1menu "Core Netfilter Configuration" 2 depends on NET && INET && NETFILTER 3 4config NETFILTER_INGRESS 5 bool "Netfilter ingress support" 6 default y 7 select NET_INGRESS 8 help 9 This allows you to classify packets from ingress using the Netfilter 10 infrastructure. 11 12config NETFILTER_NETLINK 13 tristate 14 15config NETFILTER_NETLINK_ACCT 16tristate "Netfilter NFACCT over NFNETLINK interface" 17 depends on NETFILTER_ADVANCED 18 select NETFILTER_NETLINK 19 help 20 If this option is enabled, the kernel will include support 21 for extended accounting via NFNETLINK. 22 23config NETFILTER_NETLINK_QUEUE 24 tristate "Netfilter NFQUEUE over NFNETLINK interface" 25 depends on NETFILTER_ADVANCED 26 select NETFILTER_NETLINK 27 help 28 If this option is enabled, the kernel will include support 29 for queueing packets via NFNETLINK. 30 31config NETFILTER_NETLINK_LOG 32 tristate "Netfilter LOG over NFNETLINK interface" 33 default m if NETFILTER_ADVANCED=n 34 select NETFILTER_NETLINK 35 help 36 If this option is enabled, the kernel will include support 37 for logging packets via NFNETLINK. 38 39 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 40 and is also scheduled to replace the old syslog-based ipt_LOG 41 and ip6t_LOG modules. 42 43config NF_CONNTRACK 44 tristate "Netfilter connection tracking support" 45 default m if NETFILTER_ADVANCED=n 46 help 47 Connection tracking keeps a record of what packets have passed 48 through your machine, in order to figure out how they are related 49 into connections. 50 51 This is required to do Masquerading or other kinds of Network 52 Address Translation. It can also be used to enhance packet 53 filtering (see `Connection state match support' below). 54 55 To compile it as a module, choose M here. If unsure, say N. 56 57config NF_LOG_COMMON 58 tristate 59 60config NF_LOG_NETDEV 61 tristate "Netdev packet logging" 62 select NF_LOG_COMMON 63 64if NF_CONNTRACK 65 66config NF_CONNTRACK_MARK 67 bool 'Connection mark tracking support' 68 depends on NETFILTER_ADVANCED 69 help 70 This option enables support for connection marks, used by the 71 `CONNMARK' target and `connmark' match. Similar to the mark value 72 of packets, but this mark value is kept in the conntrack session 73 instead of the individual packets. 74 75config NF_CONNTRACK_SECMARK 76 bool 'Connection tracking security mark support' 77 depends on NETWORK_SECMARK 78 default m if NETFILTER_ADVANCED=n 79 help 80 This option enables security markings to be applied to 81 connections. Typically they are copied to connections from 82 packets using the CONNSECMARK target and copied back from 83 connections to packets with the same target, with the packets 84 being originally labeled via SECMARK. 85 86 If unsure, say 'N'. 87 88config NF_CONNTRACK_ZONES 89 bool 'Connection tracking zones' 90 depends on NETFILTER_ADVANCED 91 depends on NETFILTER_XT_TARGET_CT 92 help 93 This option enables support for connection tracking zones. 94 Normally, each connection needs to have a unique system wide 95 identity. Connection tracking zones allow to have multiple 96 connections using the same identity, as long as they are 97 contained in different zones. 98 99 If unsure, say `N'. 100 101config NF_CONNTRACK_PROCFS 102 bool "Supply CT list in procfs (OBSOLETE)" 103 default y 104 depends on PROC_FS 105 ---help--- 106 This option enables for the list of known conntrack entries 107 to be shown in procfs under net/netfilter/nf_conntrack. This 108 is considered obsolete in favor of using the conntrack(8) 109 tool which uses Netlink. 110 111config NF_CONNTRACK_EVENTS 112 bool "Connection tracking events" 113 depends on NETFILTER_ADVANCED 114 help 115 If this option is enabled, the connection tracking code will 116 provide a notifier chain that can be used by other kernel code 117 to get notified about changes in the connection tracking state. 118 119 If unsure, say `N'. 120 121config NF_CONNTRACK_TIMEOUT 122 bool 'Connection tracking timeout' 123 depends on NETFILTER_ADVANCED 124 help 125 This option enables support for connection tracking timeout 126 extension. This allows you to attach timeout policies to flow 127 via the CT target. 128 129 If unsure, say `N'. 130 131config NF_CONNTRACK_TIMESTAMP 132 bool 'Connection tracking timestamping' 133 depends on NETFILTER_ADVANCED 134 help 135 This option enables support for connection tracking timestamping. 136 This allows you to store the flow start-time and to obtain 137 the flow-stop time (once it has been destroyed) via Connection 138 tracking events. 139 140 If unsure, say `N'. 141 142config NF_CONNTRACK_LABELS 143 bool 144 help 145 This option enables support for assigning user-defined flag bits 146 to connection tracking entries. It selected by the connlabel match. 147 148config NF_CT_PROTO_DCCP 149 bool 'DCCP protocol connection tracking support' 150 depends on NETFILTER_ADVANCED 151 default y 152 help 153 With this option enabled, the layer 3 independent connection 154 tracking code will be able to do state tracking on DCCP connections. 155 156 If unsure, say Y. 157 158config NF_CT_PROTO_GRE 159 tristate 160 161config NF_CT_PROTO_SCTP 162 bool 'SCTP protocol connection tracking support' 163 depends on NETFILTER_ADVANCED 164 default y 165 select LIBCRC32C 166 help 167 With this option enabled, the layer 3 independent connection 168 tracking code will be able to do state tracking on SCTP connections. 169 170 If unsure, say Y. 171 172config NF_CT_PROTO_UDPLITE 173 bool 'UDP-Lite protocol connection tracking support' 174 depends on NETFILTER_ADVANCED 175 default y 176 help 177 With this option enabled, the layer 3 independent connection 178 tracking code will be able to do state tracking on UDP-Lite 179 connections. 180 181 If unsure, say Y. 182 183config NF_CONNTRACK_AMANDA 184 tristate "Amanda backup protocol support" 185 depends on NETFILTER_ADVANCED 186 select TEXTSEARCH 187 select TEXTSEARCH_KMP 188 help 189 If you are running the Amanda backup package <http://www.amanda.org/> 190 on this machine or machines that will be MASQUERADED through this 191 machine, then you may want to enable this feature. This allows the 192 connection tracking and natting code to allow the sub-channels that 193 Amanda requires for communication of the backup data, messages and 194 index. 195 196 To compile it as a module, choose M here. If unsure, say N. 197 198config NF_CONNTRACK_FTP 199 tristate "FTP protocol support" 200 default m if NETFILTER_ADVANCED=n 201 help 202 Tracking FTP connections is problematic: special helpers are 203 required for tracking them, and doing masquerading and other forms 204 of Network Address Translation on them. 205 206 This is FTP support on Layer 3 independent connection tracking. 207 Layer 3 independent connection tracking is experimental scheme 208 which generalize ip_conntrack to support other layer 3 protocols. 209 210 To compile it as a module, choose M here. If unsure, say N. 211 212config NF_CONNTRACK_H323 213 tristate "H.323 protocol support" 214 depends on IPV6 || IPV6=n 215 depends on NETFILTER_ADVANCED 216 help 217 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 218 important VoIP protocols, it is widely used by voice hardware and 219 software including voice gateways, IP phones, Netmeeting, OpenPhone, 220 Gnomemeeting, etc. 221 222 With this module you can support H.323 on a connection tracking/NAT 223 firewall. 224 225 This module supports RAS, Fast Start, H.245 Tunnelling, Call 226 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 227 whiteboard, file transfer, etc. For more information, please 228 visit http://nath323.sourceforge.net/. 229 230 To compile it as a module, choose M here. If unsure, say N. 231 232config NF_CONNTRACK_IRC 233 tristate "IRC protocol support" 234 default m if NETFILTER_ADVANCED=n 235 help 236 There is a commonly-used extension to IRC called 237 Direct Client-to-Client Protocol (DCC). This enables users to send 238 files to each other, and also chat to each other without the need 239 of a server. DCC Sending is used anywhere you send files over IRC, 240 and DCC Chat is most commonly used by Eggdrop bots. If you are 241 using NAT, this extension will enable you to send files and initiate 242 chats. Note that you do NOT need this extension to get files or 243 have others initiate chats, or everything else in IRC. 244 245 To compile it as a module, choose M here. If unsure, say N. 246 247config NF_CONNTRACK_BROADCAST 248 tristate 249 250config NF_CONNTRACK_NETBIOS_NS 251 tristate "NetBIOS name service protocol support" 252 select NF_CONNTRACK_BROADCAST 253 help 254 NetBIOS name service requests are sent as broadcast messages from an 255 unprivileged port and responded to with unicast messages to the 256 same port. This make them hard to firewall properly because connection 257 tracking doesn't deal with broadcasts. This helper tracks locally 258 originating NetBIOS name service requests and the corresponding 259 responses. It relies on correct IP address configuration, specifically 260 netmask and broadcast address. When properly configured, the output 261 of "ip address show" should look similar to this: 262 263 $ ip -4 address show eth0 264 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 265 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 266 267 To compile it as a module, choose M here. If unsure, say N. 268 269config NF_CONNTRACK_SNMP 270 tristate "SNMP service protocol support" 271 depends on NETFILTER_ADVANCED 272 select NF_CONNTRACK_BROADCAST 273 help 274 SNMP service requests are sent as broadcast messages from an 275 unprivileged port and responded to with unicast messages to the 276 same port. This make them hard to firewall properly because connection 277 tracking doesn't deal with broadcasts. This helper tracks locally 278 originating SNMP service requests and the corresponding 279 responses. It relies on correct IP address configuration, specifically 280 netmask and broadcast address. 281 282 To compile it as a module, choose M here. If unsure, say N. 283 284config NF_CONNTRACK_PPTP 285 tristate "PPtP protocol support" 286 depends on NETFILTER_ADVANCED 287 select NF_CT_PROTO_GRE 288 help 289 This module adds support for PPTP (Point to Point Tunnelling 290 Protocol, RFC2637) connection tracking and NAT. 291 292 If you are running PPTP sessions over a stateful firewall or NAT 293 box, you may want to enable this feature. 294 295 Please note that not all PPTP modes of operation are supported yet. 296 Specifically these limitations exist: 297 - Blindly assumes that control connections are always established 298 in PNS->PAC direction. This is a violation of RFC2637. 299 - Only supports a single call within each session 300 301 To compile it as a module, choose M here. If unsure, say N. 302 303config NF_CONNTRACK_SANE 304 tristate "SANE protocol support" 305 depends on NETFILTER_ADVANCED 306 help 307 SANE is a protocol for remote access to scanners as implemented 308 by the 'saned' daemon. Like FTP, it uses separate control and 309 data connections. 310 311 With this module you can support SANE on a connection tracking 312 firewall. 313 314 To compile it as a module, choose M here. If unsure, say N. 315 316config NF_CONNTRACK_SIP 317 tristate "SIP protocol support" 318 default m if NETFILTER_ADVANCED=n 319 help 320 SIP is an application-layer control protocol that can establish, 321 modify, and terminate multimedia sessions (conferences) such as 322 Internet telephony calls. With the ip_conntrack_sip and 323 the nf_nat_sip modules you can support the protocol on a connection 324 tracking/NATing firewall. 325 326 To compile it as a module, choose M here. If unsure, say N. 327 328config NF_CONNTRACK_TFTP 329 tristate "TFTP protocol support" 330 depends on NETFILTER_ADVANCED 331 help 332 TFTP connection tracking helper, this is required depending 333 on how restrictive your ruleset is. 334 If you are using a tftp client behind -j SNAT or -j MASQUERADING 335 you will need this. 336 337 To compile it as a module, choose M here. If unsure, say N. 338 339config NF_CT_NETLINK 340 tristate 'Connection tracking netlink interface' 341 select NETFILTER_NETLINK 342 default m if NETFILTER_ADVANCED=n 343 help 344 This option enables support for a netlink-based userspace interface 345 346config NF_CT_NETLINK_TIMEOUT 347 tristate 'Connection tracking timeout tuning via Netlink' 348 select NETFILTER_NETLINK 349 depends on NETFILTER_ADVANCED 350 help 351 This option enables support for connection tracking timeout 352 fine-grain tuning. This allows you to attach specific timeout 353 policies to flows, instead of using the global timeout policy. 354 355 If unsure, say `N'. 356 357config NF_CT_NETLINK_HELPER 358 tristate 'Connection tracking helpers in user-space via Netlink' 359 select NETFILTER_NETLINK 360 depends on NF_CT_NETLINK 361 depends on NETFILTER_NETLINK_QUEUE 362 depends on NETFILTER_NETLINK_GLUE_CT 363 depends on NETFILTER_ADVANCED 364 help 365 This option enables the user-space connection tracking helpers 366 infrastructure. 367 368 If unsure, say `N'. 369 370config NETFILTER_NETLINK_GLUE_CT 371 bool "NFQUEUE and NFLOG integration with Connection Tracking" 372 default n 373 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 374 help 375 If this option is enabled, NFQUEUE and NFLOG can include 376 Connection Tracking information together with the packet is 377 the enqueued via NFNETLINK. 378 379config NF_NAT 380 tristate 381 382config NF_NAT_NEEDED 383 bool 384 depends on NF_NAT 385 default y 386 387config NF_NAT_PROTO_DCCP 388 bool 389 depends on NF_NAT && NF_CT_PROTO_DCCP 390 default NF_NAT && NF_CT_PROTO_DCCP 391 392config NF_NAT_PROTO_UDPLITE 393 bool 394 depends on NF_NAT && NF_CT_PROTO_UDPLITE 395 default NF_NAT && NF_CT_PROTO_UDPLITE 396 397config NF_NAT_PROTO_SCTP 398 bool 399 default NF_NAT && NF_CT_PROTO_SCTP 400 depends on NF_NAT && NF_CT_PROTO_SCTP 401 402config NF_NAT_AMANDA 403 tristate 404 depends on NF_CONNTRACK && NF_NAT 405 default NF_NAT && NF_CONNTRACK_AMANDA 406 407config NF_NAT_FTP 408 tristate 409 depends on NF_CONNTRACK && NF_NAT 410 default NF_NAT && NF_CONNTRACK_FTP 411 412config NF_NAT_IRC 413 tristate 414 depends on NF_CONNTRACK && NF_NAT 415 default NF_NAT && NF_CONNTRACK_IRC 416 417config NF_NAT_SIP 418 tristate 419 depends on NF_CONNTRACK && NF_NAT 420 default NF_NAT && NF_CONNTRACK_SIP 421 422config NF_NAT_TFTP 423 tristate 424 depends on NF_CONNTRACK && NF_NAT 425 default NF_NAT && NF_CONNTRACK_TFTP 426 427config NF_NAT_REDIRECT 428 tristate "IPv4/IPv6 redirect support" 429 depends on NF_NAT 430 help 431 This is the kernel functionality to redirect packets to local 432 machine through NAT. 433 434config NETFILTER_SYNPROXY 435 tristate 436 437endif # NF_CONNTRACK 438 439config NF_TABLES 440 select NETFILTER_NETLINK 441 tristate "Netfilter nf_tables support" 442 help 443 nftables is the new packet classification framework that intends to 444 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 445 provides a pseudo-state machine with an extensible instruction-set 446 (also known as expressions) that the userspace 'nft' utility 447 (http://www.netfilter.org/projects/nftables) uses to build the 448 rule-set. It also comes with the generic set infrastructure that 449 allows you to construct mappings between matchings and actions 450 for performance lookups. 451 452 To compile it as a module, choose M here. 453 454if NF_TABLES 455 456config NF_TABLES_INET 457 depends on IPV6 458 select NF_TABLES_IPV4 459 select NF_TABLES_IPV6 460 tristate "Netfilter nf_tables mixed IPv4/IPv6 tables support" 461 help 462 This option enables support for a mixed IPv4/IPv6 "inet" table. 463 464config NF_TABLES_NETDEV 465 tristate "Netfilter nf_tables netdev tables support" 466 help 467 This option enables support for the "netdev" table. 468 469config NFT_EXTHDR 470 tristate "Netfilter nf_tables exthdr module" 471 help 472 This option adds the "exthdr" expression that you can use to match 473 IPv6 extension headers and tcp options. 474 475config NFT_META 476 tristate "Netfilter nf_tables meta module" 477 help 478 This option adds the "meta" expression that you can use to match and 479 to set packet metainformation such as the packet mark. 480 481config NFT_RT 482 tristate "Netfilter nf_tables routing module" 483 help 484 This option adds the "rt" expression that you can use to match 485 packet routing information such as the packet nexthop. 486 487config NFT_NUMGEN 488 tristate "Netfilter nf_tables number generator module" 489 help 490 This option adds the number generator expression used to perform 491 incremental counting and random numbers bound to a upper limit. 492 493config NFT_CT 494 depends on NF_CONNTRACK 495 tristate "Netfilter nf_tables conntrack module" 496 help 497 This option adds the "ct" expression that you can use to match 498 connection tracking information such as the flow state. 499 500config NFT_SET_RBTREE 501 tristate "Netfilter nf_tables rbtree set module" 502 help 503 This option adds the "rbtree" set type (Red Black tree) that is used 504 to build interval-based sets. 505 506config NFT_SET_HASH 507 tristate "Netfilter nf_tables hash set module" 508 help 509 This option adds the "hash" set type that is used to build one-way 510 mappings between matchings and actions. 511 512config NFT_SET_BITMAP 513 tristate "Netfilter nf_tables bitmap set module" 514 help 515 This option adds the "bitmap" set type that is used to build sets 516 whose keys are smaller or equal to 16 bits. 517 518config NFT_COUNTER 519 tristate "Netfilter nf_tables counter module" 520 help 521 This option adds the "counter" expression that you can use to 522 include packet and byte counters in a rule. 523 524config NFT_LOG 525 tristate "Netfilter nf_tables log module" 526 help 527 This option adds the "log" expression that you can use to log 528 packets matching some criteria. 529 530config NFT_LIMIT 531 tristate "Netfilter nf_tables limit module" 532 help 533 This option adds the "limit" expression that you can use to 534 ratelimit rule matchings. 535 536config NFT_MASQ 537 depends on NF_CONNTRACK 538 depends on NF_NAT 539 tristate "Netfilter nf_tables masquerade support" 540 help 541 This option adds the "masquerade" expression that you can use 542 to perform NAT in the masquerade flavour. 543 544config NFT_REDIR 545 depends on NF_CONNTRACK 546 depends on NF_NAT 547 tristate "Netfilter nf_tables redirect support" 548 help 549 This options adds the "redirect" expression that you can use 550 to perform NAT in the redirect flavour. 551 552config NFT_NAT 553 depends on NF_CONNTRACK 554 select NF_NAT 555 tristate "Netfilter nf_tables nat module" 556 help 557 This option adds the "nat" expression that you can use to perform 558 typical Network Address Translation (NAT) packet transformations. 559 560config NFT_OBJREF 561 tristate "Netfilter nf_tables stateful object reference module" 562 help 563 This option adds the "objref" expression that allows you to refer to 564 stateful objects, such as counters and quotas. 565 566config NFT_QUEUE 567 depends on NETFILTER_NETLINK_QUEUE 568 tristate "Netfilter nf_tables queue module" 569 help 570 This is required if you intend to use the userspace queueing 571 infrastructure (also known as NFQUEUE) from nftables. 572 573config NFT_QUOTA 574 tristate "Netfilter nf_tables quota module" 575 help 576 This option adds the "quota" expression that you can use to match 577 enforce bytes quotas. 578 579config NFT_REJECT 580 default m if NETFILTER_ADVANCED=n 581 tristate "Netfilter nf_tables reject support" 582 help 583 This option adds the "reject" expression that you can use to 584 explicitly deny and notify via TCP reset/ICMP informational errors 585 unallowed traffic. 586 587config NFT_REJECT_INET 588 depends on NF_TABLES_INET 589 default NFT_REJECT 590 tristate 591 592config NFT_COMPAT 593 depends on NETFILTER_XTABLES 594 tristate "Netfilter x_tables over nf_tables module" 595 help 596 This is required if you intend to use any of existing 597 x_tables match/target extensions over the nf_tables 598 framework. 599 600config NFT_HASH 601 tristate "Netfilter nf_tables hash module" 602 help 603 This option adds the "hash" expression that you can use to perform 604 a hash operation on registers. 605 606config NFT_FIB 607 tristate 608 609config NFT_FIB_INET 610 depends on NF_TABLES_INET 611 depends on NFT_FIB_IPV4 612 depends on NFT_FIB_IPV6 613 tristate "Netfilter nf_tables fib inet support" 614 help 615 This option allows using the FIB expression from the inet table. 616 The lookup will be delegated to the IPv4 or IPv6 FIB depending 617 on the protocol of the packet. 618 619if NF_TABLES_NETDEV 620 621config NF_DUP_NETDEV 622 tristate "Netfilter packet duplication support" 623 help 624 This option enables the generic packet duplication infrastructure 625 for Netfilter. 626 627config NFT_DUP_NETDEV 628 tristate "Netfilter nf_tables netdev packet duplication support" 629 select NF_DUP_NETDEV 630 help 631 This option enables packet duplication for the "netdev" family. 632 633config NFT_FWD_NETDEV 634 tristate "Netfilter nf_tables netdev packet forwarding support" 635 select NF_DUP_NETDEV 636 help 637 This option enables packet forwarding for the "netdev" family. 638 639endif # NF_TABLES_NETDEV 640 641endif # NF_TABLES 642 643config NETFILTER_XTABLES 644 tristate "Netfilter Xtables support (required for ip_tables)" 645 default m if NETFILTER_ADVANCED=n 646 help 647 This is required if you intend to use any of ip_tables, 648 ip6_tables or arp_tables. 649 650if NETFILTER_XTABLES 651 652comment "Xtables combined modules" 653 654config NETFILTER_XT_MARK 655 tristate 'nfmark target and match support' 656 default m if NETFILTER_ADVANCED=n 657 ---help--- 658 This option adds the "MARK" target and "mark" match. 659 660 Netfilter mark matching allows you to match packets based on the 661 "nfmark" value in the packet. 662 The target allows you to create rules in the "mangle" table which alter 663 the netfilter mark (nfmark) field associated with the packet. 664 665 Prior to routing, the nfmark can influence the routing method and can 666 also be used by other subsystems to change their behavior. 667 668config NETFILTER_XT_CONNMARK 669 tristate 'ctmark target and match support' 670 depends on NF_CONNTRACK 671 depends on NETFILTER_ADVANCED 672 select NF_CONNTRACK_MARK 673 ---help--- 674 This option adds the "CONNMARK" target and "connmark" match. 675 676 Netfilter allows you to store a mark value per connection (a.k.a. 677 ctmark), similarly to the packet mark (nfmark). Using this 678 target and match, you can set and match on this mark. 679 680config NETFILTER_XT_SET 681 tristate 'set target and match support' 682 depends on IP_SET 683 depends on NETFILTER_ADVANCED 684 help 685 This option adds the "SET" target and "set" match. 686 687 Using this target and match, you can add/delete and match 688 elements in the sets created by ipset(8). 689 690 To compile it as a module, choose M here. If unsure, say N. 691 692# alphabetically ordered list of targets 693 694comment "Xtables targets" 695 696config NETFILTER_XT_TARGET_AUDIT 697 tristate "AUDIT target support" 698 depends on AUDIT 699 depends on NETFILTER_ADVANCED 700 ---help--- 701 This option adds a 'AUDIT' target, which can be used to create 702 audit records for packets dropped/accepted. 703 704 To compileit as a module, choose M here. If unsure, say N. 705 706config NETFILTER_XT_TARGET_CHECKSUM 707 tristate "CHECKSUM target support" 708 depends on IP_NF_MANGLE || IP6_NF_MANGLE 709 depends on NETFILTER_ADVANCED 710 ---help--- 711 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 712 table. 713 714 You can use this target to compute and fill in the checksum in 715 a packet that lacks a checksum. This is particularly useful, 716 if you need to work around old applications such as dhcp clients, 717 that do not work well with checksum offloads, but don't want to disable 718 checksum offload in your device. 719 720 To compile it as a module, choose M here. If unsure, say N. 721 722config NETFILTER_XT_TARGET_CLASSIFY 723 tristate '"CLASSIFY" target support' 724 depends on NETFILTER_ADVANCED 725 help 726 This option adds a `CLASSIFY' target, which enables the user to set 727 the priority of a packet. Some qdiscs can use this value for 728 classification, among these are: 729 730 atm, cbq, dsmark, pfifo_fast, htb, prio 731 732 To compile it as a module, choose M here. If unsure, say N. 733 734config NETFILTER_XT_TARGET_CONNMARK 735 tristate '"CONNMARK" target support' 736 depends on NF_CONNTRACK 737 depends on NETFILTER_ADVANCED 738 select NETFILTER_XT_CONNMARK 739 ---help--- 740 This is a backwards-compat option for the user's convenience 741 (e.g. when running oldconfig). It selects 742 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 743 744config NETFILTER_XT_TARGET_CONNSECMARK 745 tristate '"CONNSECMARK" target support' 746 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 747 default m if NETFILTER_ADVANCED=n 748 help 749 The CONNSECMARK target copies security markings from packets 750 to connections, and restores security markings from connections 751 to packets (if the packets are not already marked). This would 752 normally be used in conjunction with the SECMARK target. 753 754 To compile it as a module, choose M here. If unsure, say N. 755 756config NETFILTER_XT_TARGET_CT 757 tristate '"CT" target support' 758 depends on NF_CONNTRACK 759 depends on IP_NF_RAW || IP6_NF_RAW 760 depends on NETFILTER_ADVANCED 761 help 762 This options adds a `CT' target, which allows to specify initial 763 connection tracking parameters like events to be delivered and 764 the helper to be used. 765 766 To compile it as a module, choose M here. If unsure, say N. 767 768config NETFILTER_XT_TARGET_DSCP 769 tristate '"DSCP" and "TOS" target support' 770 depends on IP_NF_MANGLE || IP6_NF_MANGLE 771 depends on NETFILTER_ADVANCED 772 help 773 This option adds a `DSCP' target, which allows you to manipulate 774 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 775 776 The DSCP field can have any value between 0x0 and 0x3f inclusive. 777 778 It also adds the "TOS" target, which allows you to create rules in 779 the "mangle" table which alter the Type Of Service field of an IPv4 780 or the Priority field of an IPv6 packet, prior to routing. 781 782 To compile it as a module, choose M here. If unsure, say N. 783 784config NETFILTER_XT_TARGET_HL 785 tristate '"HL" hoplimit target support' 786 depends on IP_NF_MANGLE || IP6_NF_MANGLE 787 depends on NETFILTER_ADVANCED 788 ---help--- 789 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 790 targets, which enable the user to change the 791 hoplimit/time-to-live value of the IP header. 792 793 While it is safe to decrement the hoplimit/TTL value, the 794 modules also allow to increment and set the hoplimit value of 795 the header to arbitrary values. This is EXTREMELY DANGEROUS 796 since you can easily create immortal packets that loop 797 forever on the network. 798 799config NETFILTER_XT_TARGET_HMARK 800 tristate '"HMARK" target support' 801 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 802 depends on NETFILTER_ADVANCED 803 ---help--- 804 This option adds the "HMARK" target. 805 806 The target allows you to create rules in the "raw" and "mangle" tables 807 which set the skbuff mark by means of hash calculation within a given 808 range. The nfmark can influence the routing method and can also be used 809 by other subsystems to change their behaviour. 810 811 To compile it as a module, choose M here. If unsure, say N. 812 813config NETFILTER_XT_TARGET_IDLETIMER 814 tristate "IDLETIMER target support" 815 depends on NETFILTER_ADVANCED 816 help 817 818 This option adds the `IDLETIMER' target. Each matching packet 819 resets the timer associated with label specified when the rule is 820 added. When the timer expires, it triggers a sysfs notification. 821 The remaining time for expiration can be read via sysfs. 822 823 To compile it as a module, choose M here. If unsure, say N. 824 825config NETFILTER_XT_TARGET_LED 826 tristate '"LED" target support' 827 depends on LEDS_CLASS && LEDS_TRIGGERS 828 depends on NETFILTER_ADVANCED 829 help 830 This option adds a `LED' target, which allows you to blink LEDs in 831 response to particular packets passing through your machine. 832 833 This can be used to turn a spare LED into a network activity LED, 834 which only flashes in response to FTP transfers, for example. Or 835 you could have an LED which lights up for a minute or two every time 836 somebody connects to your machine via SSH. 837 838 You will need support for the "led" class to make this work. 839 840 To create an LED trigger for incoming SSH traffic: 841 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 842 843 Then attach the new trigger to an LED on your system: 844 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 845 846 For more information on the LEDs available on your system, see 847 Documentation/leds/leds-class.txt 848 849config NETFILTER_XT_TARGET_LOG 850 tristate "LOG target support" 851 select NF_LOG_COMMON 852 select NF_LOG_IPV4 853 select NF_LOG_IPV6 if IPV6 854 default m if NETFILTER_ADVANCED=n 855 help 856 This option adds a `LOG' target, which allows you to create rules in 857 any iptables table which records the packet header to the syslog. 858 859 To compile it as a module, choose M here. If unsure, say N. 860 861config NETFILTER_XT_TARGET_MARK 862 tristate '"MARK" target support' 863 depends on NETFILTER_ADVANCED 864 select NETFILTER_XT_MARK 865 ---help--- 866 This is a backwards-compat option for the user's convenience 867 (e.g. when running oldconfig). It selects 868 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 869 870config NETFILTER_XT_NAT 871 tristate '"SNAT and DNAT" targets support' 872 depends on NF_NAT 873 ---help--- 874 This option enables the SNAT and DNAT targets. 875 876 To compile it as a module, choose M here. If unsure, say N. 877 878config NETFILTER_XT_TARGET_NETMAP 879 tristate '"NETMAP" target support' 880 depends on NF_NAT 881 ---help--- 882 NETMAP is an implementation of static 1:1 NAT mapping of network 883 addresses. It maps the network address part, while keeping the host 884 address part intact. 885 886 To compile it as a module, choose M here. If unsure, say N. 887 888config NETFILTER_XT_TARGET_NFLOG 889 tristate '"NFLOG" target support' 890 default m if NETFILTER_ADVANCED=n 891 select NETFILTER_NETLINK_LOG 892 help 893 This option enables the NFLOG target, which allows to LOG 894 messages through nfnetlink_log. 895 896 To compile it as a module, choose M here. If unsure, say N. 897 898config NETFILTER_XT_TARGET_NFQUEUE 899 tristate '"NFQUEUE" target Support' 900 depends on NETFILTER_ADVANCED 901 select NETFILTER_NETLINK_QUEUE 902 help 903 This target replaced the old obsolete QUEUE target. 904 905 As opposed to QUEUE, it supports 65535 different queues, 906 not just one. 907 908 To compile it as a module, choose M here. If unsure, say N. 909 910config NETFILTER_XT_TARGET_NOTRACK 911 tristate '"NOTRACK" target support (DEPRECATED)' 912 depends on NF_CONNTRACK 913 depends on IP_NF_RAW || IP6_NF_RAW 914 depends on NETFILTER_ADVANCED 915 select NETFILTER_XT_TARGET_CT 916 917config NETFILTER_XT_TARGET_RATEEST 918 tristate '"RATEEST" target support' 919 depends on NETFILTER_ADVANCED 920 help 921 This option adds a `RATEEST' target, which allows to measure 922 rates similar to TC estimators. The `rateest' match can be 923 used to match on the measured rates. 924 925 To compile it as a module, choose M here. If unsure, say N. 926 927config NETFILTER_XT_TARGET_REDIRECT 928 tristate "REDIRECT target support" 929 depends on NF_NAT 930 select NF_NAT_REDIRECT 931 ---help--- 932 REDIRECT is a special case of NAT: all incoming connections are 933 mapped onto the incoming interface's address, causing the packets to 934 come to the local machine instead of passing through. This is 935 useful for transparent proxies. 936 937 To compile it as a module, choose M here. If unsure, say N. 938 939config NETFILTER_XT_TARGET_TEE 940 tristate '"TEE" - packet cloning to alternate destination' 941 depends on NETFILTER_ADVANCED 942 depends on IPV6 || IPV6=n 943 depends on !NF_CONNTRACK || NF_CONNTRACK 944 select NF_DUP_IPV4 945 select NF_DUP_IPV6 if IPV6 946 ---help--- 947 This option adds a "TEE" target with which a packet can be cloned and 948 this clone be rerouted to another nexthop. 949 950config NETFILTER_XT_TARGET_TPROXY 951 tristate '"TPROXY" target transparent proxying support' 952 depends on NETFILTER_XTABLES 953 depends on NETFILTER_ADVANCED 954 depends on IPV6 || IPV6=n 955 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 956 depends on IP_NF_MANGLE 957 select NF_DEFRAG_IPV4 958 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 959 help 960 This option adds a `TPROXY' target, which is somewhat similar to 961 REDIRECT. It can only be used in the mangle table and is useful 962 to redirect traffic to a transparent proxy. It does _not_ depend 963 on Netfilter connection tracking and NAT, unlike REDIRECT. 964 For it to work you will have to configure certain iptables rules 965 and use policy routing. For more information on how to set it up 966 see Documentation/networking/tproxy.txt. 967 968 To compile it as a module, choose M here. If unsure, say N. 969 970config NETFILTER_XT_TARGET_TRACE 971 tristate '"TRACE" target support' 972 depends on IP_NF_RAW || IP6_NF_RAW 973 depends on NETFILTER_ADVANCED 974 help 975 The TRACE target allows you to mark packets so that the kernel 976 will log every rule which match the packets as those traverse 977 the tables, chains, rules. 978 979 If you want to compile it as a module, say M here and read 980 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 981 982config NETFILTER_XT_TARGET_SECMARK 983 tristate '"SECMARK" target support' 984 depends on NETWORK_SECMARK 985 default m if NETFILTER_ADVANCED=n 986 help 987 The SECMARK target allows security marking of network 988 packets, for use with security subsystems. 989 990 To compile it as a module, choose M here. If unsure, say N. 991 992config NETFILTER_XT_TARGET_TCPMSS 993 tristate '"TCPMSS" target support' 994 depends on IPV6 || IPV6=n 995 default m if NETFILTER_ADVANCED=n 996 ---help--- 997 This option adds a `TCPMSS' target, which allows you to alter the 998 MSS value of TCP SYN packets, to control the maximum size for that 999 connection (usually limiting it to your outgoing interface's MTU 1000 minus 40). 1001 1002 This is used to overcome criminally braindead ISPs or servers which 1003 block ICMP Fragmentation Needed packets. The symptoms of this 1004 problem are that everything works fine from your Linux 1005 firewall/router, but machines behind it can never exchange large 1006 packets: 1007 1) Web browsers connect, then hang with no data received. 1008 2) Small mail works fine, but large emails hang. 1009 3) ssh works fine, but scp hangs after initial handshaking. 1010 1011 Workaround: activate this option and add a rule to your firewall 1012 configuration like: 1013 1014 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1015 -j TCPMSS --clamp-mss-to-pmtu 1016 1017 To compile it as a module, choose M here. If unsure, say N. 1018 1019config NETFILTER_XT_TARGET_TCPOPTSTRIP 1020 tristate '"TCPOPTSTRIP" target support' 1021 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1022 depends on NETFILTER_ADVANCED 1023 help 1024 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1025 TCP options from TCP packets. 1026 1027# alphabetically ordered list of matches 1028 1029comment "Xtables matches" 1030 1031config NETFILTER_XT_MATCH_ADDRTYPE 1032 tristate '"addrtype" address type match support' 1033 default m if NETFILTER_ADVANCED=n 1034 ---help--- 1035 This option allows you to match what routing thinks of an address, 1036 eg. UNICAST, LOCAL, BROADCAST, ... 1037 1038 If you want to compile it as a module, say M here and read 1039 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1040 1041config NETFILTER_XT_MATCH_BPF 1042 tristate '"bpf" match support' 1043 depends on NETFILTER_ADVANCED 1044 help 1045 BPF matching applies a linux socket filter to each packet and 1046 accepts those for which the filter returns non-zero. 1047 1048 To compile it as a module, choose M here. If unsure, say N. 1049 1050config NETFILTER_XT_MATCH_CGROUP 1051 tristate '"control group" match support' 1052 depends on NETFILTER_ADVANCED 1053 depends on CGROUPS 1054 select CGROUP_NET_CLASSID 1055 ---help--- 1056 Socket/process control group matching allows you to match locally 1057 generated packets based on which net_cls control group processes 1058 belong to. 1059 1060config NETFILTER_XT_MATCH_CLUSTER 1061 tristate '"cluster" match support' 1062 depends on NF_CONNTRACK 1063 depends on NETFILTER_ADVANCED 1064 ---help--- 1065 This option allows you to build work-load-sharing clusters of 1066 network servers/stateful firewalls without having a dedicated 1067 load-balancing router/server/switch. Basically, this match returns 1068 true when the packet must be handled by this cluster node. Thus, 1069 all nodes see all packets and this match decides which node handles 1070 what packets. The work-load sharing algorithm is based on source 1071 address hashing. 1072 1073 If you say Y or M here, try `iptables -m cluster --help` for 1074 more information. 1075 1076config NETFILTER_XT_MATCH_COMMENT 1077 tristate '"comment" match support' 1078 depends on NETFILTER_ADVANCED 1079 help 1080 This option adds a `comment' dummy-match, which allows you to put 1081 comments in your iptables ruleset. 1082 1083 If you want to compile it as a module, say M here and read 1084 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1085 1086config NETFILTER_XT_MATCH_CONNBYTES 1087 tristate '"connbytes" per-connection counter match support' 1088 depends on NF_CONNTRACK 1089 depends on NETFILTER_ADVANCED 1090 help 1091 This option adds a `connbytes' match, which allows you to match the 1092 number of bytes and/or packets for each direction within a connection. 1093 1094 If you want to compile it as a module, say M here and read 1095 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1096 1097config NETFILTER_XT_MATCH_CONNLABEL 1098 tristate '"connlabel" match support' 1099 select NF_CONNTRACK_LABELS 1100 depends on NF_CONNTRACK 1101 depends on NETFILTER_ADVANCED 1102 ---help--- 1103 This match allows you to test and assign userspace-defined labels names 1104 to a connection. The kernel only stores bit values - mapping 1105 names to bits is done by userspace. 1106 1107 Unlike connmark, more than 32 flag bits may be assigned to a 1108 connection simultaneously. 1109 1110config NETFILTER_XT_MATCH_CONNLIMIT 1111 tristate '"connlimit" match support' 1112 depends on NF_CONNTRACK 1113 depends on NETFILTER_ADVANCED 1114 ---help--- 1115 This match allows you to match against the number of parallel 1116 connections to a server per client IP address (or address block). 1117 1118config NETFILTER_XT_MATCH_CONNMARK 1119 tristate '"connmark" connection mark match support' 1120 depends on NF_CONNTRACK 1121 depends on NETFILTER_ADVANCED 1122 select NETFILTER_XT_CONNMARK 1123 ---help--- 1124 This is a backwards-compat option for the user's convenience 1125 (e.g. when running oldconfig). It selects 1126 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1127 1128config NETFILTER_XT_MATCH_CONNTRACK 1129 tristate '"conntrack" connection tracking match support' 1130 depends on NF_CONNTRACK 1131 default m if NETFILTER_ADVANCED=n 1132 help 1133 This is a general conntrack match module, a superset of the state match. 1134 1135 It allows matching on additional conntrack information, which is 1136 useful in complex configurations, such as NAT gateways with multiple 1137 internet links or tunnels. 1138 1139 To compile it as a module, choose M here. If unsure, say N. 1140 1141config NETFILTER_XT_MATCH_CPU 1142 tristate '"cpu" match support' 1143 depends on NETFILTER_ADVANCED 1144 help 1145 CPU matching allows you to match packets based on the CPU 1146 currently handling the packet. 1147 1148 To compile it as a module, choose M here. If unsure, say N. 1149 1150config NETFILTER_XT_MATCH_DCCP 1151 tristate '"dccp" protocol match support' 1152 depends on NETFILTER_ADVANCED 1153 default IP_DCCP 1154 help 1155 With this option enabled, you will be able to use the iptables 1156 `dccp' match in order to match on DCCP source/destination ports 1157 and DCCP flags. 1158 1159 If you want to compile it as a module, say M here and read 1160 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1161 1162config NETFILTER_XT_MATCH_DEVGROUP 1163 tristate '"devgroup" match support' 1164 depends on NETFILTER_ADVANCED 1165 help 1166 This options adds a `devgroup' match, which allows to match on the 1167 device group a network device is assigned to. 1168 1169 To compile it as a module, choose M here. If unsure, say N. 1170 1171config NETFILTER_XT_MATCH_DSCP 1172 tristate '"dscp" and "tos" match support' 1173 depends on NETFILTER_ADVANCED 1174 help 1175 This option adds a `DSCP' match, which allows you to match against 1176 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1177 1178 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1179 1180 It will also add a "tos" match, which allows you to match packets 1181 based on the Type Of Service fields of the IPv4 packet (which share 1182 the same bits as DSCP). 1183 1184 To compile it as a module, choose M here. If unsure, say N. 1185 1186config NETFILTER_XT_MATCH_ECN 1187 tristate '"ecn" match support' 1188 depends on NETFILTER_ADVANCED 1189 ---help--- 1190 This option adds an "ECN" match, which allows you to match against 1191 the IPv4 and TCP header ECN fields. 1192 1193 To compile it as a module, choose M here. If unsure, say N. 1194 1195config NETFILTER_XT_MATCH_ESP 1196 tristate '"esp" match support' 1197 depends on NETFILTER_ADVANCED 1198 help 1199 This match extension allows you to match a range of SPIs 1200 inside ESP header of IPSec packets. 1201 1202 To compile it as a module, choose M here. If unsure, say N. 1203 1204config NETFILTER_XT_MATCH_HASHLIMIT 1205 tristate '"hashlimit" match support' 1206 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1207 depends on NETFILTER_ADVANCED 1208 help 1209 This option adds a `hashlimit' match. 1210 1211 As opposed to `limit', this match dynamically creates a hash table 1212 of limit buckets, based on your selection of source/destination 1213 addresses and/or ports. 1214 1215 It enables you to express policies like `10kpps for any given 1216 destination address' or `500pps from any given source address' 1217 with a single rule. 1218 1219config NETFILTER_XT_MATCH_HELPER 1220 tristate '"helper" match support' 1221 depends on NF_CONNTRACK 1222 depends on NETFILTER_ADVANCED 1223 help 1224 Helper matching allows you to match packets in dynamic connections 1225 tracked by a conntrack-helper, ie. ip_conntrack_ftp 1226 1227 To compile it as a module, choose M here. If unsure, say Y. 1228 1229config NETFILTER_XT_MATCH_HL 1230 tristate '"hl" hoplimit/TTL match support' 1231 depends on NETFILTER_ADVANCED 1232 ---help--- 1233 HL matching allows you to match packets based on the hoplimit 1234 in the IPv6 header, or the time-to-live field in the IPv4 1235 header of the packet. 1236 1237config NETFILTER_XT_MATCH_IPCOMP 1238 tristate '"ipcomp" match support' 1239 depends on NETFILTER_ADVANCED 1240 help 1241 This match extension allows you to match a range of CPIs(16 bits) 1242 inside IPComp header of IPSec packets. 1243 1244 To compile it as a module, choose M here. If unsure, say N. 1245 1246config NETFILTER_XT_MATCH_IPRANGE 1247 tristate '"iprange" address range match support' 1248 depends on NETFILTER_ADVANCED 1249 ---help--- 1250 This option adds a "iprange" match, which allows you to match based on 1251 an IP address range. (Normal iptables only matches on single addresses 1252 with an optional mask.) 1253 1254 If unsure, say M. 1255 1256config NETFILTER_XT_MATCH_IPVS 1257 tristate '"ipvs" match support' 1258 depends on IP_VS 1259 depends on NETFILTER_ADVANCED 1260 depends on NF_CONNTRACK 1261 help 1262 This option allows you to match against IPVS properties of a packet. 1263 1264 If unsure, say N. 1265 1266config NETFILTER_XT_MATCH_L2TP 1267 tristate '"l2tp" match support' 1268 depends on NETFILTER_ADVANCED 1269 default L2TP 1270 ---help--- 1271 This option adds an "L2TP" match, which allows you to match against 1272 L2TP protocol header fields. 1273 1274 To compile it as a module, choose M here. If unsure, say N. 1275 1276config NETFILTER_XT_MATCH_LENGTH 1277 tristate '"length" match support' 1278 depends on NETFILTER_ADVANCED 1279 help 1280 This option allows you to match the length of a packet against a 1281 specific value or range of values. 1282 1283 To compile it as a module, choose M here. If unsure, say N. 1284 1285config NETFILTER_XT_MATCH_LIMIT 1286 tristate '"limit" match support' 1287 depends on NETFILTER_ADVANCED 1288 help 1289 limit matching allows you to control the rate at which a rule can be 1290 matched: mainly useful in combination with the LOG target ("LOG 1291 target support", below) and to avoid some Denial of Service attacks. 1292 1293 To compile it as a module, choose M here. If unsure, say N. 1294 1295config NETFILTER_XT_MATCH_MAC 1296 tristate '"mac" address match support' 1297 depends on NETFILTER_ADVANCED 1298 help 1299 MAC matching allows you to match packets based on the source 1300 Ethernet address of the packet. 1301 1302 To compile it as a module, choose M here. If unsure, say N. 1303 1304config NETFILTER_XT_MATCH_MARK 1305 tristate '"mark" match support' 1306 depends on NETFILTER_ADVANCED 1307 select NETFILTER_XT_MARK 1308 ---help--- 1309 This is a backwards-compat option for the user's convenience 1310 (e.g. when running oldconfig). It selects 1311 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1312 1313config NETFILTER_XT_MATCH_MULTIPORT 1314 tristate '"multiport" Multiple port match support' 1315 depends on NETFILTER_ADVANCED 1316 help 1317 Multiport matching allows you to match TCP or UDP packets based on 1318 a series of source or destination ports: normally a rule can only 1319 match a single range of ports. 1320 1321 To compile it as a module, choose M here. If unsure, say N. 1322 1323config NETFILTER_XT_MATCH_NFACCT 1324 tristate '"nfacct" match support' 1325 depends on NETFILTER_ADVANCED 1326 select NETFILTER_NETLINK_ACCT 1327 help 1328 This option allows you to use the extended accounting through 1329 nfnetlink_acct. 1330 1331 To compile it as a module, choose M here. If unsure, say N. 1332 1333config NETFILTER_XT_MATCH_OSF 1334 tristate '"osf" Passive OS fingerprint match' 1335 depends on NETFILTER_ADVANCED && NETFILTER_NETLINK 1336 help 1337 This option selects the Passive OS Fingerprinting match module 1338 that allows to passively match the remote operating system by 1339 analyzing incoming TCP SYN packets. 1340 1341 Rules and loading software can be downloaded from 1342 http://www.ioremap.net/projects/osf 1343 1344 To compile it as a module, choose M here. If unsure, say N. 1345 1346config NETFILTER_XT_MATCH_OWNER 1347 tristate '"owner" match support' 1348 depends on NETFILTER_ADVANCED 1349 ---help--- 1350 Socket owner matching allows you to match locally-generated packets 1351 based on who created the socket: the user or group. It is also 1352 possible to check whether a socket actually exists. 1353 1354config NETFILTER_XT_MATCH_POLICY 1355 tristate 'IPsec "policy" match support' 1356 depends on XFRM 1357 default m if NETFILTER_ADVANCED=n 1358 help 1359 Policy matching allows you to match packets based on the 1360 IPsec policy that was used during decapsulation/will 1361 be used during encapsulation. 1362 1363 To compile it as a module, choose M here. If unsure, say N. 1364 1365config NETFILTER_XT_MATCH_PHYSDEV 1366 tristate '"physdev" match support' 1367 depends on BRIDGE && BRIDGE_NETFILTER 1368 depends on NETFILTER_ADVANCED 1369 help 1370 Physdev packet matching matches against the physical bridge ports 1371 the IP packet arrived on or will leave by. 1372 1373 To compile it as a module, choose M here. If unsure, say N. 1374 1375config NETFILTER_XT_MATCH_PKTTYPE 1376 tristate '"pkttype" packet type match support' 1377 depends on NETFILTER_ADVANCED 1378 help 1379 Packet type matching allows you to match a packet by 1380 its "class", eg. BROADCAST, MULTICAST, ... 1381 1382 Typical usage: 1383 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1384 1385 To compile it as a module, choose M here. If unsure, say N. 1386 1387config NETFILTER_XT_MATCH_QUOTA 1388 tristate '"quota" match support' 1389 depends on NETFILTER_ADVANCED 1390 help 1391 This option adds a `quota' match, which allows to match on a 1392 byte counter. 1393 1394 If you want to compile it as a module, say M here and read 1395 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1396 1397config NETFILTER_XT_MATCH_RATEEST 1398 tristate '"rateest" match support' 1399 depends on NETFILTER_ADVANCED 1400 select NETFILTER_XT_TARGET_RATEEST 1401 help 1402 This option adds a `rateest' match, which allows to match on the 1403 rate estimated by the RATEEST target. 1404 1405 To compile it as a module, choose M here. If unsure, say N. 1406 1407config NETFILTER_XT_MATCH_REALM 1408 tristate '"realm" match support' 1409 depends on NETFILTER_ADVANCED 1410 select IP_ROUTE_CLASSID 1411 help 1412 This option adds a `realm' match, which allows you to use the realm 1413 key from the routing subsystem inside iptables. 1414 1415 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1416 in tc world. 1417 1418 If you want to compile it as a module, say M here and read 1419 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1420 1421config NETFILTER_XT_MATCH_RECENT 1422 tristate '"recent" match support' 1423 depends on NETFILTER_ADVANCED 1424 ---help--- 1425 This match is used for creating one or many lists of recently 1426 used addresses and then matching against that/those list(s). 1427 1428 Short options are available by using 'iptables -m recent -h' 1429 Official Website: <http://snowman.net/projects/ipt_recent/> 1430 1431config NETFILTER_XT_MATCH_SCTP 1432 tristate '"sctp" protocol match support' 1433 depends on NETFILTER_ADVANCED 1434 default IP_SCTP 1435 help 1436 With this option enabled, you will be able to use the 1437 `sctp' match in order to match on SCTP source/destination ports 1438 and SCTP chunk types. 1439 1440 If you want to compile it as a module, say M here and read 1441 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1442 1443config NETFILTER_XT_MATCH_SOCKET 1444 tristate '"socket" match support' 1445 depends on NETFILTER_XTABLES 1446 depends on NETFILTER_ADVANCED 1447 depends on IPV6 || IPV6=n 1448 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1449 depends on NF_SOCKET_IPV4 1450 depends on NF_SOCKET_IPV6 1451 select NF_DEFRAG_IPV4 1452 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1453 help 1454 This option adds a `socket' match, which can be used to match 1455 packets for which a TCP or UDP socket lookup finds a valid socket. 1456 It can be used in combination with the MARK target and policy 1457 routing to implement full featured non-locally bound sockets. 1458 1459 To compile it as a module, choose M here. If unsure, say N. 1460 1461config NETFILTER_XT_MATCH_STATE 1462 tristate '"state" match support' 1463 depends on NF_CONNTRACK 1464 default m if NETFILTER_ADVANCED=n 1465 help 1466 Connection state matching allows you to match packets based on their 1467 relationship to a tracked connection (ie. previous packets). This 1468 is a powerful tool for packet classification. 1469 1470 To compile it as a module, choose M here. If unsure, say N. 1471 1472config NETFILTER_XT_MATCH_STATISTIC 1473 tristate '"statistic" match support' 1474 depends on NETFILTER_ADVANCED 1475 help 1476 This option adds a `statistic' match, which allows you to match 1477 on packets periodically or randomly with a given percentage. 1478 1479 To compile it as a module, choose M here. If unsure, say N. 1480 1481config NETFILTER_XT_MATCH_STRING 1482 tristate '"string" match support' 1483 depends on NETFILTER_ADVANCED 1484 select TEXTSEARCH 1485 select TEXTSEARCH_KMP 1486 select TEXTSEARCH_BM 1487 select TEXTSEARCH_FSM 1488 help 1489 This option adds a `string' match, which allows you to look for 1490 pattern matchings in packets. 1491 1492 To compile it as a module, choose M here. If unsure, say N. 1493 1494config NETFILTER_XT_MATCH_TCPMSS 1495 tristate '"tcpmss" match support' 1496 depends on NETFILTER_ADVANCED 1497 help 1498 This option adds a `tcpmss' match, which allows you to examine the 1499 MSS value of TCP SYN packets, which control the maximum packet size 1500 for that connection. 1501 1502 To compile it as a module, choose M here. If unsure, say N. 1503 1504config NETFILTER_XT_MATCH_TIME 1505 tristate '"time" match support' 1506 depends on NETFILTER_ADVANCED 1507 ---help--- 1508 This option adds a "time" match, which allows you to match based on 1509 the packet arrival time (at the machine which netfilter is running) 1510 on) or departure time/date (for locally generated packets). 1511 1512 If you say Y here, try `iptables -m time --help` for 1513 more information. 1514 1515 If you want to compile it as a module, say M here. 1516 If unsure, say N. 1517 1518config NETFILTER_XT_MATCH_U32 1519 tristate '"u32" match support' 1520 depends on NETFILTER_ADVANCED 1521 ---help--- 1522 u32 allows you to extract quantities of up to 4 bytes from a packet, 1523 AND them with specified masks, shift them by specified amounts and 1524 test whether the results are in any of a set of specified ranges. 1525 The specification of what to extract is general enough to skip over 1526 headers with lengths stored in the packet, as in IP or TCP header 1527 lengths. 1528 1529 Details and examples are in the kernel module source. 1530 1531endif # NETFILTER_XTABLES 1532 1533endmenu 1534 1535source "net/netfilter/ipset/Kconfig" 1536 1537source "net/netfilter/ipvs/Kconfig" 1538