1# SPDX-License-Identifier: GPL-2.0-only 2menu "Core Netfilter Configuration" 3 depends on INET && NETFILTER 4 5config NETFILTER_INGRESS 6 bool "Netfilter ingress support" 7 default y 8 select NET_INGRESS 9 help 10 This allows you to classify packets from ingress using the Netfilter 11 infrastructure. 12 13config NETFILTER_EGRESS 14 bool "Netfilter egress support" 15 default y 16 select NET_EGRESS 17 help 18 This allows you to classify packets before transmission using the 19 Netfilter infrastructure. 20 21config NETFILTER_SKIP_EGRESS 22 def_bool NETFILTER_EGRESS && (NET_CLS_ACT || IFB) 23 24config NETFILTER_NETLINK 25 tristate 26 27config NETFILTER_FAMILY_BRIDGE 28 bool 29 30config NETFILTER_FAMILY_ARP 31 bool 32 33config NETFILTER_NETLINK_HOOK 34 tristate "Netfilter base hook dump support" 35 depends on NETFILTER_ADVANCED 36 depends on NF_TABLES 37 select NETFILTER_NETLINK 38 help 39 If this option is enabled, the kernel will include support 40 to list the base netfilter hooks via NFNETLINK. 41 This is helpful for debugging. 42 43config NETFILTER_NETLINK_ACCT 44 tristate "Netfilter NFACCT over NFNETLINK interface" 45 depends on NETFILTER_ADVANCED 46 select NETFILTER_NETLINK 47 help 48 If this option is enabled, the kernel will include support 49 for extended accounting via NFNETLINK. 50 51config NETFILTER_NETLINK_QUEUE 52 tristate "Netfilter NFQUEUE over NFNETLINK interface" 53 depends on NETFILTER_ADVANCED 54 select NETFILTER_NETLINK 55 help 56 If this option is enabled, the kernel will include support 57 for queueing packets via NFNETLINK. 58 59config NETFILTER_NETLINK_LOG 60 tristate "Netfilter LOG over NFNETLINK interface" 61 default m if NETFILTER_ADVANCED=n 62 select NETFILTER_NETLINK 63 help 64 If this option is enabled, the kernel will include support 65 for logging packets via NFNETLINK. 66 67 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 68 and is also scheduled to replace the old syslog-based ipt_LOG 69 and ip6t_LOG modules. 70 71config NETFILTER_NETLINK_OSF 72 tristate "Netfilter OSF over NFNETLINK interface" 73 depends on NETFILTER_ADVANCED 74 select NETFILTER_NETLINK 75 help 76 If this option is enabled, the kernel will include support 77 for passive OS fingerprint via NFNETLINK. 78 79config NF_CONNTRACK 80 tristate "Netfilter connection tracking support" 81 default m if NETFILTER_ADVANCED=n 82 select NF_DEFRAG_IPV4 83 select NF_DEFRAG_IPV6 if IPV6 != n 84 help 85 Connection tracking keeps a record of what packets have passed 86 through your machine, in order to figure out how they are related 87 into connections. 88 89 This is required to do Masquerading or other kinds of Network 90 Address Translation. It can also be used to enhance packet 91 filtering (see `Connection state match support' below). 92 93 To compile it as a module, choose M here. If unsure, say N. 94 95config NF_LOG_SYSLOG 96 tristate "Syslog packet logging" 97 default m if NETFILTER_ADVANCED=n 98 help 99 This option enable support for packet logging via syslog. 100 It supports IPv4, IPV6, ARP and common transport protocols such 101 as TCP and UDP. 102 This is a simpler but less flexible logging method compared to 103 CONFIG_NETFILTER_NETLINK_LOG. 104 If both are enabled the backend to use can be configured at run-time 105 by means of per-address-family sysctl tunables. 106 107if NF_CONNTRACK 108config NETFILTER_CONNCOUNT 109 tristate 110 111config NF_CONNTRACK_MARK 112 bool 'Connection mark tracking support' 113 depends on NETFILTER_ADVANCED 114 help 115 This option enables support for connection marks, used by the 116 `CONNMARK' target and `connmark' match. Similar to the mark value 117 of packets, but this mark value is kept in the conntrack session 118 instead of the individual packets. 119 120config NF_CONNTRACK_SECMARK 121 bool 'Connection tracking security mark support' 122 depends on NETWORK_SECMARK 123 default y if NETFILTER_ADVANCED=n 124 help 125 This option enables security markings to be applied to 126 connections. Typically they are copied to connections from 127 packets using the CONNSECMARK target and copied back from 128 connections to packets with the same target, with the packets 129 being originally labeled via SECMARK. 130 131 If unsure, say 'N'. 132 133config NF_CONNTRACK_ZONES 134 bool 'Connection tracking zones' 135 depends on NETFILTER_ADVANCED 136 help 137 This option enables support for connection tracking zones. 138 Normally, each connection needs to have a unique system wide 139 identity. Connection tracking zones allow to have multiple 140 connections using the same identity, as long as they are 141 contained in different zones. 142 143 If unsure, say `N'. 144 145config NF_CONNTRACK_PROCFS 146 bool "Supply CT list in procfs (OBSOLETE)" 147 default y 148 depends on PROC_FS 149 help 150 This option enables for the list of known conntrack entries 151 to be shown in procfs under net/netfilter/nf_conntrack. This 152 is considered obsolete in favor of using the conntrack(8) 153 tool which uses Netlink. 154 155config NF_CONNTRACK_EVENTS 156 bool "Connection tracking events" 157 depends on NETFILTER_ADVANCED 158 help 159 If this option is enabled, the connection tracking code will 160 provide a notifier chain that can be used by other kernel code 161 to get notified about changes in the connection tracking state. 162 163 If unsure, say `N'. 164 165config NF_CONNTRACK_TIMEOUT 166 bool 'Connection tracking timeout' 167 depends on NETFILTER_ADVANCED 168 help 169 This option enables support for connection tracking timeout 170 extension. This allows you to attach timeout policies to flow 171 via the CT target. 172 173 If unsure, say `N'. 174 175config NF_CONNTRACK_TIMESTAMP 176 bool 'Connection tracking timestamping' 177 depends on NETFILTER_ADVANCED 178 help 179 This option enables support for connection tracking timestamping. 180 This allows you to store the flow start-time and to obtain 181 the flow-stop time (once it has been destroyed) via Connection 182 tracking events. 183 184 If unsure, say `N'. 185 186config NF_CONNTRACK_LABELS 187 bool "Connection tracking labels" 188 help 189 This option enables support for assigning user-defined flag bits 190 to connection tracking entries. It can be used with xtables connlabel 191 match and the nftables ct expression. 192 193config NF_CT_PROTO_DCCP 194 bool 'DCCP protocol connection tracking support' 195 depends on NETFILTER_ADVANCED 196 default y 197 help 198 With this option enabled, the layer 3 independent connection 199 tracking code will be able to do state tracking on DCCP connections. 200 201 If unsure, say Y. 202 203config NF_CT_PROTO_GRE 204 bool 205 206config NF_CT_PROTO_SCTP 207 bool 'SCTP protocol connection tracking support' 208 depends on NETFILTER_ADVANCED 209 default y 210 select LIBCRC32C 211 help 212 With this option enabled, the layer 3 independent connection 213 tracking code will be able to do state tracking on SCTP connections. 214 215 If unsure, say Y. 216 217config NF_CT_PROTO_UDPLITE 218 bool 'UDP-Lite protocol connection tracking support' 219 depends on NETFILTER_ADVANCED 220 default y 221 help 222 With this option enabled, the layer 3 independent connection 223 tracking code will be able to do state tracking on UDP-Lite 224 connections. 225 226 If unsure, say Y. 227 228config NF_CONNTRACK_AMANDA 229 tristate "Amanda backup protocol support" 230 depends on NETFILTER_ADVANCED 231 select TEXTSEARCH 232 select TEXTSEARCH_KMP 233 help 234 If you are running the Amanda backup package <http://www.amanda.org/> 235 on this machine or machines that will be MASQUERADED through this 236 machine, then you may want to enable this feature. This allows the 237 connection tracking and natting code to allow the sub-channels that 238 Amanda requires for communication of the backup data, messages and 239 index. 240 241 To compile it as a module, choose M here. If unsure, say N. 242 243config NF_CONNTRACK_FTP 244 tristate "FTP protocol support" 245 default m if NETFILTER_ADVANCED=n 246 help 247 Tracking FTP connections is problematic: special helpers are 248 required for tracking them, and doing masquerading and other forms 249 of Network Address Translation on them. 250 251 This is FTP support on Layer 3 independent connection tracking. 252 253 To compile it as a module, choose M here. If unsure, say N. 254 255config NF_CONNTRACK_H323 256 tristate "H.323 protocol support" 257 depends on IPV6 || IPV6=n 258 depends on NETFILTER_ADVANCED 259 help 260 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 261 important VoIP protocols, it is widely used by voice hardware and 262 software including voice gateways, IP phones, Netmeeting, OpenPhone, 263 Gnomemeeting, etc. 264 265 With this module you can support H.323 on a connection tracking/NAT 266 firewall. 267 268 This module supports RAS, Fast Start, H.245 Tunnelling, Call 269 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 270 whiteboard, file transfer, etc. For more information, please 271 visit http://nath323.sourceforge.net/. 272 273 To compile it as a module, choose M here. If unsure, say N. 274 275config NF_CONNTRACK_IRC 276 tristate "IRC protocol support" 277 default m if NETFILTER_ADVANCED=n 278 help 279 There is a commonly-used extension to IRC called 280 Direct Client-to-Client Protocol (DCC). This enables users to send 281 files to each other, and also chat to each other without the need 282 of a server. DCC Sending is used anywhere you send files over IRC, 283 and DCC Chat is most commonly used by Eggdrop bots. If you are 284 using NAT, this extension will enable you to send files and initiate 285 chats. Note that you do NOT need this extension to get files or 286 have others initiate chats, or everything else in IRC. 287 288 To compile it as a module, choose M here. If unsure, say N. 289 290config NF_CONNTRACK_BROADCAST 291 tristate 292 293config NF_CONNTRACK_NETBIOS_NS 294 tristate "NetBIOS name service protocol support" 295 select NF_CONNTRACK_BROADCAST 296 help 297 NetBIOS name service requests are sent as broadcast messages from an 298 unprivileged port and responded to with unicast messages to the 299 same port. This make them hard to firewall properly because connection 300 tracking doesn't deal with broadcasts. This helper tracks locally 301 originating NetBIOS name service requests and the corresponding 302 responses. It relies on correct IP address configuration, specifically 303 netmask and broadcast address. When properly configured, the output 304 of "ip address show" should look similar to this: 305 306 $ ip -4 address show eth0 307 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 308 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 309 310 To compile it as a module, choose M here. If unsure, say N. 311 312config NF_CONNTRACK_SNMP 313 tristate "SNMP service protocol support" 314 depends on NETFILTER_ADVANCED 315 select NF_CONNTRACK_BROADCAST 316 help 317 SNMP service requests are sent as broadcast messages from an 318 unprivileged port and responded to with unicast messages to the 319 same port. This make them hard to firewall properly because connection 320 tracking doesn't deal with broadcasts. This helper tracks locally 321 originating SNMP service requests and the corresponding 322 responses. It relies on correct IP address configuration, specifically 323 netmask and broadcast address. 324 325 To compile it as a module, choose M here. If unsure, say N. 326 327config NF_CONNTRACK_PPTP 328 tristate "PPtP protocol support" 329 depends on NETFILTER_ADVANCED 330 select NF_CT_PROTO_GRE 331 help 332 This module adds support for PPTP (Point to Point Tunnelling 333 Protocol, RFC2637) connection tracking and NAT. 334 335 If you are running PPTP sessions over a stateful firewall or NAT 336 box, you may want to enable this feature. 337 338 Please note that not all PPTP modes of operation are supported yet. 339 Specifically these limitations exist: 340 - Blindly assumes that control connections are always established 341 in PNS->PAC direction. This is a violation of RFC2637. 342 - Only supports a single call within each session 343 344 To compile it as a module, choose M here. If unsure, say N. 345 346config NF_CONNTRACK_SANE 347 tristate "SANE protocol support" 348 depends on NETFILTER_ADVANCED 349 help 350 SANE is a protocol for remote access to scanners as implemented 351 by the 'saned' daemon. Like FTP, it uses separate control and 352 data connections. 353 354 With this module you can support SANE on a connection tracking 355 firewall. 356 357 To compile it as a module, choose M here. If unsure, say N. 358 359config NF_CONNTRACK_SIP 360 tristate "SIP protocol support" 361 default m if NETFILTER_ADVANCED=n 362 help 363 SIP is an application-layer control protocol that can establish, 364 modify, and terminate multimedia sessions (conferences) such as 365 Internet telephony calls. With the nf_conntrack_sip and 366 the nf_nat_sip modules you can support the protocol on a connection 367 tracking/NATing firewall. 368 369 To compile it as a module, choose M here. If unsure, say N. 370 371config NF_CONNTRACK_TFTP 372 tristate "TFTP protocol support" 373 depends on NETFILTER_ADVANCED 374 help 375 TFTP connection tracking helper, this is required depending 376 on how restrictive your ruleset is. 377 If you are using a tftp client behind -j SNAT or -j MASQUERADING 378 you will need this. 379 380 To compile it as a module, choose M here. If unsure, say N. 381 382config NF_CT_NETLINK 383 tristate 'Connection tracking netlink interface' 384 select NETFILTER_NETLINK 385 default m if NETFILTER_ADVANCED=n 386 help 387 This option enables support for a netlink-based userspace interface 388 389config NF_CT_NETLINK_TIMEOUT 390 tristate 'Connection tracking timeout tuning via Netlink' 391 select NETFILTER_NETLINK 392 depends on NETFILTER_ADVANCED 393 depends on NF_CONNTRACK_TIMEOUT 394 help 395 This option enables support for connection tracking timeout 396 fine-grain tuning. This allows you to attach specific timeout 397 policies to flows, instead of using the global timeout policy. 398 399 If unsure, say `N'. 400 401config NF_CT_NETLINK_HELPER 402 tristate 'Connection tracking helpers in user-space via Netlink' 403 select NETFILTER_NETLINK 404 depends on NF_CT_NETLINK 405 depends on NETFILTER_NETLINK_QUEUE 406 depends on NETFILTER_NETLINK_GLUE_CT 407 depends on NETFILTER_ADVANCED 408 help 409 This option enables the user-space connection tracking helpers 410 infrastructure. 411 412 If unsure, say `N'. 413 414config NETFILTER_NETLINK_GLUE_CT 415 bool "NFQUEUE and NFLOG integration with Connection Tracking" 416 default n 417 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 418 help 419 If this option is enabled, NFQUEUE and NFLOG can include 420 Connection Tracking information together with the packet is 421 the enqueued via NFNETLINK. 422 423config NF_NAT 424 tristate "Network Address Translation support" 425 depends on NF_CONNTRACK 426 default m if NETFILTER_ADVANCED=n 427 help 428 The NAT option allows masquerading, port forwarding and other 429 forms of full Network Address Port Translation. This can be 430 controlled by iptables, ip6tables or nft. 431 432config NF_NAT_AMANDA 433 tristate 434 depends on NF_CONNTRACK && NF_NAT 435 default NF_NAT && NF_CONNTRACK_AMANDA 436 437config NF_NAT_FTP 438 tristate 439 depends on NF_CONNTRACK && NF_NAT 440 default NF_NAT && NF_CONNTRACK_FTP 441 442config NF_NAT_IRC 443 tristate 444 depends on NF_CONNTRACK && NF_NAT 445 default NF_NAT && NF_CONNTRACK_IRC 446 447config NF_NAT_SIP 448 tristate 449 depends on NF_CONNTRACK && NF_NAT 450 default NF_NAT && NF_CONNTRACK_SIP 451 452config NF_NAT_TFTP 453 tristate 454 depends on NF_CONNTRACK && NF_NAT 455 default NF_NAT && NF_CONNTRACK_TFTP 456 457config NF_NAT_REDIRECT 458 bool 459 460config NF_NAT_MASQUERADE 461 bool 462 463config NETFILTER_SYNPROXY 464 tristate 465 466endif # NF_CONNTRACK 467 468config NF_TABLES 469 select NETFILTER_NETLINK 470 select LIBCRC32C 471 tristate "Netfilter nf_tables support" 472 help 473 nftables is the new packet classification framework that intends to 474 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 475 provides a pseudo-state machine with an extensible instruction-set 476 (also known as expressions) that the userspace 'nft' utility 477 (https://www.netfilter.org/projects/nftables) uses to build the 478 rule-set. It also comes with the generic set infrastructure that 479 allows you to construct mappings between matchings and actions 480 for performance lookups. 481 482 To compile it as a module, choose M here. 483 484if NF_TABLES 485config NF_TABLES_INET 486 depends on IPV6 487 select NF_TABLES_IPV4 488 select NF_TABLES_IPV6 489 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support" 490 help 491 This option enables support for a mixed IPv4/IPv6 "inet" table. 492 493config NF_TABLES_NETDEV 494 bool "Netfilter nf_tables netdev tables support" 495 help 496 This option enables support for the "netdev" table. 497 498config NFT_NUMGEN 499 tristate "Netfilter nf_tables number generator module" 500 help 501 This option adds the number generator expression used to perform 502 incremental counting and random numbers bound to a upper limit. 503 504config NFT_CT 505 depends on NF_CONNTRACK 506 tristate "Netfilter nf_tables conntrack module" 507 help 508 This option adds the "ct" expression that you can use to match 509 connection tracking information such as the flow state. 510 511config NFT_FLOW_OFFLOAD 512 depends on NF_CONNTRACK && NF_FLOW_TABLE 513 tristate "Netfilter nf_tables hardware flow offload module" 514 help 515 This option adds the "flow_offload" expression that you can use to 516 choose what flows are placed into the hardware. 517 518config NFT_CONNLIMIT 519 tristate "Netfilter nf_tables connlimit module" 520 depends on NF_CONNTRACK 521 depends on NETFILTER_ADVANCED 522 select NETFILTER_CONNCOUNT 523 help 524 This option adds the "connlimit" expression that you can use to 525 ratelimit rule matchings per connections. 526 527config NFT_LOG 528 tristate "Netfilter nf_tables log module" 529 help 530 This option adds the "log" expression that you can use to log 531 packets matching some criteria. 532 533config NFT_LIMIT 534 tristate "Netfilter nf_tables limit module" 535 help 536 This option adds the "limit" expression that you can use to 537 ratelimit rule matchings. 538 539config NFT_MASQ 540 depends on NF_CONNTRACK 541 depends on NF_NAT 542 select NF_NAT_MASQUERADE 543 tristate "Netfilter nf_tables masquerade support" 544 help 545 This option adds the "masquerade" expression that you can use 546 to perform NAT in the masquerade flavour. 547 548config NFT_REDIR 549 depends on NF_CONNTRACK 550 depends on NF_NAT 551 tristate "Netfilter nf_tables redirect support" 552 select NF_NAT_REDIRECT 553 help 554 This options adds the "redirect" expression that you can use 555 to perform NAT in the redirect flavour. 556 557config NFT_NAT 558 depends on NF_CONNTRACK 559 select NF_NAT 560 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6 561 tristate "Netfilter nf_tables nat module" 562 help 563 This option adds the "nat" expression that you can use to perform 564 typical Network Address Translation (NAT) packet transformations. 565 566config NFT_TUNNEL 567 tristate "Netfilter nf_tables tunnel module" 568 help 569 This option adds the "tunnel" expression that you can use to set 570 tunneling policies. 571 572config NFT_OBJREF 573 tristate "Netfilter nf_tables stateful object reference module" 574 help 575 This option adds the "objref" expression that allows you to refer to 576 stateful objects, such as counters and quotas. 577 578config NFT_QUEUE 579 depends on NETFILTER_NETLINK_QUEUE 580 tristate "Netfilter nf_tables queue module" 581 help 582 This is required if you intend to use the userspace queueing 583 infrastructure (also known as NFQUEUE) from nftables. 584 585config NFT_QUOTA 586 tristate "Netfilter nf_tables quota module" 587 help 588 This option adds the "quota" expression that you can use to match 589 enforce bytes quotas. 590 591config NFT_REJECT 592 default m if NETFILTER_ADVANCED=n 593 tristate "Netfilter nf_tables reject support" 594 depends on !NF_TABLES_INET || (IPV6!=m || m) 595 help 596 This option adds the "reject" expression that you can use to 597 explicitly deny and notify via TCP reset/ICMP informational errors 598 unallowed traffic. 599 600config NFT_REJECT_INET 601 depends on NF_TABLES_INET 602 default NFT_REJECT 603 tristate 604 605config NFT_COMPAT 606 depends on NETFILTER_XTABLES 607 tristate "Netfilter x_tables over nf_tables module" 608 help 609 This is required if you intend to use any of existing 610 x_tables match/target extensions over the nf_tables 611 framework. 612 613config NFT_HASH 614 tristate "Netfilter nf_tables hash module" 615 help 616 This option adds the "hash" expression that you can use to perform 617 a hash operation on registers. 618 619config NFT_FIB 620 tristate 621 622config NFT_FIB_INET 623 depends on NF_TABLES_INET 624 depends on NFT_FIB_IPV4 625 depends on NFT_FIB_IPV6 626 tristate "Netfilter nf_tables fib inet support" 627 help 628 This option allows using the FIB expression from the inet table. 629 The lookup will be delegated to the IPv4 or IPv6 FIB depending 630 on the protocol of the packet. 631 632config NFT_XFRM 633 tristate "Netfilter nf_tables xfrm/IPSec security association matching" 634 depends on XFRM 635 help 636 This option adds an expression that you can use to extract properties 637 of a packets security association. 638 639config NFT_SOCKET 640 tristate "Netfilter nf_tables socket match support" 641 depends on IPV6 || IPV6=n 642 select NF_SOCKET_IPV4 643 select NF_SOCKET_IPV6 if NF_TABLES_IPV6 644 help 645 This option allows matching for the presence or absence of a 646 corresponding socket and its attributes. 647 648config NFT_OSF 649 tristate "Netfilter nf_tables passive OS fingerprint support" 650 depends on NETFILTER_ADVANCED 651 select NETFILTER_NETLINK_OSF 652 help 653 This option allows matching packets from an specific OS. 654 655config NFT_TPROXY 656 tristate "Netfilter nf_tables tproxy support" 657 depends on IPV6 || IPV6=n 658 select NF_DEFRAG_IPV4 659 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6 660 select NF_TPROXY_IPV4 661 select NF_TPROXY_IPV6 if NF_TABLES_IPV6 662 help 663 This makes transparent proxy support available in nftables. 664 665config NFT_SYNPROXY 666 tristate "Netfilter nf_tables SYNPROXY expression support" 667 depends on NF_CONNTRACK && NETFILTER_ADVANCED 668 select NETFILTER_SYNPROXY 669 select SYN_COOKIES 670 help 671 The SYNPROXY expression allows you to intercept TCP connections and 672 establish them using syncookies before they are passed on to the 673 server. This allows to avoid conntrack and server resource usage 674 during SYN-flood attacks. 675 676if NF_TABLES_NETDEV 677 678config NF_DUP_NETDEV 679 tristate "Netfilter packet duplication support" 680 help 681 This option enables the generic packet duplication infrastructure 682 for Netfilter. 683 684config NFT_DUP_NETDEV 685 tristate "Netfilter nf_tables netdev packet duplication support" 686 select NF_DUP_NETDEV 687 help 688 This option enables packet duplication for the "netdev" family. 689 690config NFT_FWD_NETDEV 691 tristate "Netfilter nf_tables netdev packet forwarding support" 692 select NF_DUP_NETDEV 693 help 694 This option enables packet forwarding for the "netdev" family. 695 696config NFT_FIB_NETDEV 697 depends on NFT_FIB_IPV4 698 depends on NFT_FIB_IPV6 699 tristate "Netfilter nf_tables netdev fib lookups support" 700 help 701 This option allows using the FIB expression from the netdev table. 702 The lookup will be delegated to the IPv4 or IPv6 FIB depending 703 on the protocol of the packet. 704 705config NFT_REJECT_NETDEV 706 depends on NFT_REJECT_IPV4 707 depends on NFT_REJECT_IPV6 708 tristate "Netfilter nf_tables netdev REJECT support" 709 help 710 This option enables the REJECT support from the netdev table. 711 The return packet generation will be delegated to the IPv4 712 or IPv6 ICMP or TCP RST implementation depending on the 713 protocol of the packet. 714 715endif # NF_TABLES_NETDEV 716 717endif # NF_TABLES 718 719config NF_FLOW_TABLE_INET 720 tristate "Netfilter flow table mixed IPv4/IPv6 module" 721 depends on NF_FLOW_TABLE 722 help 723 This option adds the flow table mixed IPv4/IPv6 support. 724 725 To compile it as a module, choose M here. 726 727config NF_FLOW_TABLE 728 tristate "Netfilter flow table module" 729 depends on NETFILTER_INGRESS 730 depends on NF_CONNTRACK 731 depends on NF_TABLES 732 help 733 This option adds the flow table core infrastructure. 734 735 To compile it as a module, choose M here. 736 737config NF_FLOW_TABLE_PROCFS 738 bool "Supply flow table statistics in procfs" 739 depends on NF_FLOW_TABLE 740 depends on PROC_FS 741 help 742 This option enables for the flow table offload statistics 743 to be shown in procfs under net/netfilter/nf_flowtable. 744 745config NETFILTER_XTABLES 746 tristate "Netfilter Xtables support (required for ip_tables)" 747 default m if NETFILTER_ADVANCED=n 748 help 749 This is required if you intend to use any of ip_tables, 750 ip6_tables or arp_tables. 751 752if NETFILTER_XTABLES 753 754config NETFILTER_XTABLES_COMPAT 755 bool "Netfilter Xtables 32bit support" 756 depends on COMPAT 757 default y 758 help 759 This option provides a translation layer to run 32bit arp,ip(6),ebtables 760 binaries on 64bit kernels. 761 762 If unsure, say N. 763 764comment "Xtables combined modules" 765 766config NETFILTER_XT_MARK 767 tristate 'nfmark target and match support' 768 default m if NETFILTER_ADVANCED=n 769 help 770 This option adds the "MARK" target and "mark" match. 771 772 Netfilter mark matching allows you to match packets based on the 773 "nfmark" value in the packet. 774 The target allows you to create rules in the "mangle" table which alter 775 the netfilter mark (nfmark) field associated with the packet. 776 777 Prior to routing, the nfmark can influence the routing method and can 778 also be used by other subsystems to change their behavior. 779 780config NETFILTER_XT_CONNMARK 781 tristate 'ctmark target and match support' 782 depends on NF_CONNTRACK 783 depends on NETFILTER_ADVANCED 784 select NF_CONNTRACK_MARK 785 help 786 This option adds the "CONNMARK" target and "connmark" match. 787 788 Netfilter allows you to store a mark value per connection (a.k.a. 789 ctmark), similarly to the packet mark (nfmark). Using this 790 target and match, you can set and match on this mark. 791 792config NETFILTER_XT_SET 793 tristate 'set target and match support' 794 depends on IP_SET 795 depends on NETFILTER_ADVANCED 796 help 797 This option adds the "SET" target and "set" match. 798 799 Using this target and match, you can add/delete and match 800 elements in the sets created by ipset(8). 801 802 To compile it as a module, choose M here. If unsure, say N. 803 804# alphabetically ordered list of targets 805 806comment "Xtables targets" 807 808config NETFILTER_XT_TARGET_AUDIT 809 tristate "AUDIT target support" 810 depends on AUDIT 811 depends on NETFILTER_ADVANCED 812 help 813 This option adds a 'AUDIT' target, which can be used to create 814 audit records for packets dropped/accepted. 815 816 To compileit as a module, choose M here. If unsure, say N. 817 818config NETFILTER_XT_TARGET_CHECKSUM 819 tristate "CHECKSUM target support" 820 depends on IP_NF_MANGLE || IP6_NF_MANGLE 821 depends on NETFILTER_ADVANCED 822 help 823 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 824 table to work around buggy DHCP clients in virtualized environments. 825 826 Some old DHCP clients drop packets because they are not aware 827 that the checksum would normally be offloaded to hardware and 828 thus should be considered valid. 829 This target can be used to fill in the checksum using iptables 830 when such packets are sent via a virtual network device. 831 832 To compile it as a module, choose M here. If unsure, say N. 833 834config NETFILTER_XT_TARGET_CLASSIFY 835 tristate '"CLASSIFY" target support' 836 depends on NETFILTER_ADVANCED 837 help 838 This option adds a `CLASSIFY' target, which enables the user to set 839 the priority of a packet. Some qdiscs can use this value for 840 classification, among these are: 841 842 atm, cbq, dsmark, pfifo_fast, htb, prio 843 844 To compile it as a module, choose M here. If unsure, say N. 845 846config NETFILTER_XT_TARGET_CONNMARK 847 tristate '"CONNMARK" target support' 848 depends on NF_CONNTRACK 849 depends on NETFILTER_ADVANCED 850 select NETFILTER_XT_CONNMARK 851 help 852 This is a backwards-compat option for the user's convenience 853 (e.g. when running oldconfig). It selects 854 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 855 856config NETFILTER_XT_TARGET_CONNSECMARK 857 tristate '"CONNSECMARK" target support' 858 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 859 default m if NETFILTER_ADVANCED=n 860 help 861 The CONNSECMARK target copies security markings from packets 862 to connections, and restores security markings from connections 863 to packets (if the packets are not already marked). This would 864 normally be used in conjunction with the SECMARK target. 865 866 To compile it as a module, choose M here. If unsure, say N. 867 868config NETFILTER_XT_TARGET_CT 869 tristate '"CT" target support' 870 depends on NF_CONNTRACK 871 depends on IP_NF_RAW || IP6_NF_RAW 872 depends on NETFILTER_ADVANCED 873 help 874 This options adds a `CT' target, which allows to specify initial 875 connection tracking parameters like events to be delivered and 876 the helper to be used. 877 878 To compile it as a module, choose M here. If unsure, say N. 879 880config NETFILTER_XT_TARGET_DSCP 881 tristate '"DSCP" and "TOS" target support' 882 depends on IP_NF_MANGLE || IP6_NF_MANGLE 883 depends on NETFILTER_ADVANCED 884 help 885 This option adds a `DSCP' target, which allows you to manipulate 886 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 887 888 The DSCP field can have any value between 0x0 and 0x3f inclusive. 889 890 It also adds the "TOS" target, which allows you to create rules in 891 the "mangle" table which alter the Type Of Service field of an IPv4 892 or the Priority field of an IPv6 packet, prior to routing. 893 894 To compile it as a module, choose M here. If unsure, say N. 895 896config NETFILTER_XT_TARGET_HL 897 tristate '"HL" hoplimit target support' 898 depends on IP_NF_MANGLE || IP6_NF_MANGLE 899 depends on NETFILTER_ADVANCED 900 help 901 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 902 targets, which enable the user to change the 903 hoplimit/time-to-live value of the IP header. 904 905 While it is safe to decrement the hoplimit/TTL value, the 906 modules also allow to increment and set the hoplimit value of 907 the header to arbitrary values. This is EXTREMELY DANGEROUS 908 since you can easily create immortal packets that loop 909 forever on the network. 910 911config NETFILTER_XT_TARGET_HMARK 912 tristate '"HMARK" target support' 913 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 914 depends on NETFILTER_ADVANCED 915 help 916 This option adds the "HMARK" target. 917 918 The target allows you to create rules in the "raw" and "mangle" tables 919 which set the skbuff mark by means of hash calculation within a given 920 range. The nfmark can influence the routing method and can also be used 921 by other subsystems to change their behaviour. 922 923 To compile it as a module, choose M here. If unsure, say N. 924 925config NETFILTER_XT_TARGET_IDLETIMER 926 tristate "IDLETIMER target support" 927 depends on NETFILTER_ADVANCED 928 help 929 930 This option adds the `IDLETIMER' target. Each matching packet 931 resets the timer associated with label specified when the rule is 932 added. When the timer expires, it triggers a sysfs notification. 933 The remaining time for expiration can be read via sysfs. 934 935 To compile it as a module, choose M here. If unsure, say N. 936 937config NETFILTER_XT_TARGET_LED 938 tristate '"LED" target support' 939 depends on LEDS_CLASS && LEDS_TRIGGERS 940 depends on NETFILTER_ADVANCED 941 help 942 This option adds a `LED' target, which allows you to blink LEDs in 943 response to particular packets passing through your machine. 944 945 This can be used to turn a spare LED into a network activity LED, 946 which only flashes in response to FTP transfers, for example. Or 947 you could have an LED which lights up for a minute or two every time 948 somebody connects to your machine via SSH. 949 950 You will need support for the "led" class to make this work. 951 952 To create an LED trigger for incoming SSH traffic: 953 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 954 955 Then attach the new trigger to an LED on your system: 956 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 957 958 For more information on the LEDs available on your system, see 959 Documentation/leds/leds-class.rst 960 961config NETFILTER_XT_TARGET_LOG 962 tristate "LOG target support" 963 select NF_LOG_SYSLOG 964 select NF_LOG_IPV6 if IP6_NF_IPTABLES 965 default m if NETFILTER_ADVANCED=n 966 help 967 This option adds a `LOG' target, which allows you to create rules in 968 any iptables table which records the packet header to the syslog. 969 970 To compile it as a module, choose M here. If unsure, say N. 971 972config NETFILTER_XT_TARGET_MARK 973 tristate '"MARK" target support' 974 depends on NETFILTER_ADVANCED 975 select NETFILTER_XT_MARK 976 help 977 This is a backwards-compat option for the user's convenience 978 (e.g. when running oldconfig). It selects 979 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 980 981config NETFILTER_XT_NAT 982 tristate '"SNAT and DNAT" targets support' 983 depends on NF_NAT 984 help 985 This option enables the SNAT and DNAT targets. 986 987 To compile it as a module, choose M here. If unsure, say N. 988 989config NETFILTER_XT_TARGET_NETMAP 990 tristate '"NETMAP" target support' 991 depends on NF_NAT 992 help 993 NETMAP is an implementation of static 1:1 NAT mapping of network 994 addresses. It maps the network address part, while keeping the host 995 address part intact. 996 997 To compile it as a module, choose M here. If unsure, say N. 998 999config NETFILTER_XT_TARGET_NFLOG 1000 tristate '"NFLOG" target support' 1001 default m if NETFILTER_ADVANCED=n 1002 select NETFILTER_NETLINK_LOG 1003 help 1004 This option enables the NFLOG target, which allows to LOG 1005 messages through nfnetlink_log. 1006 1007 To compile it as a module, choose M here. If unsure, say N. 1008 1009config NETFILTER_XT_TARGET_NFQUEUE 1010 tristate '"NFQUEUE" target Support' 1011 depends on NETFILTER_ADVANCED 1012 select NETFILTER_NETLINK_QUEUE 1013 help 1014 This target replaced the old obsolete QUEUE target. 1015 1016 As opposed to QUEUE, it supports 65535 different queues, 1017 not just one. 1018 1019 To compile it as a module, choose M here. If unsure, say N. 1020 1021config NETFILTER_XT_TARGET_NOTRACK 1022 tristate '"NOTRACK" target support (DEPRECATED)' 1023 depends on NF_CONNTRACK 1024 depends on IP_NF_RAW || IP6_NF_RAW 1025 depends on NETFILTER_ADVANCED 1026 select NETFILTER_XT_TARGET_CT 1027 1028config NETFILTER_XT_TARGET_RATEEST 1029 tristate '"RATEEST" target support' 1030 depends on NETFILTER_ADVANCED 1031 help 1032 This option adds a `RATEEST' target, which allows to measure 1033 rates similar to TC estimators. The `rateest' match can be 1034 used to match on the measured rates. 1035 1036 To compile it as a module, choose M here. If unsure, say N. 1037 1038config NETFILTER_XT_TARGET_REDIRECT 1039 tristate "REDIRECT target support" 1040 depends on NF_NAT 1041 select NF_NAT_REDIRECT 1042 help 1043 REDIRECT is a special case of NAT: all incoming connections are 1044 mapped onto the incoming interface's address, causing the packets to 1045 come to the local machine instead of passing through. This is 1046 useful for transparent proxies. 1047 1048 To compile it as a module, choose M here. If unsure, say N. 1049 1050config NETFILTER_XT_TARGET_MASQUERADE 1051 tristate "MASQUERADE target support" 1052 depends on NF_NAT 1053 default m if NETFILTER_ADVANCED=n 1054 select NF_NAT_MASQUERADE 1055 help 1056 Masquerading is a special case of NAT: all outgoing connections are 1057 changed to seem to come from a particular interface's address, and 1058 if the interface goes down, those connections are lost. This is 1059 only useful for dialup accounts with dynamic IP address (ie. your IP 1060 address will be different on next dialup). 1061 1062 To compile it as a module, choose M here. If unsure, say N. 1063 1064config NETFILTER_XT_TARGET_TEE 1065 tristate '"TEE" - packet cloning to alternate destination' 1066 depends on NETFILTER_ADVANCED 1067 depends on IPV6 || IPV6=n 1068 depends on !NF_CONNTRACK || NF_CONNTRACK 1069 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES 1070 select NF_DUP_IPV4 1071 select NF_DUP_IPV6 if IP6_NF_IPTABLES 1072 help 1073 This option adds a "TEE" target with which a packet can be cloned and 1074 this clone be rerouted to another nexthop. 1075 1076config NETFILTER_XT_TARGET_TPROXY 1077 tristate '"TPROXY" target transparent proxying support' 1078 depends on NETFILTER_XTABLES 1079 depends on NETFILTER_ADVANCED 1080 depends on IPV6 || IPV6=n 1081 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1082 depends on IP_NF_MANGLE 1083 select NF_DEFRAG_IPV4 1084 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1085 select NF_TPROXY_IPV4 1086 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES 1087 help 1088 This option adds a `TPROXY' target, which is somewhat similar to 1089 REDIRECT. It can only be used in the mangle table and is useful 1090 to redirect traffic to a transparent proxy. It does _not_ depend 1091 on Netfilter connection tracking and NAT, unlike REDIRECT. 1092 For it to work you will have to configure certain iptables rules 1093 and use policy routing. For more information on how to set it up 1094 see Documentation/networking/tproxy.rst. 1095 1096 To compile it as a module, choose M here. If unsure, say N. 1097 1098config NETFILTER_XT_TARGET_TRACE 1099 tristate '"TRACE" target support' 1100 depends on IP_NF_RAW || IP6_NF_RAW 1101 depends on NETFILTER_ADVANCED 1102 help 1103 The TRACE target allows you to mark packets so that the kernel 1104 will log every rule which match the packets as those traverse 1105 the tables, chains, rules. 1106 1107 If you want to compile it as a module, say M here and read 1108 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1109 1110config NETFILTER_XT_TARGET_SECMARK 1111 tristate '"SECMARK" target support' 1112 depends on NETWORK_SECMARK 1113 default m if NETFILTER_ADVANCED=n 1114 help 1115 The SECMARK target allows security marking of network 1116 packets, for use with security subsystems. 1117 1118 To compile it as a module, choose M here. If unsure, say N. 1119 1120config NETFILTER_XT_TARGET_TCPMSS 1121 tristate '"TCPMSS" target support' 1122 depends on IPV6 || IPV6=n 1123 default m if NETFILTER_ADVANCED=n 1124 help 1125 This option adds a `TCPMSS' target, which allows you to alter the 1126 MSS value of TCP SYN packets, to control the maximum size for that 1127 connection (usually limiting it to your outgoing interface's MTU 1128 minus 40). 1129 1130 This is used to overcome criminally braindead ISPs or servers which 1131 block ICMP Fragmentation Needed packets. The symptoms of this 1132 problem are that everything works fine from your Linux 1133 firewall/router, but machines behind it can never exchange large 1134 packets: 1135 1) Web browsers connect, then hang with no data received. 1136 2) Small mail works fine, but large emails hang. 1137 3) ssh works fine, but scp hangs after initial handshaking. 1138 1139 Workaround: activate this option and add a rule to your firewall 1140 configuration like: 1141 1142 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1143 -j TCPMSS --clamp-mss-to-pmtu 1144 1145 To compile it as a module, choose M here. If unsure, say N. 1146 1147config NETFILTER_XT_TARGET_TCPOPTSTRIP 1148 tristate '"TCPOPTSTRIP" target support' 1149 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1150 depends on NETFILTER_ADVANCED 1151 help 1152 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1153 TCP options from TCP packets. 1154 1155# alphabetically ordered list of matches 1156 1157comment "Xtables matches" 1158 1159config NETFILTER_XT_MATCH_ADDRTYPE 1160 tristate '"addrtype" address type match support' 1161 default m if NETFILTER_ADVANCED=n 1162 help 1163 This option allows you to match what routing thinks of an address, 1164 eg. UNICAST, LOCAL, BROADCAST, ... 1165 1166 If you want to compile it as a module, say M here and read 1167 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1168 1169config NETFILTER_XT_MATCH_BPF 1170 tristate '"bpf" match support' 1171 depends on NETFILTER_ADVANCED 1172 help 1173 BPF matching applies a linux socket filter to each packet and 1174 accepts those for which the filter returns non-zero. 1175 1176 To compile it as a module, choose M here. If unsure, say N. 1177 1178config NETFILTER_XT_MATCH_CGROUP 1179 tristate '"control group" match support' 1180 depends on NETFILTER_ADVANCED 1181 depends on CGROUPS 1182 select CGROUP_NET_CLASSID 1183 help 1184 Socket/process control group matching allows you to match locally 1185 generated packets based on which net_cls control group processes 1186 belong to. 1187 1188config NETFILTER_XT_MATCH_CLUSTER 1189 tristate '"cluster" match support' 1190 depends on NF_CONNTRACK 1191 depends on NETFILTER_ADVANCED 1192 help 1193 This option allows you to build work-load-sharing clusters of 1194 network servers/stateful firewalls without having a dedicated 1195 load-balancing router/server/switch. Basically, this match returns 1196 true when the packet must be handled by this cluster node. Thus, 1197 all nodes see all packets and this match decides which node handles 1198 what packets. The work-load sharing algorithm is based on source 1199 address hashing. 1200 1201 If you say Y or M here, try `iptables -m cluster --help` for 1202 more information. 1203 1204config NETFILTER_XT_MATCH_COMMENT 1205 tristate '"comment" match support' 1206 depends on NETFILTER_ADVANCED 1207 help 1208 This option adds a `comment' dummy-match, which allows you to put 1209 comments in your iptables ruleset. 1210 1211 If you want to compile it as a module, say M here and read 1212 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1213 1214config NETFILTER_XT_MATCH_CONNBYTES 1215 tristate '"connbytes" per-connection counter match support' 1216 depends on NF_CONNTRACK 1217 depends on NETFILTER_ADVANCED 1218 help 1219 This option adds a `connbytes' match, which allows you to match the 1220 number of bytes and/or packets for each direction within a connection. 1221 1222 If you want to compile it as a module, say M here and read 1223 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1224 1225config NETFILTER_XT_MATCH_CONNLABEL 1226 tristate '"connlabel" match support' 1227 select NF_CONNTRACK_LABELS 1228 depends on NF_CONNTRACK 1229 depends on NETFILTER_ADVANCED 1230 help 1231 This match allows you to test and assign userspace-defined labels names 1232 to a connection. The kernel only stores bit values - mapping 1233 names to bits is done by userspace. 1234 1235 Unlike connmark, more than 32 flag bits may be assigned to a 1236 connection simultaneously. 1237 1238config NETFILTER_XT_MATCH_CONNLIMIT 1239 tristate '"connlimit" match support' 1240 depends on NF_CONNTRACK 1241 depends on NETFILTER_ADVANCED 1242 select NETFILTER_CONNCOUNT 1243 help 1244 This match allows you to match against the number of parallel 1245 connections to a server per client IP address (or address block). 1246 1247config NETFILTER_XT_MATCH_CONNMARK 1248 tristate '"connmark" connection mark match support' 1249 depends on NF_CONNTRACK 1250 depends on NETFILTER_ADVANCED 1251 select NETFILTER_XT_CONNMARK 1252 help 1253 This is a backwards-compat option for the user's convenience 1254 (e.g. when running oldconfig). It selects 1255 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1256 1257config NETFILTER_XT_MATCH_CONNTRACK 1258 tristate '"conntrack" connection tracking match support' 1259 depends on NF_CONNTRACK 1260 default m if NETFILTER_ADVANCED=n 1261 help 1262 This is a general conntrack match module, a superset of the state match. 1263 1264 It allows matching on additional conntrack information, which is 1265 useful in complex configurations, such as NAT gateways with multiple 1266 internet links or tunnels. 1267 1268 To compile it as a module, choose M here. If unsure, say N. 1269 1270config NETFILTER_XT_MATCH_CPU 1271 tristate '"cpu" match support' 1272 depends on NETFILTER_ADVANCED 1273 help 1274 CPU matching allows you to match packets based on the CPU 1275 currently handling the packet. 1276 1277 To compile it as a module, choose M here. If unsure, say N. 1278 1279config NETFILTER_XT_MATCH_DCCP 1280 tristate '"dccp" protocol match support' 1281 depends on NETFILTER_ADVANCED 1282 default IP_DCCP 1283 help 1284 With this option enabled, you will be able to use the iptables 1285 `dccp' match in order to match on DCCP source/destination ports 1286 and DCCP flags. 1287 1288 If you want to compile it as a module, say M here and read 1289 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1290 1291config NETFILTER_XT_MATCH_DEVGROUP 1292 tristate '"devgroup" match support' 1293 depends on NETFILTER_ADVANCED 1294 help 1295 This options adds a `devgroup' match, which allows to match on the 1296 device group a network device is assigned to. 1297 1298 To compile it as a module, choose M here. If unsure, say N. 1299 1300config NETFILTER_XT_MATCH_DSCP 1301 tristate '"dscp" and "tos" match support' 1302 depends on NETFILTER_ADVANCED 1303 help 1304 This option adds a `DSCP' match, which allows you to match against 1305 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1306 1307 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1308 1309 It will also add a "tos" match, which allows you to match packets 1310 based on the Type Of Service fields of the IPv4 packet (which share 1311 the same bits as DSCP). 1312 1313 To compile it as a module, choose M here. If unsure, say N. 1314 1315config NETFILTER_XT_MATCH_ECN 1316 tristate '"ecn" match support' 1317 depends on NETFILTER_ADVANCED 1318 help 1319 This option adds an "ECN" match, which allows you to match against 1320 the IPv4 and TCP header ECN fields. 1321 1322 To compile it as a module, choose M here. If unsure, say N. 1323 1324config NETFILTER_XT_MATCH_ESP 1325 tristate '"esp" match support' 1326 depends on NETFILTER_ADVANCED 1327 help 1328 This match extension allows you to match a range of SPIs 1329 inside ESP header of IPSec packets. 1330 1331 To compile it as a module, choose M here. If unsure, say N. 1332 1333config NETFILTER_XT_MATCH_HASHLIMIT 1334 tristate '"hashlimit" match support' 1335 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1336 depends on NETFILTER_ADVANCED 1337 help 1338 This option adds a `hashlimit' match. 1339 1340 As opposed to `limit', this match dynamically creates a hash table 1341 of limit buckets, based on your selection of source/destination 1342 addresses and/or ports. 1343 1344 It enables you to express policies like `10kpps for any given 1345 destination address' or `500pps from any given source address' 1346 with a single rule. 1347 1348config NETFILTER_XT_MATCH_HELPER 1349 tristate '"helper" match support' 1350 depends on NF_CONNTRACK 1351 depends on NETFILTER_ADVANCED 1352 help 1353 Helper matching allows you to match packets in dynamic connections 1354 tracked by a conntrack-helper, ie. nf_conntrack_ftp 1355 1356 To compile it as a module, choose M here. If unsure, say Y. 1357 1358config NETFILTER_XT_MATCH_HL 1359 tristate '"hl" hoplimit/TTL match support' 1360 depends on NETFILTER_ADVANCED 1361 help 1362 HL matching allows you to match packets based on the hoplimit 1363 in the IPv6 header, or the time-to-live field in the IPv4 1364 header of the packet. 1365 1366config NETFILTER_XT_MATCH_IPCOMP 1367 tristate '"ipcomp" match support' 1368 depends on NETFILTER_ADVANCED 1369 help 1370 This match extension allows you to match a range of CPIs(16 bits) 1371 inside IPComp header of IPSec packets. 1372 1373 To compile it as a module, choose M here. If unsure, say N. 1374 1375config NETFILTER_XT_MATCH_IPRANGE 1376 tristate '"iprange" address range match support' 1377 depends on NETFILTER_ADVANCED 1378 help 1379 This option adds a "iprange" match, which allows you to match based on 1380 an IP address range. (Normal iptables only matches on single addresses 1381 with an optional mask.) 1382 1383 If unsure, say M. 1384 1385config NETFILTER_XT_MATCH_IPVS 1386 tristate '"ipvs" match support' 1387 depends on IP_VS 1388 depends on NETFILTER_ADVANCED 1389 depends on NF_CONNTRACK 1390 help 1391 This option allows you to match against IPVS properties of a packet. 1392 1393 If unsure, say N. 1394 1395config NETFILTER_XT_MATCH_L2TP 1396 tristate '"l2tp" match support' 1397 depends on NETFILTER_ADVANCED 1398 default L2TP 1399 help 1400 This option adds an "L2TP" match, which allows you to match against 1401 L2TP protocol header fields. 1402 1403 To compile it as a module, choose M here. If unsure, say N. 1404 1405config NETFILTER_XT_MATCH_LENGTH 1406 tristate '"length" match support' 1407 depends on NETFILTER_ADVANCED 1408 help 1409 This option allows you to match the length of a packet against a 1410 specific value or range of values. 1411 1412 To compile it as a module, choose M here. If unsure, say N. 1413 1414config NETFILTER_XT_MATCH_LIMIT 1415 tristate '"limit" match support' 1416 depends on NETFILTER_ADVANCED 1417 help 1418 limit matching allows you to control the rate at which a rule can be 1419 matched: mainly useful in combination with the LOG target ("LOG 1420 target support", below) and to avoid some Denial of Service attacks. 1421 1422 To compile it as a module, choose M here. If unsure, say N. 1423 1424config NETFILTER_XT_MATCH_MAC 1425 tristate '"mac" address match support' 1426 depends on NETFILTER_ADVANCED 1427 help 1428 MAC matching allows you to match packets based on the source 1429 Ethernet address of the packet. 1430 1431 To compile it as a module, choose M here. If unsure, say N. 1432 1433config NETFILTER_XT_MATCH_MARK 1434 tristate '"mark" match support' 1435 depends on NETFILTER_ADVANCED 1436 select NETFILTER_XT_MARK 1437 help 1438 This is a backwards-compat option for the user's convenience 1439 (e.g. when running oldconfig). It selects 1440 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1441 1442config NETFILTER_XT_MATCH_MULTIPORT 1443 tristate '"multiport" Multiple port match support' 1444 depends on NETFILTER_ADVANCED 1445 help 1446 Multiport matching allows you to match TCP or UDP packets based on 1447 a series of source or destination ports: normally a rule can only 1448 match a single range of ports. 1449 1450 To compile it as a module, choose M here. If unsure, say N. 1451 1452config NETFILTER_XT_MATCH_NFACCT 1453 tristate '"nfacct" match support' 1454 depends on NETFILTER_ADVANCED 1455 select NETFILTER_NETLINK_ACCT 1456 help 1457 This option allows you to use the extended accounting through 1458 nfnetlink_acct. 1459 1460 To compile it as a module, choose M here. If unsure, say N. 1461 1462config NETFILTER_XT_MATCH_OSF 1463 tristate '"osf" Passive OS fingerprint match' 1464 depends on NETFILTER_ADVANCED 1465 select NETFILTER_NETLINK_OSF 1466 help 1467 This option selects the Passive OS Fingerprinting match module 1468 that allows to passively match the remote operating system by 1469 analyzing incoming TCP SYN packets. 1470 1471 Rules and loading software can be downloaded from 1472 http://www.ioremap.net/projects/osf 1473 1474 To compile it as a module, choose M here. If unsure, say N. 1475 1476config NETFILTER_XT_MATCH_OWNER 1477 tristate '"owner" match support' 1478 depends on NETFILTER_ADVANCED 1479 help 1480 Socket owner matching allows you to match locally-generated packets 1481 based on who created the socket: the user or group. It is also 1482 possible to check whether a socket actually exists. 1483 1484config NETFILTER_XT_MATCH_POLICY 1485 tristate 'IPsec "policy" match support' 1486 depends on XFRM 1487 default m if NETFILTER_ADVANCED=n 1488 help 1489 Policy matching allows you to match packets based on the 1490 IPsec policy that was used during decapsulation/will 1491 be used during encapsulation. 1492 1493 To compile it as a module, choose M here. If unsure, say N. 1494 1495config NETFILTER_XT_MATCH_PHYSDEV 1496 tristate '"physdev" match support' 1497 depends on BRIDGE && BRIDGE_NETFILTER 1498 depends on NETFILTER_ADVANCED 1499 help 1500 Physdev packet matching matches against the physical bridge ports 1501 the IP packet arrived on or will leave by. 1502 1503 To compile it as a module, choose M here. If unsure, say N. 1504 1505config NETFILTER_XT_MATCH_PKTTYPE 1506 tristate '"pkttype" packet type match support' 1507 depends on NETFILTER_ADVANCED 1508 help 1509 Packet type matching allows you to match a packet by 1510 its "class", eg. BROADCAST, MULTICAST, ... 1511 1512 Typical usage: 1513 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1514 1515 To compile it as a module, choose M here. If unsure, say N. 1516 1517config NETFILTER_XT_MATCH_QUOTA 1518 tristate '"quota" match support' 1519 depends on NETFILTER_ADVANCED 1520 help 1521 This option adds a `quota' match, which allows to match on a 1522 byte counter. 1523 1524 If you want to compile it as a module, say M here and read 1525 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1526 1527config NETFILTER_XT_MATCH_RATEEST 1528 tristate '"rateest" match support' 1529 depends on NETFILTER_ADVANCED 1530 select NETFILTER_XT_TARGET_RATEEST 1531 help 1532 This option adds a `rateest' match, which allows to match on the 1533 rate estimated by the RATEEST target. 1534 1535 To compile it as a module, choose M here. If unsure, say N. 1536 1537config NETFILTER_XT_MATCH_REALM 1538 tristate '"realm" match support' 1539 depends on NETFILTER_ADVANCED 1540 select IP_ROUTE_CLASSID 1541 help 1542 This option adds a `realm' match, which allows you to use the realm 1543 key from the routing subsystem inside iptables. 1544 1545 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1546 in tc world. 1547 1548 If you want to compile it as a module, say M here and read 1549 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1550 1551config NETFILTER_XT_MATCH_RECENT 1552 tristate '"recent" match support' 1553 depends on NETFILTER_ADVANCED 1554 help 1555 This match is used for creating one or many lists of recently 1556 used addresses and then matching against that/those list(s). 1557 1558 Short options are available by using 'iptables -m recent -h' 1559 Official Website: <http://snowman.net/projects/ipt_recent/> 1560 1561config NETFILTER_XT_MATCH_SCTP 1562 tristate '"sctp" protocol match support' 1563 depends on NETFILTER_ADVANCED 1564 default IP_SCTP 1565 help 1566 With this option enabled, you will be able to use the 1567 `sctp' match in order to match on SCTP source/destination ports 1568 and SCTP chunk types. 1569 1570 If you want to compile it as a module, say M here and read 1571 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1572 1573config NETFILTER_XT_MATCH_SOCKET 1574 tristate '"socket" match support' 1575 depends on NETFILTER_XTABLES 1576 depends on NETFILTER_ADVANCED 1577 depends on IPV6 || IPV6=n 1578 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1579 select NF_SOCKET_IPV4 1580 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES 1581 select NF_DEFRAG_IPV4 1582 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1583 help 1584 This option adds a `socket' match, which can be used to match 1585 packets for which a TCP or UDP socket lookup finds a valid socket. 1586 It can be used in combination with the MARK target and policy 1587 routing to implement full featured non-locally bound sockets. 1588 1589 To compile it as a module, choose M here. If unsure, say N. 1590 1591config NETFILTER_XT_MATCH_STATE 1592 tristate '"state" match support' 1593 depends on NF_CONNTRACK 1594 default m if NETFILTER_ADVANCED=n 1595 help 1596 Connection state matching allows you to match packets based on their 1597 relationship to a tracked connection (ie. previous packets). This 1598 is a powerful tool for packet classification. 1599 1600 To compile it as a module, choose M here. If unsure, say N. 1601 1602config NETFILTER_XT_MATCH_STATISTIC 1603 tristate '"statistic" match support' 1604 depends on NETFILTER_ADVANCED 1605 help 1606 This option adds a `statistic' match, which allows you to match 1607 on packets periodically or randomly with a given percentage. 1608 1609 To compile it as a module, choose M here. If unsure, say N. 1610 1611config NETFILTER_XT_MATCH_STRING 1612 tristate '"string" match support' 1613 depends on NETFILTER_ADVANCED 1614 select TEXTSEARCH 1615 select TEXTSEARCH_KMP 1616 select TEXTSEARCH_BM 1617 select TEXTSEARCH_FSM 1618 help 1619 This option adds a `string' match, which allows you to look for 1620 pattern matchings in packets. 1621 1622 To compile it as a module, choose M here. If unsure, say N. 1623 1624config NETFILTER_XT_MATCH_TCPMSS 1625 tristate '"tcpmss" match support' 1626 depends on NETFILTER_ADVANCED 1627 help 1628 This option adds a `tcpmss' match, which allows you to examine the 1629 MSS value of TCP SYN packets, which control the maximum packet size 1630 for that connection. 1631 1632 To compile it as a module, choose M here. If unsure, say N. 1633 1634config NETFILTER_XT_MATCH_TIME 1635 tristate '"time" match support' 1636 depends on NETFILTER_ADVANCED 1637 help 1638 This option adds a "time" match, which allows you to match based on 1639 the packet arrival time (at the machine which netfilter is running) 1640 on) or departure time/date (for locally generated packets). 1641 1642 If you say Y here, try `iptables -m time --help` for 1643 more information. 1644 1645 If you want to compile it as a module, say M here. 1646 If unsure, say N. 1647 1648config NETFILTER_XT_MATCH_U32 1649 tristate '"u32" match support' 1650 depends on NETFILTER_ADVANCED 1651 help 1652 u32 allows you to extract quantities of up to 4 bytes from a packet, 1653 AND them with specified masks, shift them by specified amounts and 1654 test whether the results are in any of a set of specified ranges. 1655 The specification of what to extract is general enough to skip over 1656 headers with lengths stored in the packet, as in IP or TCP header 1657 lengths. 1658 1659 Details and examples are in the kernel module source. 1660 1661endif # NETFILTER_XTABLES 1662 1663endmenu 1664 1665source "net/netfilter/ipset/Kconfig" 1666 1667source "net/netfilter/ipvs/Kconfig" 1668