MATCH_COMMENT 1145 tristate '"comment" match support' 1146 depends on NETFILTER_ADVANCED 1147 help 1148 This option adds a `comment' dummy-match, which allows you to put 1149 comments in your iptables ruleset. 1150 1151 If you want to compile it as a module, say M here and read 1152 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1153 1154config NETFILTER_XT_MATCH_CONNBYTES 1155 tristate '"connbytes" per-connection counter match support' 1156 depends on NF_CONNTRACK 1157 depends on NETFILTER_ADVANCED 1158 help 1159 This option adds a `connbytes' match, which allows you to match the 1160 number of bytes and/or packets for each direction within a connection. 1161 1162 If you want to compile it as a module, say M here and read 1163 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1164 1165config NETFILTER_XT_MATCH_CONNLABEL 1166 tristate '"connlabel" match support' 1167 select NF_CONNTRACK_LABELS 1168 depends on NF_CONNTRACK 1169 depends on NETFILTER_ADVANCED 1170 ---help--- 1171 This match allows you to test and assign userspace-defined labels names 1172 to a connection. The kernel only stores bit values - mapping 1173 names to bits is done by userspace. 1174 1175 Unlike connmark, more than 32 flag bits may be assigned to a 1176 connection simultaneously. 1177 1178config NETFILTER_XT_MATCH_CONNLIMIT 1179 tristate '"connlimit" match support' 1180 depends on NF_CONNTRACK 1181 depends on NETFILTER_ADVANCED 1182 select NETFILTER_CONNCOUNT 1183 ---help--- 1184 This match allows you to match against the number of parallel 1185 connections to a server per client IP address (or address block). 1186 1187config NETFILTER_XT_MATCH_CONNMARK 1188 tristate '"connmark" connection mark match support' 1189 depends on NF_CONNTRACK 1190 depends on NETFILTER_ADVANCED 1191 select NETFILTER_XT_CONNMARK 1192 ---help--- 1193 This is a backwards-compat option for the user's convenience 1194 (e.g. when running oldconfig). It selects 1195 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1196 1197config NETFILTER_XT_MATCH_CONNTRACK 1198 tristate '"conntrack" connection tracking match support' 1199 depends on NF_CONNTRACK 1200 default m if NETFILTER_ADVANCED=n 1201 help 1202 This is a general conntrack match module, a superset of the state match. 1203 1204 It allows matching on additional conntrack information, which is 1205 useful in complex configurations, such as NAT gateways with multiple 1206 internet links or tunnels. 1207 1208 To compile it as a module, choose M here. If unsure, say N. 1209 1210config NETFILTER_XT_MATCH_CPU 1211 tristate '"cpu" match support' 1212 depends on NETFILTER_ADVANCED 1213 help 1214 CPU matching allows you to match packets based on the CPU 1215 currently handling the packet. 1216 1217 To compile it as a module, choose M here. If unsure, say N. 1218 1219config NETFILTER_XT_MATCH_DCCP 1220 tristate '"dccp" protocol match support' 1221 depends on NETFILTER_ADVANCED 1222 default IP_DCCP 1223 help 1224 With this option enabled, you will be able to use the iptables 1225 `dccp' match in order to match on DCCP source/destination ports 1226 and DCCP flags. 1227 1228 If you want to compile it as a module, say M here and read 1229 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1230 1231config NETFILTER_XT_MATCH_DEVGROUP 1232 tristate '"devgroup" match support' 1233 depends on NETFILTER_ADVANCED 1234 help 1235 This options adds a `devgroup' match, which allows to match on the 1236 device group a network device is assigned to. 1237 1238 To compile it as a module, choose M here. If unsure, say N. 1239 1240config NETFILTER_XT_MATCH_DSCP 1241 tristate '"dscp" and "tos" match support' 1242 depends on NETFILTER_ADVANCED 1243 help 1244 This option adds a `DSCP' match, which allows you to match against 1245 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1246 1247 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1248 1249 It will also add a "tos" match, which allows you to match packets 1250 based on the Type Of Service fields of the IPv4 packet (which share 1251 the same bits as DSCP). 1252 1253 To compile it as a module, choose M here. If unsure, say N. 1254 1255config NETFILTER_XT_MATCH_ECN 1256 tristate '"ecn" match support' 1257 depends on NETFILTER_ADVANCED 1258 ---help--- 1259 This option adds an "ECN" match, which allows you to match against 1260 the IPv4 and TCP header ECN fields. 1261 1262 To compile it as a module, choose M here. If unsure, say N. 1263 1264config NETFILTER_XT_MATCH_ESP 1265 tristate '"esp" match support' 1266 depends on NETFILTER_ADVANCED 1267 help 1268 This match extension allows you to match a range of SPIs 1269 inside ESP header of IPSec packets. 1270 1271 To compile it as a module, choose M here. If unsure, say N. 1272 1273config NETFILTER_XT_MATCH_HASHLIMIT 1274 tristate '"hashlimit" match support' 1275 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1276 depends on NETFILTER_ADVANCED 1277 help 1278 This option adds a `hashlimit' match. 1279 1280 As opposed to `limit', this match dynamically creates a hash table 1281 of limit buckets, based on your selection of source/destination 1282 addresses and/or ports. 1283 1284 It enables you to express policies like `10kpps for any given 1285 destination address' or `500pps from any given source address' 1286 with a single rule. 1287 1288config NETFILTER_XT_MATCH_HELPER 1289 tristate '"helper" match support' 1290 depends on NF_CONNTRACK 1291 depends on NETFILTER_ADVANCED 1292 help 1293 Helper matching allows you to match packets in dynamic connections 1294 tracked by a conntrack-helper, ie. ip_conntrack_ftp 1295 1296 To compile it as a module, choose M here. If unsure, say Y. 1297 1298config NETFILTER_XT_MATCH_HL 1299 tristate '"hl" hoplimit/TTL match support' 1300 depends on NETFILTER_ADVANCED 1301 ---help--- 1302 HL matching allows you to match packets based on the hoplimit 1303 in the IPv6 header, or the time-to-live field in the IPv4 1304 header of the packet. 1305 1306config NETFILTER_XT_MATCH_IPCOMP 1307 tristate '"ipcomp" match support' 1308 depends on NETFILTER_ADVANCED 1309 help 1310 This match extension allows you to match a range of CPIs(16 bits) 1311 inside IPComp header of IPSec packets. 1312 1313 To compile it as a module, choose M here. If unsure, say N. 1314 1315config NETFILTER_XT_MATCH_IPRANGE 1316 tristate '"iprange" address range match support' 1317 depends on NETFILTER_ADVANCED 1318 ---help--- 1319 This option adds a "iprange" match, which allows you to match based on 1320 an IP address range. (Normal iptables only matches on single addresses 1321 with an optional mask.) 1322 1323 If unsure, say M. 1324 1325config NETFILTER_XT_MATCH_IPVS 1326 tristate '"ipvs" match support' 1327 depends on IP_VS 1328 depends on NETFILTER_ADVANCED 1329 depends on NF_CONNTRACK 1330 help 1331 This option allows you to match against IPVS properties of a packet. 1332 1333 If unsure, say N. 1334 1335config NETFILTER_XT_MATCH_L2TP 1336 tristate '"l2tp" match support' 1337 depends on NETFILTER_ADVANCED 1338 default L2TP 1339 ---help--- 1340 This option adds an "L2TP" match, which allows you to match against 1341 L2TP protocol header fields. 1342 1343 To compile it as a module, choose M here. If unsure, say N. 1344 1345config NETFILTER_XT_MATCH_LENGTH 1346 tristate '"length" match support' 1347 depends on NETFILTER_ADVANCED 1348 help 1349 This option allows you to match the length of a packet against a 1350 specific value or range of values. 1351 1352 To compile it as a module, choose M here. If unsure, say N. 1353 1354config NETFILTER_XT_MATCH_LIMIT 1355 tristate '"limit" match support' 1356 depends on NETFILTER_ADVANCED 1357 help 1358 limit matching allows you to control the rate at which a rule can be 1359 matched: mainly useful in combination with the LOG target ("LOG 1360 target support", below) and to avoid some Denial of Service attacks. 1361 1362 To compile it as a module, choose M here. If unsure, say N. 1363 1364config NETFILTER_XT_MATCH_MAC 1365 tristate '"mac" address match support' 1366 depends on NETFILTER_ADVANCED 1367 help 1368 MAC matching allows you to match packets based on the source 1369 Ethernet address of the packet. 1370 1371 To compile it as a module, choose M here. If unsure, say N. 1372 1373config NETFILTER_XT_MATCH_MARK 1374 tristate '"mark" match support' 1375 depends on NETFILTER_ADVANCED 1376 select NETFILTER_XT_MARK 1377 ---help--- 1378 This is a backwards-compat option for the user's convenience 1379 (e.g. when running oldconfig). It selects 1380 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1381 1382config NETFILTER_XT_MATCH_MULTIPORT 1383 tristate '"multiport" Multiple port match support' 1384 depends on NETFILTER_ADVANCED 1385 help 1386 Multiport matching allows you to match TCP or UDP packets based on 1387 a series of source or destination ports: normally a rule can only 1388 match a single range of ports. 1389 1390 To compile it as a module, choose M here. If unsure, say N. 1391 1392config NETFILTER_XT_MATCH_NFACCT 1393 tristate '"nfacct" match support' 1394 depends on NETFILTER_ADVANCED 1395 select NETFILTER_NETLINK_ACCT 1396 help 1397 This option allows you to use the extended accounting through 1398 nfnetlink_acct. 1399 1400 To compile it as a module, choose M here. If unsure, say N. 1401 1402config NETFILTER_XT_MATCH_OSF 1403 tristate '"osf" Passive OS fingerprint match' 1404 depends on NETFILTER_ADVANCED 1405 select NETFILTER_NETLINK_OSF 1406 help 1407 This option selects the Passive OS Fingerprinting match module 1408 that allows to passively match the remote operating system by 1409 analyzing incoming TCP SYN packets. 1410 1411 Rules and loading software can be downloaded from 1412 http://www.ioremap.net/projects/osf 1413 1414 To compile it as a module, choose M here. If unsure, say N. 1415 1416config NETFILTER_XT_MATCH_OWNER 1417 tristate '"owner" match support' 1418 depends on NETFILTER_ADVANCED 1419 ---help--- 1420 Socket owner matching allows you to match locally-generated packets 1421 based on who created the socket: the user or group. It is also 1422 possible to check whether a socket actually exists. 1423 1424config NETFILTER_XT_MATCH_POLICY 1425 tristate 'IPsec "policy" match support' 1426 depends on XFRM 1427 default m if NETFILTER_ADVANCED=n 1428 help 1429 Policy matching allows you to match packets based on the 1430 IPsec policy that was used during decapsulation/will 1431 be used during encapsulation. 1432 1433 To compile it as a module, choose M here. If unsure, say N. 1434 1435config NETFILTER_XT_MATCH_PHYSDEV 1436 tristate '"physdev" match support' 1437 depends on BRIDGE && BRIDGE_NETFILTER 1438 depends on NETFILTER_ADVANCED 1439 help 1440 Physdev packet matching matches against the physical bridge ports 1441 the IP packet arrived on or will leave by. 1442 1443 To compile it as a module, choose M here. If unsure, say N. 1444 1445config NETFILTER_XT_MATCH_PKTTYPE 1446 tristate '"pkttype" packet type match support' 1447 depends on NETFILTER_ADVANCED 1448 help 1449 Packet type matching allows you to match a packet by 1450 its "class", eg. BROADCAST, MULTICAST, ... 1451 1452 Typical usage: 1453 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1454 1455 To compile it as a module, choose M here. If unsure, say N. 1456 1457config NETFILTER_XT_MATCH_QUOTA 1458 tristate '"quota" match support' 1459 depends on NETFILTER_ADVANCED 1460 help 1461 This option adds a `quota' match, which allows to match on a 1462 byte counter. 1463 1464 If you want to compile it as a module, say M here and read 1465 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1466 1467config NETFILTER_XT_MATCH_RATEEST 1468 tristate '"rateest" match support' 1469 depends on NETFILTER_ADVANCED 1470 select NETFILTER_XT_TARGET_RATEEST 1471 help 1472 This option adds a `rateest' match, which allows to match on the 1473 rate estimated by the RATEEST target. 1474 1475 To compile it as a module, choose M here. If unsure, say N. 1476 1477config NETFILTER_XT_MATCH_REALM 1478 tristate '"realm" match support' 1479 depends on NETFILTER_ADVANCED 1480 select IP_ROUTE_CLASSID 1481 help 1482 This option adds a `realm' match, which allows you to use the realm 1483 key from the routing subsystem inside iptables. 1484 1485 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1486 in tc world. 1487 1488 If you want to compile it as a module, say M here and read 1489 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1490 1491config NETFILTER_XT_MATCH_RECENT 1492 tristate '"recent" match support' 1493 depends on NETFILTER_ADVANCED 1494 ---help--- 1495 This match is used for creating one or many lists of recently 1496 used addresses and then matching against that/those list(s). 1497 1498 Short options are available by using 'iptables -m recent -h' 1499 Official Website: <http://snowman.net/projects/ipt_recent/> 1500 1501config NETFILTER_XT_MATCH_SCTP 1502 tristate '"sctp" protocol match support' 1503 depends on NETFILTER_ADVANCED 1504 default IP_SCTP 1505 help 1506 With this option enabled, you will be able to use the 1507 `sctp' match in order to match on SCTP source/destination ports 1508 and SCTP chunk types. 1509 1510 If you want to compile it as a module, say M here and read 1511 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1512 1513config NETFILTER_XT_MATCH_SOCKET 1514 tristate '"socket" match support' 1515 depends on NETFILTER_XTABLES 1516 depends on NETFILTER_ADVANCED 1517 depends on IPV6 || IPV6=n 1518 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1519 select NF_SOCKET_IPV4 1520 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES 1521 select NF_DEFRAG_IPV4 1522 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1523 help 1524 This option adds a `socket' match, which can be used to match 1525 packets for which a TCP or UDP socket lookup finds a valid socket. 1526 It can be used in combination with the MARK target and policy 1527 routing to implement full featured non-locally bound sockets. 1528 1529 To compile it as a module, choose M here. If unsure, say N. 1530 1531config NETFILTER_XT_MATCH_STATE 1532 tristate '"state" match support' 1533 depends on NF_CONNTRACK 1534 default m if NETFILTER_ADVANCED=n 1535 help 1536 Connection state matching allows you to match packets based on their 1537 relationship to a tracked connection (ie. previous packets). This 1538 is a powerful tool for packet classification. 1539 1540 To compile it as a module, choose M here. If unsure, say N. 1541 1542config NETFILTER_XT_MATCH_STATISTIC 1543 tristate '"statistic" match support' 1544 depends on NETFILTER_ADVANCED 1545 help 1546 This option adds a `statistic' match, which allows you to match 1547 on packets periodically or randomly with a given percentage. 1548 1549 To compile it as a module, choose M here. If unsure, say N. 1550 1551config NETFILTER_XT_MATCH_STRING 1552 tristate '"string" match support' 1553 depends on NETFILTER_ADVANCED 1554 select TEXTSEARCH 1555 select TEXTSEARCH_KMP 1556 select TEXTSEARCH_BM 1557 select TEXTSEARCH_FSM 1558 help 1559 This option adds a `string' match, which allows you to look for 1560 pattern matchings in packets. 1561 1562 To compile it as a module, choose M here. If unsure, say N. 1563 1564config NETFILTER_XT_MATCH_TCPMSS 1565 tristate '"tcpmss" match support' 1566 depends on NETFILTER_ADVANCED 1567 help 1568 This option adds a `tcpmss' match, which allows you to examine the 1569 MSS value of TCP SYN packets, which control the maximum packet size 1570 for that connection. 1571 1572 To compile it as a module, choose M here. If unsure, say N. 1573 1574config NETFILTER_XT_MATCH_TIME 1575 tristate '"time" match support' 1576 depends on NETFILTER_ADVANCED 1577 ---help--- 1578 This option adds a "time" match, which allows you to match based on 1579 the packet arrival time (at the machine which netfilter is running) 1580 on) or departure time/date (for locally generated packets). 1581 1582 If you say Y here, try `iptables -m time --help` for 1583 more information. 1584 1585 If you want to compile it as a module, say M here. 1586 If unsure, say N. 1587 1588config NETFILTER_XT_MATCH_U32 1589 tristate '"u32" match support' 1590 depends on NETFILTER_ADVANCED 1591 ---help--- 1592 u32 allows you to extract quantities of up to 4 bytes from a packet, 1593 AND them with specified masks, shift them by specified amounts and 1594 test whether the results are in any of a set of specified ranges. 1595 The specification of what to extract is general enough to skip over 1596 headers with lengths stored in the packet, as in IP or TCP header 1597 lengths. 1598 1599 Details and examples are in the kernel module source. 1600 1601endif # NETFILTER_XTABLES 1602 1603endmenu 1604 1605source "net/netfilter/ipset/Kconfig" 1606 1607source "net/netfilter/ipvs/Kconfig" 1608