1menu "Core Netfilter Configuration" 2 depends on NET && INET && NETFILTER 3 4config NETFILTER_INGRESS 5 bool "Netfilter ingress support" 6 default y 7 select NET_INGRESS 8 help 9 This allows you to classify packets from ingress using the Netfilter 10 infrastructure. 11 12config NETFILTER_NETLINK 13 tristate 14 15config NETFILTER_FAMILY_BRIDGE 16 bool 17 18config NETFILTER_FAMILY_ARP 19 bool 20 21config NETFILTER_NETLINK_ACCT 22tristate "Netfilter NFACCT over NFNETLINK interface" 23 depends on NETFILTER_ADVANCED 24 select NETFILTER_NETLINK 25 help 26 If this option is enabled, the kernel will include support 27 for extended accounting via NFNETLINK. 28 29config NETFILTER_NETLINK_QUEUE 30 tristate "Netfilter NFQUEUE over NFNETLINK interface" 31 depends on NETFILTER_ADVANCED 32 select NETFILTER_NETLINK 33 help 34 If this option is enabled, the kernel will include support 35 for queueing packets via NFNETLINK. 36 37config NETFILTER_NETLINK_LOG 38 tristate "Netfilter LOG over NFNETLINK interface" 39 default m if NETFILTER_ADVANCED=n 40 select NETFILTER_NETLINK 41 help 42 If this option is enabled, the kernel will include support 43 for logging packets via NFNETLINK. 44 45 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 46 and is also scheduled to replace the old syslog-based ipt_LOG 47 and ip6t_LOG modules. 48 49config NETFILTER_NETLINK_OSF 50 tristate "Netfilter OSF over NFNETLINK interface" 51 depends on NETFILTER_ADVANCED 52 select NETFILTER_NETLINK 53 help 54 If this option is enabled, the kernel will include support 55 for passive OS fingerprint via NFNETLINK. 56 57config NF_CONNTRACK 58 tristate "Netfilter connection tracking support" 59 default m if NETFILTER_ADVANCED=n 60 select NF_DEFRAG_IPV4 61 select NF_DEFRAG_IPV6 if IPV6 != n 62 help 63 Connection tracking keeps a record of what packets have passed 64 through your machine, in order to figure out how they are related 65 into connections. 66 67 This is required to do Masquerading or other kinds of Network 68 Address Translation. It can also be used to enhance packet 69 filtering (see `Connection state match support' below). 70 71 To compile it as a module, choose M here. If unsure, say N. 72 73config NF_LOG_COMMON 74 tristate 75 76config NF_LOG_NETDEV 77 tristate "Netdev packet logging" 78 select NF_LOG_COMMON 79 80if NF_CONNTRACK 81config NETFILTER_CONNCOUNT 82 tristate 83 84config NF_CONNTRACK_MARK 85 bool 'Connection mark tracking support' 86 depends on NETFILTER_ADVANCED 87 help 88 This option enables support for connection marks, used by the 89 `CONNMARK' target and `connmark' match. Similar to the mark value 90 of packets, but this mark value is kept in the conntrack session 91 instead of the individual packets. 92 93config NF_CONNTRACK_SECMARK 94 bool 'Connection tracking security mark support' 95 depends on NETWORK_SECMARK 96 default m if NETFILTER_ADVANCED=n 97 help 98 This option enables security markings to be applied to 99 connections. Typically they are copied to connections from 100 packets using the CONNSECMARK target and copied back from 101 connections to packets with the same target, with the packets 102 being originally labeled via SECMARK. 103 104 If unsure, say 'N'. 105 106config NF_CONNTRACK_ZONES 107 bool 'Connection tracking zones' 108 depends on NETFILTER_ADVANCED 109 help 110 This option enables support for connection tracking zones. 111 Normally, each connection needs to have a unique system wide 112 identity. Connection tracking zones allow to have multiple 113 connections using the same identity, as long as they are 114 contained in different zones. 115 116 If unsure, say `N'. 117 118config NF_CONNTRACK_PROCFS 119 bool "Supply CT list in procfs (OBSOLETE)" 120 default y 121 depends on PROC_FS 122 ---help--- 123 This option enables for the list of known conntrack entries 124 to be shown in procfs under net/netfilter/nf_conntrack. This 125 is considered obsolete in favor of using the conntrack(8) 126 tool which uses Netlink. 127 128config NF_CONNTRACK_EVENTS 129 bool "Connection tracking events" 130 depends on NETFILTER_ADVANCED 131 help 132 If this option is enabled, the connection tracking code will 133 provide a notifier chain that can be used by other kernel code 134 to get notified about changes in the connection tracking state. 135 136 If unsure, say `N'. 137 138config NF_CONNTRACK_TIMEOUT 139 bool 'Connection tracking timeout' 140 depends on NETFILTER_ADVANCED 141 help 142 This option enables support for connection tracking timeout 143 extension. This allows you to attach timeout policies to flow 144 via the CT target. 145 146 If unsure, say `N'. 147 148config NF_CONNTRACK_TIMESTAMP 149 bool 'Connection tracking timestamping' 150 depends on NETFILTER_ADVANCED 151 help 152 This option enables support for connection tracking timestamping. 153 This allows you to store the flow start-time and to obtain 154 the flow-stop time (once it has been destroyed) via Connection 155 tracking events. 156 157 If unsure, say `N'. 158 159config NF_CONNTRACK_LABELS 160 bool "Connection tracking labels" 161 help 162 This option enables support for assigning user-defined flag bits 163 to connection tracking entries. It can be used with xtables connlabel 164 match and the nftables ct expression. 165 166config NF_CT_PROTO_DCCP 167 bool 'DCCP protocol connection tracking support' 168 depends on NETFILTER_ADVANCED 169 default y 170 help 171 With this option enabled, the layer 3 independent connection 172 tracking code will be able to do state tracking on DCCP connections. 173 174 If unsure, say Y. 175 176config NF_CT_PROTO_GRE 177 bool 178 179config NF_CT_PROTO_SCTP 180 bool 'SCTP protocol connection tracking support' 181 depends on NETFILTER_ADVANCED 182 default y 183 select LIBCRC32C 184 help 185 With this option enabled, the layer 3 independent connection 186 tracking code will be able to do state tracking on SCTP connections. 187 188 If unsure, say Y. 189 190config NF_CT_PROTO_UDPLITE 191 bool 'UDP-Lite protocol connection tracking support' 192 depends on NETFILTER_ADVANCED 193 default y 194 help 195 With this option enabled, the layer 3 independent connection 196 tracking code will be able to do state tracking on UDP-Lite 197 connections. 198 199 If unsure, say Y. 200 201config NF_CONNTRACK_AMANDA 202 tristate "Amanda backup protocol support" 203 depends on NETFILTER_ADVANCED 204 select TEXTSEARCH 205 select TEXTSEARCH_KMP 206 help 207 If you are running the Amanda backup package <http://www.amanda.org/> 208 on this machine or machines that will be MASQUERADED through this 209 machine, then you may want to enable this feature. This allows the 210 connection tracking and natting code to allow the sub-channels that 211 Amanda requires for communication of the backup data, messages and 212 index. 213 214 To compile it as a module, choose M here. If unsure, say N. 215 216config NF_CONNTRACK_FTP 217 tristate "FTP protocol support" 218 default m if NETFILTER_ADVANCED=n 219 help 220 Tracking FTP connections is problematic: special helpers are 221 required for tracking them, and doing masquerading and other forms 222 of Network Address Translation on them. 223 224 This is FTP support on Layer 3 independent connection tracking. 225 Layer 3 independent connection tracking is experimental scheme 226 which generalize ip_conntrack to support other layer 3 protocols. 227 228 To compile it as a module, choose M here. If unsure, say N. 229 230config NF_CONNTRACK_H323 231 tristate "H.323 protocol support" 232 depends on IPV6 || IPV6=n 233 depends on NETFILTER_ADVANCED 234 help 235 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 236 important VoIP protocols, it is widely used by voice hardware and 237 software including voice gateways, IP phones, Netmeeting, OpenPhone, 238 Gnomemeeting, etc. 239 240 With this module you can support H.323 on a connection tracking/NAT 241 firewall. 242 243 This module supports RAS, Fast Start, H.245 Tunnelling, Call 244 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 245 whiteboard, file transfer, etc. For more information, please 246 visit http://nath323.sourceforge.net/. 247 248 To compile it as a module, choose M here. If unsure, say N. 249 250config NF_CONNTRACK_IRC 251 tristate "IRC protocol support" 252 default m if NETFILTER_ADVANCED=n 253 help 254 There is a commonly-used extension to IRC called 255 Direct Client-to-Client Protocol (DCC). This enables users to send 256 files to each other, and also chat to each other without the need 257 of a server. DCC Sending is used anywhere you send files over IRC, 258 and DCC Chat is most commonly used by Eggdrop bots. If you are 259 using NAT, this extension will enable you to send files and initiate 260 chats. Note that you do NOT need this extension to get files or 261 have others initiate chats, or everything else in IRC. 262 263 To compile it as a module, choose M here. If unsure, say N. 264 265config NF_CONNTRACK_BROADCAST 266 tristate 267 268config NF_CONNTRACK_NETBIOS_NS 269 tristate "NetBIOS name service protocol support" 270 select NF_CONNTRACK_BROADCAST 271 help 272 NetBIOS name service requests are sent as broadcast messages from an 273 unprivileged port and responded to with unicast messages to the 274 same port. This make them hard to firewall properly because connection 275 tracking doesn't deal with broadcasts. This helper tracks locally 276 originating NetBIOS name service requests and the corresponding 277 responses. It relies on correct IP address configuration, specifically 278 netmask and broadcast address. When properly configured, the output 279 of "ip address show" should look similar to this: 280 281 $ ip -4 address show eth0 282 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 283 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 284 285 To compile it as a module, choose M here. If unsure, say N. 286 287config NF_CONNTRACK_SNMP 288 tristate "SNMP service protocol support" 289 depends on NETFILTER_ADVANCED 290 select NF_CONNTRACK_BROADCAST 291 help 292 SNMP service requests are sent as broadcast messages from an 293 unprivileged port and responded to with unicast messages to the 294 same port. This make them hard to firewall properly because connection 295 tracking doesn't deal with broadcasts. This helper tracks locally 296 originating SNMP service requests and the corresponding 297 responses. It relies on correct IP address configuration, specifically 298 netmask and broadcast address. 299 300 To compile it as a module, choose M here. If unsure, say N. 301 302config NF_CONNTRACK_PPTP 303 tristate "PPtP protocol support" 304 depends on NETFILTER_ADVANCED 305 select NF_CT_PROTO_GRE 306 help 307 This module adds support for PPTP (Point to Point Tunnelling 308 Protocol, RFC2637) connection tracking and NAT. 309 310 If you are running PPTP sessions over a stateful firewall or NAT 311 box, you may want to enable this feature. 312 313 Please note that not all PPTP modes of operation are supported yet. 314 Specifically these limitations exist: 315 - Blindly assumes that control connections are always established 316 in PNS->PAC direction. This is a violation of RFC2637. 317 - Only supports a single call within each session 318 319 To compile it as a module, choose M here. If unsure, say N. 320 321config NF_CONNTRACK_SANE 322 tristate "SANE protocol support" 323 depends on NETFILTER_ADVANCED 324 help 325 SANE is a protocol for remote access to scanners as implemented 326 by the 'saned' daemon. Like FTP, it uses separate control and 327 data connections. 328 329 With this module you can support SANE on a connection tracking 330 firewall. 331 332 To compile it as a module, choose M here. If unsure, say N. 333 334config NF_CONNTRACK_SIP 335 tristate "SIP protocol support" 336 default m if NETFILTER_ADVANCED=n 337 help 338 SIP is an application-layer control protocol that can establish, 339 modify, and terminate multimedia sessions (conferences) such as 340 Internet telephony calls. With the ip_conntrack_sip and 341 the nf_nat_sip modules you can support the protocol on a connection 342 tracking/NATing firewall. 343 344 To compile it as a module, choose M here. If unsure, say N. 345 346config NF_CONNTRACK_TFTP 347 tristate "TFTP protocol support" 348 depends on NETFILTER_ADVANCED 349 help 350 TFTP connection tracking helper, this is required depending 351 on how restrictive your ruleset is. 352 If you are using a tftp client behind -j SNAT or -j MASQUERADING 353 you will need this. 354 355 To compile it as a module, choose M here. If unsure, say N. 356 357config NF_CT_NETLINK 358 tristate 'Connection tracking netlink interface' 359 select NETFILTER_NETLINK 360 default m if NETFILTER_ADVANCED=n 361 help 362 This option enables support for a netlink-based userspace interface 363 364config NF_CT_NETLINK_TIMEOUT 365 tristate 'Connection tracking timeout tuning via Netlink' 366 select NETFILTER_NETLINK 367 depends on NETFILTER_ADVANCED 368 depends on NF_CONNTRACK_TIMEOUT 369 help 370 This option enables support for connection tracking timeout 371 fine-grain tuning. This allows you to attach specific timeout 372 policies to flows, instead of using the global timeout policy. 373 374 If unsure, say `N'. 375 376config NF_CT_NETLINK_HELPER 377 tristate 'Connection tracking helpers in user-space via Netlink' 378 select NETFILTER_NETLINK 379 depends on NF_CT_NETLINK 380 depends on NETFILTER_NETLINK_QUEUE 381 depends on NETFILTER_NETLINK_GLUE_CT 382 depends on NETFILTER_ADVANCED 383 help 384 This option enables the user-space connection tracking helpers 385 infrastructure. 386 387 If unsure, say `N'. 388 389config NETFILTER_NETLINK_GLUE_CT 390 bool "NFQUEUE and NFLOG integration with Connection Tracking" 391 default n 392 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 393 help 394 If this option is enabled, NFQUEUE and NFLOG can include 395 Connection Tracking information together with the packet is 396 the enqueued via NFNETLINK. 397 398config NF_NAT 399 tristate "Network Address Translation support" 400 depends on NF_CONNTRACK 401 default m if NETFILTER_ADVANCED=n 402 help 403 The NAT option allows masquerading, port forwarding and other 404 forms of full Network Address Port Translation. This can be 405 controlled by iptables, ip6tables or nft. 406 407config NF_NAT_NEEDED 408 bool 409 depends on NF_NAT 410 default y 411 412config NF_NAT_AMANDA 413 tristate 414 depends on NF_CONNTRACK && NF_NAT 415 default NF_NAT && NF_CONNTRACK_AMANDA 416 417config NF_NAT_FTP 418 tristate 419 depends on NF_CONNTRACK && NF_NAT 420 default NF_NAT && NF_CONNTRACK_FTP 421 422config NF_NAT_IRC 423 tristate 424 depends on NF_CONNTRACK && NF_NAT 425 default NF_NAT && NF_CONNTRACK_IRC 426 427config NF_NAT_SIP 428 tristate 429 depends on NF_CONNTRACK && NF_NAT 430 default NF_NAT && NF_CONNTRACK_SIP 431 432config NF_NAT_TFTP 433 tristate 434 depends on NF_CONNTRACK && NF_NAT 435 default NF_NAT && NF_CONNTRACK_TFTP 436 437config NF_NAT_REDIRECT 438 bool 439 440config NF_NAT_MASQUERADE 441 bool 442 443config NETFILTER_SYNPROXY 444 tristate 445 446endif # NF_CONNTRACK 447 448config NF_TABLES 449 select NETFILTER_NETLINK 450 tristate "Netfilter nf_tables support" 451 help 452 nftables is the new packet classification framework that intends to 453 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 454 provides a pseudo-state machine with an extensible instruction-set 455 (also known as expressions) that the userspace 'nft' utility 456 (http://www.netfilter.org/projects/nftables) uses to build the 457 rule-set. It also comes with the generic set infrastructure that 458 allows you to construct mappings between matchings and actions 459 for performance lookups. 460 461 To compile it as a module, choose M here. 462 463if NF_TABLES 464 465config NF_TABLES_SET 466 tristate "Netfilter nf_tables set infrastructure" 467 help 468 This option enables the nf_tables set infrastructure that allows to 469 look up for elements in a set and to build one-way mappings between 470 matchings and actions. 471 472config NF_TABLES_INET 473 depends on IPV6 474 select NF_TABLES_IPV4 475 select NF_TABLES_IPV6 476 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support" 477 help 478 This option enables support for a mixed IPv4/IPv6 "inet" table. 479 480config NF_TABLES_NETDEV 481 bool "Netfilter nf_tables netdev tables support" 482 help 483 This option enables support for the "netdev" table. 484 485config NFT_NUMGEN 486 tristate "Netfilter nf_tables number generator module" 487 help 488 This option adds the number generator expression used to perform 489 incremental counting and random numbers bound to a upper limit. 490 491config NFT_CT 492 depends on NF_CONNTRACK 493 tristate "Netfilter nf_tables conntrack module" 494 help 495 This option adds the "ct" expression that you can use to match 496 connection tracking information such as the flow state. 497 498config NFT_FLOW_OFFLOAD 499 depends on NF_CONNTRACK && NF_FLOW_TABLE 500 tristate "Netfilter nf_tables hardware flow offload module" 501 help 502 This option adds the "flow_offload" expression that you can use to 503 choose what flows are placed into the hardware. 504 505config NFT_COUNTER 506 tristate "Netfilter nf_tables counter module" 507 help 508 This option adds the "counter" expression that you can use to 509 include packet and byte counters in a rule. 510 511config NFT_CONNLIMIT 512 tristate "Netfilter nf_tables connlimit module" 513 depends on NF_CONNTRACK 514 depends on NETFILTER_ADVANCED 515 select NETFILTER_CONNCOUNT 516 help 517 This option adds the "connlimit" expression that you can use to 518 ratelimit rule matchings per connections. 519 520config NFT_LOG 521 tristate "Netfilter nf_tables log module" 522 help 523 This option adds the "log" expression that you can use to log 524 packets matching some criteria. 525 526config NFT_LIMIT 527 tristate "Netfilter nf_tables limit module" 528 help 529 This option adds the "limit" expression that you can use to 530 ratelimit rule matchings. 531 532config NFT_MASQ 533 depends on NF_CONNTRACK 534 depends on NF_NAT 535 select NF_NAT_MASQUERADE 536 tristate "Netfilter nf_tables masquerade support" 537 help 538 This option adds the "masquerade" expression that you can use 539 to perform NAT in the masquerade flavour. 540 541config NFT_REDIR 542 depends on NF_CONNTRACK 543 depends on NF_NAT 544 tristate "Netfilter nf_tables redirect support" 545 select NF_NAT_REDIRECT 546 help 547 This options adds the "redirect" expression that you can use 548 to perform NAT in the redirect flavour. 549 550config NFT_NAT 551 depends on NF_CONNTRACK 552 select NF_NAT 553 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6 554 tristate "Netfilter nf_tables nat module" 555 help 556 This option adds the "nat" expression that you can use to perform 557 typical Network Address Translation (NAT) packet transformations. 558 559config NFT_TUNNEL 560 tristate "Netfilter nf_tables tunnel module" 561 help 562 This option adds the "tunnel" expression that you can use to set 563 tunneling policies. 564 565config NFT_OBJREF 566 tristate "Netfilter nf_tables stateful object reference module" 567 help 568 This option adds the "objref" expression that allows you to refer to 569 stateful objects, such as counters and quotas. 570 571config NFT_QUEUE 572 depends on NETFILTER_NETLINK_QUEUE 573 tristate "Netfilter nf_tables queue module" 574 help 575 This is required if you intend to use the userspace queueing 576 infrastructure (also known as NFQUEUE) from nftables. 577 578config NFT_QUOTA 579 tristate "Netfilter nf_tables quota module" 580 help 581 This option adds the "quota" expression that you can use to match 582 enforce bytes quotas. 583 584config NFT_REJECT 585 default m if NETFILTER_ADVANCED=n 586 tristate "Netfilter nf_tables reject support" 587 depends on !NF_TABLES_INET || (IPV6!=m || m) 588 help 589 This option adds the "reject" expression that you can use to 590 explicitly deny and notify via TCP reset/ICMP informational errors 591 unallowed traffic. 592 593config NFT_REJECT_INET 594 depends on NF_TABLES_INET 595 default NFT_REJECT 596 tristate 597 598config NFT_COMPAT 599 depends on NETFILTER_XTABLES 600 tristate "Netfilter x_tables over nf_tables module" 601 help 602 This is required if you intend to use any of existing 603 x_tables match/target extensions over the nf_tables 604 framework. 605 606config NFT_HASH 607 tristate "Netfilter nf_tables hash module" 608 help 609 This option adds the "hash" expression that you can use to perform 610 a hash operation on registers. 611 612config NFT_FIB 613 tristate 614 615config NFT_FIB_INET 616 depends on NF_TABLES_INET 617 depends on NFT_FIB_IPV4 618 depends on NFT_FIB_IPV6 619 tristate "Netfilter nf_tables fib inet support" 620 help 621 This option allows using the FIB expression from the inet table. 622 The lookup will be delegated to the IPv4 or IPv6 FIB depending 623 on the protocol of the packet. 624 625config NFT_XFRM 626 tristate "Netfilter nf_tables xfrm/IPSec security association matching" 627 depends on XFRM 628 help 629 This option adds an expression that you can use to extract properties 630 of a packets security association. 631 632config NFT_SOCKET 633 tristate "Netfilter nf_tables socket match support" 634 depends on IPV6 || IPV6=n 635 select NF_SOCKET_IPV4 636 select NF_SOCKET_IPV6 if NF_TABLES_IPV6 637 help 638 This option allows matching for the presence or absence of a 639 corresponding socket and its attributes. 640 641config NFT_OSF 642 tristate "Netfilter nf_tables passive OS fingerprint support" 643 depends on NETFILTER_ADVANCED 644 select NETFILTER_NETLINK_OSF 645 help 646 This option allows matching packets from an specific OS. 647 648config NFT_TPROXY 649 tristate "Netfilter nf_tables tproxy support" 650 depends on IPV6 || IPV6=n 651 select NF_DEFRAG_IPV4 652 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6 653 select NF_TPROXY_IPV4 654 select NF_TPROXY_IPV6 if NF_TABLES_IPV6 655 help 656 This makes transparent proxy support available in nftables. 657 658if NF_TABLES_NETDEV 659 660config NF_DUP_NETDEV 661 tristate "Netfilter packet duplication support" 662 help 663 This option enables the generic packet duplication infrastructure 664 for Netfilter. 665 666config NFT_DUP_NETDEV 667 tristate "Netfilter nf_tables netdev packet duplication support" 668 select NF_DUP_NETDEV 669 help 670 This option enables packet duplication for the "netdev" family. 671 672config NFT_FWD_NETDEV 673 tristate "Netfilter nf_tables netdev packet forwarding support" 674 select NF_DUP_NETDEV 675 help 676 This option enables packet forwarding for the "netdev" family. 677 678config NFT_FIB_NETDEV 679 depends on NFT_FIB_IPV4 680 depends on NFT_FIB_IPV6 681 tristate "Netfilter nf_tables netdev fib lookups support" 682 help 683 This option allows using the FIB expression from the netdev table. 684 The lookup will be delegated to the IPv4 or IPv6 FIB depending 685 on the protocol of the packet. 686 687endif # NF_TABLES_NETDEV 688 689endif # NF_TABLES 690 691config NF_FLOW_TABLE_INET 692 tristate "Netfilter flow table mixed IPv4/IPv6 module" 693 depends on NF_FLOW_TABLE 694 help 695 This option adds the flow table mixed IPv4/IPv6 support. 696 697 To compile it as a module, choose M here. 698 699config NF_FLOW_TABLE 700 tristate "Netfilter flow table module" 701 depends on NETFILTER_INGRESS 702 depends on NF_CONNTRACK 703 depends on NF_TABLES 704 help 705 This option adds the flow table core infrastructure. 706 707 To compile it as a module, choose M here. 708 709config NETFILTER_XTABLES 710 tristate "Netfilter Xtables support (required for ip_tables)" 711 default m if NETFILTER_ADVANCED=n 712 help 713 This is required if you intend to use any of ip_tables, 714 ip6_tables or arp_tables. 715 716if NETFILTER_XTABLES 717 718comment "Xtables combined modules" 719 720config NETFILTER_XT_MARK 721 tristate 'nfmark target and match support' 722 default m if NETFILTER_ADVANCED=n 723 ---help--- 724 This option adds the "MARK" target and "mark" match. 725 726 Netfilter mark matching allows you to match packets based on the 727 "nfmark" value in the packet. 728 The target allows you to create rules in the "mangle" table which alter 729 the netfilter mark (nfmark) field associated with the packet. 730 731 Prior to routing, the nfmark can influence the routing method and can 732 also be used by other subsystems to change their behavior. 733 734config NETFILTER_XT_CONNMARK 735 tristate 'ctmark target and match support' 736 depends on NF_CONNTRACK 737 depends on NETFILTER_ADVANCED 738 select NF_CONNTRACK_MARK 739 ---help--- 740 This option adds the "CONNMARK" target and "connmark" match. 741 742 Netfilter allows you to store a mark value per connection (a.k.a. 743 ctmark), similarly to the packet mark (nfmark). Using this 744 target and match, you can set and match on this mark. 745 746config NETFILTER_XT_SET 747 tristate 'set target and match support' 748 depends on IP_SET 749 depends on NETFILTER_ADVANCED 750 help 751 This option adds the "SET" target and "set" match. 752 753 Using this target and match, you can add/delete and match 754 elements in the sets created by ipset(8). 755 756 To compile it as a module, choose M here. If unsure, say N. 757 758# alphabetically ordered list of targets 759 760comment "Xtables targets" 761 762config NETFILTER_XT_TARGET_AUDIT 763 tristate "AUDIT target support" 764 depends on AUDIT 765 depends on NETFILTER_ADVANCED 766 ---help--- 767 This option adds a 'AUDIT' target, which can be used to create 768 audit records for packets dropped/accepted. 769 770 To compileit as a module, choose M here. If unsure, say N. 771 772config NETFILTER_XT_TARGET_CHECKSUM 773 tristate "CHECKSUM target support" 774 depends on IP_NF_MANGLE || IP6_NF_MANGLE 775 depends on NETFILTER_ADVANCED 776 ---help--- 777 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 778 table to work around buggy DHCP clients in virtualized environments. 779 780 Some old DHCP clients drop packets because they are not aware 781 that the checksum would normally be offloaded to hardware and 782 thus should be considered valid. 783 This target can be used to fill in the checksum using iptables 784 when such packets are sent via a virtual network device. 785 786 To compile it as a module, choose M here. If unsure, say N. 787 788config NETFILTER_XT_TARGET_CLASSIFY 789 tristate '"CLASSIFY" target support' 790 depends on NETFILTER_ADVANCED 791 help 792 This option adds a `CLASSIFY' target, which enables the user to set 793 the priority of a packet. Some qdiscs can use this value for 794 classification, among these are: 795 796 atm, cbq, dsmark, pfifo_fast, htb, prio 797 798 To compile it as a module, choose M here. If unsure, say N. 799 800config NETFILTER_XT_TARGET_CONNMARK 801 tristate '"CONNMARK" target support' 802 depends on NF_CONNTRACK 803 depends on NETFILTER_ADVANCED 804 select NETFILTER_XT_CONNMARK 805 ---help--- 806 This is a backwards-compat option for the user's convenience 807 (e.g. when running oldconfig). It selects 808 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 809 810config NETFILTER_XT_TARGET_CONNSECMARK 811 tristate '"CONNSECMARK" target support' 812 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 813 default m if NETFILTER_ADVANCED=n 814 help 815 The CONNSECMARK target copies security markings from packets 816 to connections, and restores security markings from connections 817 to packets (if the packets are not already marked). This would 818 normally be used in conjunction with the SECMARK target. 819 820 To compile it as a module, choose M here. If unsure, say N. 821 822config NETFILTER_XT_TARGET_CT 823 tristate '"CT" target support' 824 depends on NF_CONNTRACK 825 depends on IP_NF_RAW || IP6_NF_RAW 826 depends on NETFILTER_ADVANCED 827 help 828 This options adds a `CT' target, which allows to specify initial 829 connection tracking parameters like events to be delivered and 830 the helper to be used. 831 832 To compile it as a module, choose M here. If unsure, say N. 833 834config NETFILTER_XT_TARGET_DSCP 835 tristate '"DSCP" and "TOS" target support' 836 depends on IP_NF_MANGLE || IP6_NF_MANGLE 837 depends on NETFILTER_ADVANCED 838 help 839 This option adds a `DSCP' target, which allows you to manipulate 840 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 841 842 The DSCP field can have any value between 0x0 and 0x3f inclusive. 843 844 It also adds the "TOS" target, which allows you to create rules in 845 the "mangle" table which alter the Type Of Service field of an IPv4 846 or the Priority field of an IPv6 packet, prior to routing. 847 848 To compile it as a module, choose M here. If unsure, say N. 849 850config NETFILTER_XT_TARGET_HL 851 tristate '"HL" hoplimit target support' 852 depends on IP_NF_MANGLE || IP6_NF_MANGLE 853 depends on NETFILTER_ADVANCED 854 ---help--- 855 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 856 targets, which enable the user to change the 857 hoplimit/time-to-live value of the IP header. 858 859 While it is safe to decrement the hoplimit/TTL value, the 860 modules also allow to increment and set the hoplimit value of 861 the header to arbitrary values. This is EXTREMELY DANGEROUS 862 since you can easily create immortal packets that loop 863 forever on the network. 864 865config NETFILTER_XT_TARGET_HMARK 866 tristate '"HMARK" target support' 867 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 868 depends on NETFILTER_ADVANCED 869 ---help--- 870 This option adds the "HMARK" target. 871 872 The target allows you to create rules in the "raw" and "mangle" tables 873 which set the skbuff mark by means of hash calculation within a given 874 range. The nfmark can influence the routing method and can also be used 875 by other subsystems to change their behaviour. 876 877 To compile it as a module, choose M here. If unsure, say N. 878 879config NETFILTER_XT_TARGET_IDLETIMER 880 tristate "IDLETIMER target support" 881 depends on NETFILTER_ADVANCED 882 help 883 884 This option adds the `IDLETIMER' target. Each matching packet 885 resets the timer associated with label specified when the rule is 886 added. When the timer expires, it triggers a sysfs notification. 887 The remaining time for expiration can be read via sysfs. 888 889 To compile it as a module, choose M here. If unsure, say N. 890 891config NETFILTER_XT_TARGET_LED 892 tristate '"LED" target support' 893 depends on LEDS_CLASS && LEDS_TRIGGERS 894 depends on NETFILTER_ADVANCED 895 help 896 This option adds a `LED' target, which allows you to blink LEDs in 897 response to particular packets passing through your machine. 898 899 This can be used to turn a spare LED into a network activity LED, 900 which only flashes in response to FTP transfers, for example. Or 901 you could have an LED which lights up for a minute or two every time 902 somebody connects to your machine via SSH. 903 904 You will need support for the "led" class to make this work. 905 906 To create an LED trigger for incoming SSH traffic: 907 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 908 909 Then attach the new trigger to an LED on your system: 910 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 911 912 For more information on the LEDs available on your system, see 913 Documentation/leds/leds-class.txt 914 915config NETFILTER_XT_TARGET_LOG 916 tristate "LOG target support" 917 select NF_LOG_COMMON 918 select NF_LOG_IPV4 919 select NF_LOG_IPV6 if IP6_NF_IPTABLES 920 default m if NETFILTER_ADVANCED=n 921 help 922 This option adds a `LOG' target, which allows you to create rules in 923 any iptables table which records the packet header to the syslog. 924 925 To compile it as a module, choose M here. If unsure, say N. 926 927config NETFILTER_XT_TARGET_MARK 928 tristate '"MARK" target support' 929 depends on NETFILTER_ADVANCED 930 select NETFILTER_XT_MARK 931 ---help--- 932 This is a backwards-compat option for the user's convenience 933 (e.g. when running oldconfig). It selects 934 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 935 936config NETFILTER_XT_NAT 937 tristate '"SNAT and DNAT" targets support' 938 depends on NF_NAT 939 ---help--- 940 This option enables the SNAT and DNAT targets. 941 942 To compile it as a module, choose M here. If unsure, say N. 943 944config NETFILTER_XT_TARGET_NETMAP 945 tristate '"NETMAP" target support' 946 depends on NF_NAT 947 ---help--- 948 NETMAP is an implementation of static 1:1 NAT mapping of network 949 addresses. It maps the network address part, while keeping the host 950 address part intact. 951 952 To compile it as a module, choose M here. If unsure, say N. 953 954config NETFILTER_XT_TARGET_NFLOG 955 tristate '"NFLOG" target support' 956 default m if NETFILTER_ADVANCED=n 957 select NETFILTER_NETLINK_LOG 958 help 959 This option enables the NFLOG target, which allows to LOG 960 messages through nfnetlink_log. 961 962 To compile it as a module, choose M here. If unsure, say N. 963 964config NETFILTER_XT_TARGET_NFQUEUE 965 tristate '"NFQUEUE" target Support' 966 depends on NETFILTER_ADVANCED 967 select NETFILTER_NETLINK_QUEUE 968 help 969 This target replaced the old obsolete QUEUE target. 970 971 As opposed to QUEUE, it supports 65535 different queues, 972 not just one. 973 974 To compile it as a module, choose M here. If unsure, say N. 975 976config NETFILTER_XT_TARGET_NOTRACK 977 tristate '"NOTRACK" target support (DEPRECATED)' 978 depends on NF_CONNTRACK 979 depends on IP_NF_RAW || IP6_NF_RAW 980 depends on NETFILTER_ADVANCED 981 select NETFILTER_XT_TARGET_CT 982 983config NETFILTER_XT_TARGET_RATEEST 984 tristate '"RATEEST" target support' 985 depends on NETFILTER_ADVANCED 986 help 987 This option adds a `RATEEST' target, which allows to measure 988 rates similar to TC estimators. The `rateest' match can be 989 used to match on the measured rates. 990 991 To compile it as a module, choose M here. If unsure, say N. 992 993config NETFILTER_XT_TARGET_REDIRECT 994 tristate "REDIRECT target support" 995 depends on NF_NAT 996 select NF_NAT_REDIRECT 997 ---help--- 998 REDIRECT is a special case of NAT: all incoming connections are 999 mapped onto the incoming interface's address, causing the packets to 1000 come to the local machine instead of passing through. This is 1001 useful for transparent proxies. 1002 1003 To compile it as a module, choose M here. If unsure, say N. 1004 1005config NETFILTER_XT_TARGET_TEE 1006 tristate '"TEE" - packet cloning to alternate destination' 1007 depends on NETFILTER_ADVANCED 1008 depends on IPV6 || IPV6=n 1009 depends on !NF_CONNTRACK || NF_CONNTRACK 1010 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES 1011 select NF_DUP_IPV4 1012 select NF_DUP_IPV6 if IP6_NF_IPTABLES 1013 ---help--- 1014 This option adds a "TEE" target with which a packet can be cloned and 1015 this clone be rerouted to another nexthop. 1016 1017config NETFILTER_XT_TARGET_TPROXY 1018 tristate '"TPROXY" target transparent proxying support' 1019 depends on NETFILTER_XTABLES 1020 depends on NETFILTER_ADVANCED 1021 depends on IPV6 || IPV6=n 1022 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1023 depends on IP_NF_MANGLE 1024 select NF_DEFRAG_IPV4 1025 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1026 select NF_TPROXY_IPV4 1027 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES 1028 help 1029 This option adds a `TPROXY' target, which is somewhat similar to 1030 REDIRECT. It can only be used in the mangle table and is useful 1031 to redirect traffic to a transparent proxy. It does _not_ depend 1032 on Netfilter connection tracking and NAT, unlike REDIRECT. 1033 For it to work you will have to configure certain iptables rules 1034 and use policy routing. For more information on how to set it up 1035 see Documentation/networking/tproxy.txt. 1036 1037 To compile it as a module, choose M here. If unsure, say N. 1038 1039config NETFILTER_XT_TARGET_TRACE 1040 tristate '"TRACE" target support' 1041 depends on IP_NF_RAW || IP6_NF_RAW 1042 depends on NETFILTER_ADVANCED 1043 help 1044 The TRACE target allows you to mark packets so that the kernel 1045 will log every rule which match the packets as those traverse 1046 the tables, chains, rules. 1047 1048 If you want to compile it as a module, say M here and read 1049 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1050 1051config NETFILTER_XT_TARGET_SECMARK 1052 tristate '"SECMARK" target support' 1053 depends on NETWORK_SECMARK 1054 default m if NETFILTER_ADVANCED=n 1055 help 1056 The SECMARK target allows security marking of network 1057 packets, for use with security subsystems. 1058 1059 To compile it as a module, choose M here. If unsure, say N. 1060 1061config NETFILTER_XT_TARGET_TCPMSS 1062 tristate '"TCPMSS" target support' 1063 depends on IPV6 || IPV6=n 1064 default m if NETFILTER_ADVANCED=n 1065 ---help--- 1066 This option adds a `TCPMSS' target, which allows you to alter the 1067 MSS value of TCP SYN packets, to control the maximum size for that 1068 connection (usually limiting it to your outgoing interface's MTU 1069 minus 40). 1070 1071 This is used to overcome criminally braindead ISPs or servers which 1072 block ICMP Fragmentation Needed packets. The symptoms of this 1073 problem are that everything works fine from your Linux 1074 firewall/router, but machines behind it can never exchange large 1075 packets: 1076 1) Web browsers connect, then hang with no data received. 1077 2) Small mail works fine, but large emails hang. 1078 3) ssh works fine, but scp hangs after initial handshaking. 1079 1080 Workaround: activate this option and add a rule to your firewall 1081 configuration like: 1082 1083 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1084 -j TCPMSS --clamp-mss-to-pmtu 1085 1086 To compile it as a module, choose M here. If unsure, say N. 1087 1088config NETFILTER_XT_TARGET_TCPOPTSTRIP 1089 tristate '"TCPOPTSTRIP" target support' 1090 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1091 depends on NETFILTER_ADVANCED 1092 help 1093 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1094 TCP options from TCP packets. 1095 1096# alphabetically ordered list of matches 1097 1098comment "Xtables matches" 1099 1100config NETFILTER_XT_MATCH_ADDRTYPE 1101 tristate '"addrtype" address type match support' 1102 default m if NETFILTER_ADVANCED=n 1103 ---help--- 1104 This option allows you to match what routing thinks of an address, 1105 eg. UNICAST, LOCAL, BROADCAST, ... 1106 1107 If you want to compile it as a module, say M here and read 1108 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1109 1110config NETFILTER_XT_MATCH_BPF 1111 tristate '"bpf" match support' 1112 depends on NETFILTER_ADVANCED 1113 help 1114 BPF matching applies a linux socket filter to each packet and 1115 accepts those for which the filter returns non-zero. 1116 1117 To compile it as a module, choose M here. If unsure, say N. 1118 1119config NETFILTER_XT_MATCH_CGROUP 1120 tristate '"control group" match support' 1121 depends on NETFILTER_ADVANCED 1122 depends on CGROUPS 1123 select CGROUP_NET_CLASSID 1124 ---help--- 1125 Socket/process control group matching allows you to match locally 1126 generated packets based on which net_cls control group processes 1127 belong to. 1128 1129config NETFILTER_XT_MATCH_CLUSTER 1130 tristate '"cluster" match support' 1131 depends on NF_CONNTRACK 1132 depends on NETFILTER_ADVANCED 1133 ---help--- 1134 This option allows you to build work-load-sharing clusters of 1135 network servers/stateful firewalls without having a dedicated 1136 load-balancing router/server/switch. Basically, this match returns 1137 true when the packet must be handled by this cluster node. Thus, 1138 all nodes see all packets and this match decides which node handles 1139 what packets. The work-load sharing algorithm is based on source 1140 address hashing. 1141 1142 If you say Y or M here, try `iptables -m cluster --help` for 1143 more information. 1144 1145config NETFILTER_XT_MATCH_COMMENT 1146 tristate '"comment" match support' 1147 depends on NETFILTER_ADVANCED 1148 help 1149 This option adds a `comment' dummy-match, which allows you to put 1150 comments in your iptables ruleset. 1151 1152 If you want to compile it as a module, say M here and read 1153 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1154 1155config NETFILTER_XT_MATCH_CONNBYTES 1156 tristate '"connbytes" per-connection counter match support' 1157 depends on NF_CONNTRACK 1158 depends on NETFILTER_ADVANCED 1159 help 1160 This option adds a `connbytes' match, which allows you to match the 1161 number of bytes and/or packets for each direction within a connection. 1162 1163 If you want to compile it as a module, say M here and read 1164 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1165 1166config NETFILTER_XT_MATCH_CONNLABEL 1167 tristate '"connlabel" match support' 1168 select NF_CONNTRACK_LABELS 1169 depends on NF_CONNTRACK 1170 depends on NETFILTER_ADVANCED 1171 ---help--- 1172 This match allows you to test and assign userspace-defined labels names 1173 to a connection. The kernel only stores bit values - mapping 1174 names to bits is done by userspace. 1175 1176 Unlike connmark, more than 32 flag bits may be assigned to a 1177 connection simultaneously. 1178 1179config NETFILTER_XT_MATCH_CONNLIMIT 1180 tristate '"connlimit" match support' 1181 depends on NF_CONNTRACK 1182 depends on NETFILTER_ADVANCED 1183 select NETFILTER_CONNCOUNT 1184 ---help--- 1185 This match allows you to match against the number of parallel 1186 connections to a server per client IP address (or address block). 1187 1188config NETFILTER_XT_MATCH_CONNMARK 1189 tristate '"connmark" connection mark match support' 1190 depends on NF_CONNTRACK 1191 depends on NETFILTER_ADVANCED 1192 select NETFILTER_XT_CONNMARK 1193 ---help--- 1194 This is a backwards-compat option for the user's convenience 1195 (e.g. when running oldconfig). It selects 1196 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1197 1198config NETFILTER_XT_MATCH_CONNTRACK 1199 tristate '"conntrack" connection tracking match support' 1200 depends on NF_CONNTRACK 1201 default m if NETFILTER_ADVANCED=n 1202 help 1203 This is a general conntrack match module, a superset of the state match. 1204 1205 It allows matching on additional conntrack information, which is 1206 useful in complex configurations, such as NAT gateways with multiple 1207 internet links or tunnels. 1208 1209 To compile it as a module, choose M here. If unsure, say N. 1210 1211config NETFILTER_XT_MATCH_CPU 1212 tristate '"cpu" match support' 1213 depends on NETFILTER_ADVANCED 1214 help 1215 CPU matching allows you to match packets based on the CPU 1216 currently handling the packet. 1217 1218 To compile it as a module, choose M here. If unsure, say N. 1219 1220config NETFILTER_XT_MATCH_DCCP 1221 tristate '"dccp" protocol match support' 1222 depends on NETFILTER_ADVANCED 1223 default IP_DCCP 1224 help 1225 With this option enabled, you will be able to use the iptables 1226 `dccp' match in order to match on DCCP source/destination ports 1227 and DCCP flags. 1228 1229 If you want to compile it as a module, say M here and read 1230 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1231 1232config NETFILTER_XT_MATCH_DEVGROUP 1233 tristate '"devgroup" match support' 1234 depends on NETFILTER_ADVANCED 1235 help 1236 This options adds a `devgroup' match, which allows to match on the 1237 device group a network device is assigned to. 1238 1239 To compile it as a module, choose M here. If unsure, say N. 1240 1241config NETFILTER_XT_MATCH_DSCP 1242 tristate '"dscp" and "tos" match support' 1243 depends on NETFILTER_ADVANCED 1244 help 1245 This option adds a `DSCP' match, which allows you to match against 1246 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1247 1248 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1249 1250 It will also add a "tos" match, which allows you to match packets 1251 based on the Type Of Service fields of the IPv4 packet (which share 1252 the same bits as DSCP). 1253 1254 To compile it as a module, choose M here. If unsure, say N. 1255 1256config NETFILTER_XT_MATCH_ECN 1257 tristate '"ecn" match support' 1258 depends on NETFILTER_ADVANCED 1259 ---help--- 1260 This option adds an "ECN" match, which allows you to match against 1261 the IPv4 and TCP header ECN fields. 1262 1263 To compile it as a module, choose M here. If unsure, say N. 1264 1265config NETFILTER_XT_MATCH_ESP 1266 tristate '"esp" match support' 1267 depends on NETFILTER_ADVANCED 1268 help 1269 This match extension allows you to match a range of SPIs 1270 inside ESP header of IPSec packets. 1271 1272 To compile it as a module, choose M here. If unsure, say N. 1273 1274config NETFILTER_XT_MATCH_HASHLIMIT 1275 tristate '"hashlimit" match support' 1276 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1277 depends on NETFILTER_ADVANCED 1278 help 1279 This option adds a `hashlimit' match. 1280 1281 As opposed to `limit', this match dynamically creates a hash table 1282 of limit buckets, based on your selection of source/destination 1283 addresses and/or ports. 1284 1285 It enables you to express policies like `10kpps for any given 1286 destination address' or `500pps from any given source address' 1287 with a single rule. 1288 1289config NETFILTER_XT_MATCH_HELPER 1290 tristate '"helper" match support' 1291 depends on NF_CONNTRACK 1292 depends on NETFILTER_ADVANCED 1293 help 1294 Helper matching allows you to match packets in dynamic connections 1295 tracked by a conntrack-helper, ie. ip_conntrack_ftp 1296 1297 To compile it as a module, choose M here. If unsure, say Y. 1298 1299config NETFILTER_XT_MATCH_HL 1300 tristate '"hl" hoplimit/TTL match support' 1301 depends on NETFILTER_ADVANCED 1302 ---help--- 1303 HL matching allows you to match packets based on the hoplimit 1304 in the IPv6 header, or the time-to-live field in the IPv4 1305 header of the packet. 1306 1307config NETFILTER_XT_MATCH_IPCOMP 1308 tristate '"ipcomp" match support' 1309 depends on NETFILTER_ADVANCED 1310 help 1311 This match extension allows you to match a range of CPIs(16 bits) 1312 inside IPComp header of IPSec packets. 1313 1314 To compile it as a module, choose M here. If unsure, say N. 1315 1316config NETFILTER_XT_MATCH_IPRANGE 1317 tristate '"iprange" address range match support' 1318 depends on NETFILTER_ADVANCED 1319 ---help--- 1320 This option adds a "iprange" match, which allows you to match based on 1321 an IP address range. (Normal iptables only matches on single addresses 1322 with an optional mask.) 1323 1324 If unsure, say M. 1325 1326config NETFILTER_XT_MATCH_IPVS 1327 tristate '"ipvs" match support' 1328 depends on IP_VS 1329 depends on NETFILTER_ADVANCED 1330 depends on NF_CONNTRACK 1331 help 1332 This option allows you to match against IPVS properties of a packet. 1333 1334 If unsure, say N. 1335 1336config NETFILTER_XT_MATCH_L2TP 1337 tristate '"l2tp" match support' 1338 depends on NETFILTER_ADVANCED 1339 default L2TP 1340 ---help--- 1341 This option adds an "L2TP" match, which allows you to match against 1342 L2TP protocol header fields. 1343 1344 To compile it as a module, choose M here. If unsure, say N. 1345 1346config NETFILTER_XT_MATCH_LENGTH 1347 tristate '"length" match support' 1348 depends on NETFILTER_ADVANCED 1349 help 1350 This option allows you to match the length of a packet against a 1351 specific value or range of values. 1352 1353 To compile it as a module, choose M here. If unsure, say N. 1354 1355config NETFILTER_XT_MATCH_LIMIT 1356 tristate '"limit" match support' 1357 depends on NETFILTER_ADVANCED 1358 help 1359 limit matching allows you to control the rate at which a rule can be 1360 matched: mainly useful in combination with the LOG target ("LOG 1361 target support", below) and to avoid some Denial of Service attacks. 1362 1363 To compile it as a module, choose M here. If unsure, say N. 1364 1365config NETFILTER_XT_MATCH_MAC 1366 tristate '"mac" address match support' 1367 depends on NETFILTER_ADVANCED 1368 help 1369 MAC matching allows you to match packets based on the source 1370 Ethernet address of the packet. 1371 1372 To compile it as a module, choose M here. If unsure, say N. 1373 1374config NETFILTER_XT_MATCH_MARK 1375 tristate '"mark" match support' 1376 depends on NETFILTER_ADVANCED 1377 select NETFILTER_XT_MARK 1378 ---help--- 1379 This is a backwards-compat option for the user's convenience 1380 (e.g. when running oldconfig). It selects 1381 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1382 1383config NETFILTER_XT_MATCH_MULTIPORT 1384 tristate '"multiport" Multiple port match support' 1385 depends on NETFILTER_ADVANCED 1386 help 1387 Multiport matching allows you to match TCP or UDP packets based on 1388 a series of source or destination ports: normally a rule can only 1389 match a single range of ports. 1390 1391 To compile it as a module, choose M here. If unsure, say N. 1392 1393config NETFILTER_XT_MATCH_NFACCT 1394 tristate '"nfacct" match support' 1395 depends on NETFILTER_ADVANCED 1396 select NETFILTER_NETLINK_ACCT 1397 help 1398 This option allows you to use the extended accounting through 1399 nfnetlink_acct. 1400 1401 To compile it as a module, choose M here. If unsure, say N. 1402 1403config NETFILTER_XT_MATCH_OSF 1404 tristate '"osf" Passive OS fingerprint match' 1405 depends on NETFILTER_ADVANCED 1406 select NETFILTER_NETLINK_OSF 1407 help 1408 This option selects the Passive OS Fingerprinting match module 1409 that allows to passively match the remote operating system by 1410 analyzing incoming TCP SYN packets. 1411 1412 Rules and loading software can be downloaded from 1413 http://www.ioremap.net/projects/osf 1414 1415 To compile it as a module, choose M here. If unsure, say N. 1416 1417config NETFILTER_XT_MATCH_OWNER 1418 tristate '"owner" match support' 1419 depends on NETFILTER_ADVANCED 1420 ---help--- 1421 Socket owner matching allows you to match locally-generated packets 1422 based on who created the socket: the user or group. It is also 1423 possible to check whether a socket actually exists. 1424 1425config NETFILTER_XT_MATCH_POLICY 1426 tristate 'IPsec "policy" match support' 1427 depends on XFRM 1428 default m if NETFILTER_ADVANCED=n 1429 help 1430 Policy matching allows you to match packets based on the 1431 IPsec policy that was used during decapsulation/will 1432 be used during encapsulation. 1433 1434 To compile it as a module, choose M here. If unsure, say N. 1435 1436config NETFILTER_XT_MATCH_PHYSDEV 1437 tristate '"physdev" match support' 1438 depends on BRIDGE && BRIDGE_NETFILTER 1439 depends on NETFILTER_ADVANCED 1440 help 1441 Physdev packet matching matches against the physical bridge ports 1442 the IP packet arrived on or will leave by. 1443 1444 To compile it as a module, choose M here. If unsure, say N. 1445 1446config NETFILTER_XT_MATCH_PKTTYPE 1447 tristate '"pkttype" packet type match support' 1448 depends on NETFILTER_ADVANCED 1449 help 1450 Packet type matching allows you to match a packet by 1451 its "class", eg. BROADCAST, MULTICAST, ... 1452 1453 Typical usage: 1454 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1455 1456 To compile it as a module, choose M here. If unsure, say N. 1457 1458config NETFILTER_XT_MATCH_QUOTA 1459 tristate '"quota" match support' 1460 depends on NETFILTER_ADVANCED 1461 help 1462 This option adds a `quota' match, which allows to match on a 1463 byte counter. 1464 1465 If you want to compile it as a module, say M here and read 1466 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1467 1468config NETFILTER_XT_MATCH_RATEEST 1469 tristate '"rateest" match support' 1470 depends on NETFILTER_ADVANCED 1471 select NETFILTER_XT_TARGET_RATEEST 1472 help 1473 This option adds a `rateest' match, which allows to match on the 1474 rate estimated by the RATEEST target. 1475 1476 To compile it as a module, choose M here. If unsure, say N. 1477 1478config NETFILTER_XT_MATCH_REALM 1479 tristate '"realm" match support' 1480 depends on NETFILTER_ADVANCED 1481 select IP_ROUTE_CLASSID 1482 help 1483 This option adds a `realm' match, which allows you to use the realm 1484 key from the routing subsystem inside iptables. 1485 1486 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1487 in tc world. 1488 1489 If you want to compile it as a module, say M here and read 1490 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1491 1492config NETFILTER_XT_MATCH_RECENT 1493 tristate '"recent" match support' 1494 depends on NETFILTER_ADVANCED 1495 ---help--- 1496 This match is used for creating one or many lists of recently 1497 used addresses and then matching against that/those list(s). 1498 1499 Short options are available by using 'iptables -m recent -h' 1500 Official Website: <http://snowman.net/projects/ipt_recent/> 1501 1502config NETFILTER_XT_MATCH_SCTP 1503 tristate '"sctp" protocol match support' 1504 depends on NETFILTER_ADVANCED 1505 default IP_SCTP 1506 help 1507 With this option enabled, you will be able to use the 1508 `sctp' match in order to match on SCTP source/destination ports 1509 and SCTP chunk types. 1510 1511 If you want to compile it as a module, say M here and read 1512 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1513 1514config NETFILTER_XT_MATCH_SOCKET 1515 tristate '"socket" match support' 1516 depends on NETFILTER_XTABLES 1517 depends on NETFILTER_ADVANCED 1518 depends on IPV6 || IPV6=n 1519 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1520 select NF_SOCKET_IPV4 1521 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES 1522 select NF_DEFRAG_IPV4 1523 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1524 help 1525 This option adds a `socket' match, which can be used to match 1526 packets for which a TCP or UDP socket lookup finds a valid socket. 1527 It can be used in combination with the MARK target and policy 1528 routing to implement full featured non-locally bound sockets. 1529 1530 To compile it as a module, choose M here. If unsure, say N. 1531 1532config NETFILTER_XT_MATCH_STATE 1533 tristate '"state" match support' 1534 depends on NF_CONNTRACK 1535 default m if NETFILTER_ADVANCED=n 1536 help 1537 Connection state matching allows you to match packets based on their 1538 relationship to a tracked connection (ie. previous packets). This 1539 is a powerful tool for packet classification. 1540 1541 To compile it as a module, choose M here. If unsure, say N. 1542 1543config NETFILTER_XT_MATCH_STATISTIC 1544 tristate '"statistic" match support' 1545 depends on NETFILTER_ADVANCED 1546 help 1547 This option adds a `statistic' match, which allows you to match 1548 on packets periodically or randomly with a given percentage. 1549 1550 To compile it as a module, choose M here. If unsure, say N. 1551 1552config NETFILTER_XT_MATCH_STRING 1553 tristate '"string" match support' 1554 depends on NETFILTER_ADVANCED 1555 select TEXTSEARCH 1556 select TEXTSEARCH_KMP 1557 select TEXTSEARCH_BM 1558 select TEXTSEARCH_FSM 1559 help 1560 This option adds a `string' match, which allows you to look for 1561 pattern matchings in packets. 1562 1563 To compile it as a module, choose M here. If unsure, say N. 1564 1565config NETFILTER_XT_MATCH_TCPMSS 1566 tristate '"tcpmss" match support' 1567 depends on NETFILTER_ADVANCED 1568 help 1569 This option adds a `tcpmss' match, which allows you to examine the 1570 MSS value of TCP SYN packets, which control the maximum packet size 1571 for that connection. 1572 1573 To compile it as a module, choose M here. If unsure, say N. 1574 1575config NETFILTER_XT_MATCH_TIME 1576 tristate '"time" match support' 1577 depends on NETFILTER_ADVANCED 1578 ---help--- 1579 This option adds a "time" match, which allows you to match based on 1580 the packet arrival time (at the machine which netfilter is running) 1581 on) or departure time/date (for locally generated packets). 1582 1583 If you say Y here, try `iptables -m time --help` for 1584 more information. 1585 1586 If you want to compile it as a module, say M here. 1587 If unsure, say N. 1588 1589config NETFILTER_XT_MATCH_U32 1590 tristate '"u32" match support' 1591 depends on NETFILTER_ADVANCED 1592 ---help--- 1593 u32 allows you to extract quantities of up to 4 bytes from a packet, 1594 AND them with specified masks, shift them by specified amounts and 1595 test whether the results are in any of a set of specified ranges. 1596 The specification of what to extract is general enough to skip over 1597 headers with lengths stored in the packet, as in IP or TCP header 1598 lengths. 1599 1600 Details and examples are in the kernel module source. 1601 1602endif # NETFILTER_XTABLES 1603 1604endmenu 1605 1606source "net/netfilter/ipset/Kconfig" 1607 1608source "net/netfilter/ipvs/Kconfig" 1609