1# SPDX-License-Identifier: GPL-2.0-only 2menu "Core Netfilter Configuration" 3 depends on INET && NETFILTER 4 5config NETFILTER_INGRESS 6 bool "Netfilter ingress support" 7 default y 8 select NET_INGRESS 9 help 10 This allows you to classify packets from ingress using the Netfilter 11 infrastructure. 12 13config NETFILTER_EGRESS 14 bool "Netfilter egress support" 15 default y 16 select NET_EGRESS 17 help 18 This allows you to classify packets before transmission using the 19 Netfilter infrastructure. 20 21config NETFILTER_SKIP_EGRESS 22 def_bool NETFILTER_EGRESS && (NET_CLS_ACT || IFB) 23 24config NETFILTER_NETLINK 25 tristate 26 27config NETFILTER_FAMILY_BRIDGE 28 bool 29 30config NETFILTER_FAMILY_ARP 31 bool 32 33config NETFILTER_NETLINK_HOOK 34 tristate "Netfilter base hook dump support" 35 depends on NETFILTER_ADVANCED 36 depends on NF_TABLES 37 select NETFILTER_NETLINK 38 help 39 If this option is enabled, the kernel will include support 40 to list the base netfilter hooks via NFNETLINK. 41 This is helpful for debugging. 42 43config NETFILTER_NETLINK_ACCT 44 tristate "Netfilter NFACCT over NFNETLINK interface" 45 depends on NETFILTER_ADVANCED 46 select NETFILTER_NETLINK 47 help 48 If this option is enabled, the kernel will include support 49 for extended accounting via NFNETLINK. 50 51config NETFILTER_NETLINK_QUEUE 52 tristate "Netfilter NFQUEUE over NFNETLINK interface" 53 depends on NETFILTER_ADVANCED 54 select NETFILTER_NETLINK 55 help 56 If this option is enabled, the kernel will include support 57 for queueing packets via NFNETLINK. 58 59config NETFILTER_NETLINK_LOG 60 tristate "Netfilter LOG over NFNETLINK interface" 61 default m if NETFILTER_ADVANCED=n 62 select NETFILTER_NETLINK 63 help 64 If this option is enabled, the kernel will include support 65 for logging packets via NFNETLINK. 66 67 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 68 and is also scheduled to replace the old syslog-based ipt_LOG 69 and ip6t_LOG modules. 70 71config NETFILTER_NETLINK_OSF 72 tristate "Netfilter OSF over NFNETLINK interface" 73 depends on NETFILTER_ADVANCED 74 select NETFILTER_NETLINK 75 help 76 If this option is enabled, the kernel will include support 77 for passive OS fingerprint via NFNETLINK. 78 79config NF_CONNTRACK 80 tristate "Netfilter connection tracking support" 81 default m if NETFILTER_ADVANCED=n 82 select NF_DEFRAG_IPV4 83 select NF_DEFRAG_IPV6 if IPV6 != n 84 help 85 Connection tracking keeps a record of what packets have passed 86 through your machine, in order to figure out how they are related 87 into connections. 88 89 This is required to do Masquerading or other kinds of Network 90 Address Translation. It can also be used to enhance packet 91 filtering (see `Connection state match support' below). 92 93 To compile it as a module, choose M here. If unsure, say N. 94 95config NF_LOG_SYSLOG 96 tristate "Syslog packet logging" 97 default m if NETFILTER_ADVANCED=n 98 help 99 This option enable support for packet logging via syslog. 100 It supports IPv4, IPV6, ARP and common transport protocols such 101 as TCP and UDP. 102 This is a simpler but less flexible logging method compared to 103 CONFIG_NETFILTER_NETLINK_LOG. 104 If both are enabled the backend to use can be configured at run-time 105 by means of per-address-family sysctl tunables. 106 107if NF_CONNTRACK 108config NETFILTER_CONNCOUNT 109 tristate 110 111config NF_CONNTRACK_MARK 112 bool 'Connection mark tracking support' 113 depends on NETFILTER_ADVANCED 114 help 115 This option enables support for connection marks, used by the 116 `CONNMARK' target and `connmark' match. Similar to the mark value 117 of packets, but this mark value is kept in the conntrack session 118 instead of the individual packets. 119 120config NF_CONNTRACK_SECMARK 121 bool 'Connection tracking security mark support' 122 depends on NETWORK_SECMARK 123 default y if NETFILTER_ADVANCED=n 124 help 125 This option enables security markings to be applied to 126 connections. Typically they are copied to connections from 127 packets using the CONNSECMARK target and copied back from 128 connections to packets with the same target, with the packets 129 being originally labeled via SECMARK. 130 131 If unsure, say 'N'. 132 133config NF_CONNTRACK_ZONES 134 bool 'Connection tracking zones' 135 depends on NETFILTER_ADVANCED 136 help 137 This option enables support for connection tracking zones. 138 Normally, each connection needs to have a unique system wide 139 identity. Connection tracking zones allow to have multiple 140 connections using the same identity, as long as they are 141 contained in different zones. 142 143 If unsure, say `N'. 144 145config NF_CONNTRACK_PROCFS 146 bool "Supply CT list in procfs (OBSOLETE)" 147 depends on PROC_FS 148 help 149 This option enables for the list of known conntrack entries 150 to be shown in procfs under net/netfilter/nf_conntrack. This 151 is considered obsolete in favor of using the conntrack(8) 152 tool which uses Netlink. 153 154config NF_CONNTRACK_EVENTS 155 bool "Connection tracking events" 156 depends on NETFILTER_ADVANCED 157 help 158 If this option is enabled, the connection tracking code will 159 provide a notifier chain that can be used by other kernel code 160 to get notified about changes in the connection tracking state. 161 162 If unsure, say `N'. 163 164config NF_CONNTRACK_TIMEOUT 165 bool 'Connection tracking timeout' 166 depends on NETFILTER_ADVANCED 167 help 168 This option enables support for connection tracking timeout 169 extension. This allows you to attach timeout policies to flow 170 via the CT target. 171 172 If unsure, say `N'. 173 174config NF_CONNTRACK_TIMESTAMP 175 bool 'Connection tracking timestamping' 176 depends on NETFILTER_ADVANCED 177 help 178 This option enables support for connection tracking timestamping. 179 This allows you to store the flow start-time and to obtain 180 the flow-stop time (once it has been destroyed) via Connection 181 tracking events. 182 183 If unsure, say `N'. 184 185config NF_CONNTRACK_LABELS 186 bool "Connection tracking labels" 187 help 188 This option enables support for assigning user-defined flag bits 189 to connection tracking entries. It can be used with xtables connlabel 190 match and the nftables ct expression. 191 192config NF_CONNTRACK_OVS 193 bool 194 195config NF_CT_PROTO_DCCP 196 bool 'DCCP protocol connection tracking support' 197 depends on NETFILTER_ADVANCED 198 default y 199 help 200 With this option enabled, the layer 3 independent connection 201 tracking code will be able to do state tracking on DCCP connections. 202 203 If unsure, say Y. 204 205config NF_CT_PROTO_GRE 206 bool 207 208config NF_CT_PROTO_SCTP 209 bool 'SCTP protocol connection tracking support' 210 depends on NETFILTER_ADVANCED 211 default y 212 select LIBCRC32C 213 help 214 With this option enabled, the layer 3 independent connection 215 tracking code will be able to do state tracking on SCTP connections. 216 217 If unsure, say Y. 218 219config NF_CT_PROTO_UDPLITE 220 bool 'UDP-Lite protocol connection tracking support' 221 depends on NETFILTER_ADVANCED 222 default y 223 help 224 With this option enabled, the layer 3 independent connection 225 tracking code will be able to do state tracking on UDP-Lite 226 connections. 227 228 If unsure, say Y. 229 230config NF_CONNTRACK_AMANDA 231 tristate "Amanda backup protocol support" 232 depends on NETFILTER_ADVANCED 233 select TEXTSEARCH 234 select TEXTSEARCH_KMP 235 help 236 If you are running the Amanda backup package <http://www.amanda.org/> 237 on this machine or machines that will be MASQUERADED through this 238 machine, then you may want to enable this feature. This allows the 239 connection tracking and natting code to allow the sub-channels that 240 Amanda requires for communication of the backup data, messages and 241 index. 242 243 To compile it as a module, choose M here. If unsure, say N. 244 245config NF_CONNTRACK_FTP 246 tristate "FTP protocol support" 247 default m if NETFILTER_ADVANCED=n 248 help 249 Tracking FTP connections is problematic: special helpers are 250 required for tracking them, and doing masquerading and other forms 251 of Network Address Translation on them. 252 253 This is FTP support on Layer 3 independent connection tracking. 254 255 To compile it as a module, choose M here. If unsure, say N. 256 257config NF_CONNTRACK_H323 258 tristate "H.323 protocol support" 259 depends on IPV6 || IPV6=n 260 depends on NETFILTER_ADVANCED 261 help 262 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 263 important VoIP protocols, it is widely used by voice hardware and 264 software including voice gateways, IP phones, Netmeeting, OpenPhone, 265 Gnomemeeting, etc. 266 267 With this module you can support H.323 on a connection tracking/NAT 268 firewall. 269 270 This module supports RAS, Fast Start, H.245 Tunnelling, Call 271 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 272 whiteboard, file transfer, etc. For more information, please 273 visit http://nath323.sourceforge.net/. 274 275 To compile it as a module, choose M here. If unsure, say N. 276 277config NF_CONNTRACK_IRC 278 tristate "IRC protocol support" 279 default m if NETFILTER_ADVANCED=n 280 help 281 There is a commonly-used extension to IRC called 282 Direct Client-to-Client Protocol (DCC). This enables users to send 283 files to each other, and also chat to each other without the need 284 of a server. DCC Sending is used anywhere you send files over IRC, 285 and DCC Chat is most commonly used by Eggdrop bots. If you are 286 using NAT, this extension will enable you to send files and initiate 287 chats. Note that you do NOT need this extension to get files or 288 have others initiate chats, or everything else in IRC. 289 290 To compile it as a module, choose M here. If unsure, say N. 291 292config NF_CONNTRACK_BROADCAST 293 tristate 294 295config NF_CONNTRACK_NETBIOS_NS 296 tristate "NetBIOS name service protocol support" 297 select NF_CONNTRACK_BROADCAST 298 help 299 NetBIOS name service requests are sent as broadcast messages from an 300 unprivileged port and responded to with unicast messages to the 301 same port. This make them hard to firewall properly because connection 302 tracking doesn't deal with broadcasts. This helper tracks locally 303 originating NetBIOS name service requests and the corresponding 304 responses. It relies on correct IP address configuration, specifically 305 netmask and broadcast address. When properly configured, the output 306 of "ip address show" should look similar to this: 307 308 $ ip -4 address show eth0 309 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 310 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 311 312 To compile it as a module, choose M here. If unsure, say N. 313 314config NF_CONNTRACK_SNMP 315 tristate "SNMP service protocol support" 316 depends on NETFILTER_ADVANCED 317 select NF_CONNTRACK_BROADCAST 318 help 319 SNMP service requests are sent as broadcast messages from an 320 unprivileged port and responded to with unicast messages to the 321 same port. This make them hard to firewall properly because connection 322 tracking doesn't deal with broadcasts. This helper tracks locally 323 originating SNMP service requests and the corresponding 324 responses. It relies on correct IP address configuration, specifically 325 netmask and broadcast address. 326 327 To compile it as a module, choose M here. If unsure, say N. 328 329config NF_CONNTRACK_PPTP 330 tristate "PPtP protocol support" 331 depends on NETFILTER_ADVANCED 332 select NF_CT_PROTO_GRE 333 help 334 This module adds support for PPTP (Point to Point Tunnelling 335 Protocol, RFC2637) connection tracking and NAT. 336 337 If you are running PPTP sessions over a stateful firewall or NAT 338 box, you may want to enable this feature. 339 340 Please note that not all PPTP modes of operation are supported yet. 341 Specifically these limitations exist: 342 - Blindly assumes that control connections are always established 343 in PNS->PAC direction. This is a violation of RFC2637. 344 - Only supports a single call within each session 345 346 To compile it as a module, choose M here. If unsure, say N. 347 348config NF_CONNTRACK_SANE 349 tristate "SANE protocol support" 350 depends on NETFILTER_ADVANCED 351 help 352 SANE is a protocol for remote access to scanners as implemented 353 by the 'saned' daemon. Like FTP, it uses separate control and 354 data connections. 355 356 With this module you can support SANE on a connection tracking 357 firewall. 358 359 To compile it as a module, choose M here. If unsure, say N. 360 361config NF_CONNTRACK_SIP 362 tristate "SIP protocol support" 363 default m if NETFILTER_ADVANCED=n 364 help 365 SIP is an application-layer control protocol that can establish, 366 modify, and terminate multimedia sessions (conferences) such as 367 Internet telephony calls. With the nf_conntrack_sip and 368 the nf_nat_sip modules you can support the protocol on a connection 369 tracking/NATing firewall. 370 371 To compile it as a module, choose M here. If unsure, say N. 372 373config NF_CONNTRACK_TFTP 374 tristate "TFTP protocol support" 375 depends on NETFILTER_ADVANCED 376 help 377 TFTP connection tracking helper, this is required depending 378 on how restrictive your ruleset is. 379 If you are using a tftp client behind -j SNAT or -j MASQUERADING 380 you will need this. 381 382 To compile it as a module, choose M here. If unsure, say N. 383 384config NF_CT_NETLINK 385 tristate 'Connection tracking netlink interface' 386 select NETFILTER_NETLINK 387 default m if NETFILTER_ADVANCED=n 388 help 389 This option enables support for a netlink-based userspace interface 390 391config NF_CT_NETLINK_TIMEOUT 392 tristate 'Connection tracking timeout tuning via Netlink' 393 select NETFILTER_NETLINK 394 depends on NETFILTER_ADVANCED 395 depends on NF_CONNTRACK_TIMEOUT 396 help 397 This option enables support for connection tracking timeout 398 fine-grain tuning. This allows you to attach specific timeout 399 policies to flows, instead of using the global timeout policy. 400 401 If unsure, say `N'. 402 403config NF_CT_NETLINK_HELPER 404 tristate 'Connection tracking helpers in user-space via Netlink' 405 select NETFILTER_NETLINK 406 depends on NF_CT_NETLINK 407 depends on NETFILTER_NETLINK_QUEUE 408 depends on NETFILTER_NETLINK_GLUE_CT 409 depends on NETFILTER_ADVANCED 410 help 411 This option enables the user-space connection tracking helpers 412 infrastructure. 413 414 If unsure, say `N'. 415 416config NETFILTER_NETLINK_GLUE_CT 417 bool "NFQUEUE and NFLOG integration with Connection Tracking" 418 default n 419 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 420 help 421 If this option is enabled, NFQUEUE and NFLOG can include 422 Connection Tracking information together with the packet is 423 the enqueued via NFNETLINK. 424 425config NF_NAT 426 tristate "Network Address Translation support" 427 depends on NF_CONNTRACK 428 default m if NETFILTER_ADVANCED=n 429 help 430 The NAT option allows masquerading, port forwarding and other 431 forms of full Network Address Port Translation. This can be 432 controlled by iptables, ip6tables or nft. 433 434config NF_NAT_AMANDA 435 tristate 436 depends on NF_CONNTRACK && NF_NAT 437 default NF_NAT && NF_CONNTRACK_AMANDA 438 439config NF_NAT_FTP 440 tristate 441 depends on NF_CONNTRACK && NF_NAT 442 default NF_NAT && NF_CONNTRACK_FTP 443 444config NF_NAT_IRC 445 tristate 446 depends on NF_CONNTRACK && NF_NAT 447 default NF_NAT && NF_CONNTRACK_IRC 448 449config NF_NAT_SIP 450 tristate 451 depends on NF_CONNTRACK && NF_NAT 452 default NF_NAT && NF_CONNTRACK_SIP 453 454config NF_NAT_TFTP 455 tristate 456 depends on NF_CONNTRACK && NF_NAT 457 default NF_NAT && NF_CONNTRACK_TFTP 458 459config NF_NAT_REDIRECT 460 bool 461 462config NF_NAT_MASQUERADE 463 bool 464 465config NF_NAT_OVS 466 bool 467 468config NETFILTER_SYNPROXY 469 tristate 470 471endif # NF_CONNTRACK 472 473config NF_TABLES 474 select NETFILTER_NETLINK 475 select LIBCRC32C 476 tristate "Netfilter nf_tables support" 477 help 478 nftables is the new packet classification framework that intends to 479 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 480 provides a pseudo-state machine with an extensible instruction-set 481 (also known as expressions) that the userspace 'nft' utility 482 (https://www.netfilter.org/projects/nftables) uses to build the 483 rule-set. It also comes with the generic set infrastructure that 484 allows you to construct mappings between matchings and actions 485 for performance lookups. 486 487 To compile it as a module, choose M here. 488 489if NF_TABLES 490config NF_TABLES_INET 491 depends on IPV6 492 select NF_TABLES_IPV4 493 select NF_TABLES_IPV6 494 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support" 495 help 496 This option enables support for a mixed IPv4/IPv6 "inet" table. 497 498config NF_TABLES_NETDEV 499 bool "Netfilter nf_tables netdev tables support" 500 help 501 This option enables support for the "netdev" table. 502 503config NFT_NUMGEN 504 tristate "Netfilter nf_tables number generator module" 505 help 506 This option adds the number generator expression used to perform 507 incremental counting and random numbers bound to a upper limit. 508 509config NFT_CT 510 depends on NF_CONNTRACK 511 tristate "Netfilter nf_tables conntrack module" 512 help 513 This option adds the "ct" expression that you can use to match 514 connection tracking information such as the flow state. 515 516config NFT_FLOW_OFFLOAD 517 depends on NF_CONNTRACK && NF_FLOW_TABLE 518 tristate "Netfilter nf_tables hardware flow offload module" 519 help 520 This option adds the "flow_offload" expression that you can use to 521 choose what flows are placed into the hardware. 522 523config NFT_CONNLIMIT 524 tristate "Netfilter nf_tables connlimit module" 525 depends on NF_CONNTRACK 526 depends on NETFILTER_ADVANCED 527 select NETFILTER_CONNCOUNT 528 help 529 This option adds the "connlimit" expression that you can use to 530 ratelimit rule matchings per connections. 531 532config NFT_LOG 533 tristate "Netfilter nf_tables log module" 534 help 535 This option adds the "log" expression that you can use to log 536 packets matching some criteria. 537 538config NFT_LIMIT 539 tristate "Netfilter nf_tables limit module" 540 help 541 This option adds the "limit" expression that you can use to 542 ratelimit rule matchings. 543 544config NFT_MASQ 545 depends on NF_CONNTRACK 546 depends on NF_NAT 547 select NF_NAT_MASQUERADE 548 tristate "Netfilter nf_tables masquerade support" 549 help 550 This option adds the "masquerade" expression that you can use 551 to perform NAT in the masquerade flavour. 552 553config NFT_REDIR 554 depends on NF_CONNTRACK 555 depends on NF_NAT 556 tristate "Netfilter nf_tables redirect support" 557 select NF_NAT_REDIRECT 558 help 559 This options adds the "redirect" expression that you can use 560 to perform NAT in the redirect flavour. 561 562config NFT_NAT 563 depends on NF_CONNTRACK 564 select NF_NAT 565 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6 566 tristate "Netfilter nf_tables nat module" 567 help 568 This option adds the "nat" expression that you can use to perform 569 typical Network Address Translation (NAT) packet transformations. 570 571config NFT_TUNNEL 572 tristate "Netfilter nf_tables tunnel module" 573 help 574 This option adds the "tunnel" expression that you can use to set 575 tunneling policies. 576 577config NFT_QUEUE 578 depends on NETFILTER_NETLINK_QUEUE 579 tristate "Netfilter nf_tables queue module" 580 help 581 This is required if you intend to use the userspace queueing 582 infrastructure (also known as NFQUEUE) from nftables. 583 584config NFT_QUOTA 585 tristate "Netfilter nf_tables quota module" 586 help 587 This option adds the "quota" expression that you can use to match 588 enforce bytes quotas. 589 590config NFT_REJECT 591 default m if NETFILTER_ADVANCED=n 592 tristate "Netfilter nf_tables reject support" 593 depends on !NF_TABLES_INET || (IPV6!=m || m) 594 help 595 This option adds the "reject" expression that you can use to 596 explicitly deny and notify via TCP reset/ICMP informational errors 597 unallowed traffic. 598 599config NFT_REJECT_INET 600 depends on NF_TABLES_INET 601 default NFT_REJECT 602 tristate 603 604config NFT_COMPAT 605 depends on NETFILTER_XTABLES 606 tristate "Netfilter x_tables over nf_tables module" 607 help 608 This is required if you intend to use any of existing 609 x_tables match/target extensions over the nf_tables 610 framework. 611 612config NFT_HASH 613 tristate "Netfilter nf_tables hash module" 614 help 615 This option adds the "hash" expression that you can use to perform 616 a hash operation on registers. 617 618config NFT_FIB 619 tristate 620 621config NFT_FIB_INET 622 depends on NF_TABLES_INET 623 depends on NFT_FIB_IPV4 624 depends on NFT_FIB_IPV6 625 tristate "Netfilter nf_tables fib inet support" 626 help 627 This option allows using the FIB expression from the inet table. 628 The lookup will be delegated to the IPv4 or IPv6 FIB depending 629 on the protocol of the packet. 630 631config NFT_XFRM 632 tristate "Netfilter nf_tables xfrm/IPSec security association matching" 633 depends on XFRM 634 help 635 This option adds an expression that you can use to extract properties 636 of a packets security association. 637 638config NFT_SOCKET 639 tristate "Netfilter nf_tables socket match support" 640 depends on IPV6 || IPV6=n 641 select NF_SOCKET_IPV4 642 select NF_SOCKET_IPV6 if NF_TABLES_IPV6 643 help 644 This option allows matching for the presence or absence of a 645 corresponding socket and its attributes. 646 647config NFT_OSF 648 tristate "Netfilter nf_tables passive OS fingerprint support" 649 depends on NETFILTER_ADVANCED 650 select NETFILTER_NETLINK_OSF 651 help 652 This option allows matching packets from an specific OS. 653 654config NFT_TPROXY 655 tristate "Netfilter nf_tables tproxy support" 656 depends on IPV6 || IPV6=n 657 select NF_DEFRAG_IPV4 658 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6 659 select NF_TPROXY_IPV4 660 select NF_TPROXY_IPV6 if NF_TABLES_IPV6 661 help 662 This makes transparent proxy support available in nftables. 663 664config NFT_SYNPROXY 665 tristate "Netfilter nf_tables SYNPROXY expression support" 666 depends on NF_CONNTRACK && NETFILTER_ADVANCED 667 select NETFILTER_SYNPROXY 668 select SYN_COOKIES 669 help 670 The SYNPROXY expression allows you to intercept TCP connections and 671 establish them using syncookies before they are passed on to the 672 server. This allows to avoid conntrack and server resource usage 673 during SYN-flood attacks. 674 675if NF_TABLES_NETDEV 676 677config NF_DUP_NETDEV 678 tristate "Netfilter packet duplication support" 679 help 680 This option enables the generic packet duplication infrastructure 681 for Netfilter. 682 683config NFT_DUP_NETDEV 684 tristate "Netfilter nf_tables netdev packet duplication support" 685 select NF_DUP_NETDEV 686 help 687 This option enables packet duplication for the "netdev" family. 688 689config NFT_FWD_NETDEV 690 tristate "Netfilter nf_tables netdev packet forwarding support" 691 select NF_DUP_NETDEV 692 help 693 This option enables packet forwarding for the "netdev" family. 694 695config NFT_FIB_NETDEV 696 depends on NFT_FIB_IPV4 697 depends on NFT_FIB_IPV6 698 tristate "Netfilter nf_tables netdev fib lookups support" 699 help 700 This option allows using the FIB expression from the netdev table. 701 The lookup will be delegated to the IPv4 or IPv6 FIB depending 702 on the protocol of the packet. 703 704config NFT_REJECT_NETDEV 705 depends on NFT_REJECT_IPV4 706 depends on NFT_REJECT_IPV6 707 tristate "Netfilter nf_tables netdev REJECT support" 708 help 709 This option enables the REJECT support from the netdev table. 710 The return packet generation will be delegated to the IPv4 711 or IPv6 ICMP or TCP RST implementation depending on the 712 protocol of the packet. 713 714endif # NF_TABLES_NETDEV 715 716endif # NF_TABLES 717 718config NF_FLOW_TABLE_INET 719 tristate "Netfilter flow table mixed IPv4/IPv6 module" 720 depends on NF_FLOW_TABLE 721 help 722 This option adds the flow table mixed IPv4/IPv6 support. 723 724 To compile it as a module, choose M here. 725 726config NF_FLOW_TABLE 727 tristate "Netfilter flow table module" 728 depends on NETFILTER_INGRESS 729 depends on NF_CONNTRACK 730 depends on NF_TABLES 731 help 732 This option adds the flow table core infrastructure. 733 734 To compile it as a module, choose M here. 735 736config NF_FLOW_TABLE_PROCFS 737 bool "Supply flow table statistics in procfs" 738 depends on NF_FLOW_TABLE 739 depends on PROC_FS 740 help 741 This option enables for the flow table offload statistics 742 to be shown in procfs under net/netfilter/nf_flowtable. 743 744config NETFILTER_XTABLES 745 tristate "Netfilter Xtables support (required for ip_tables)" 746 default m if NETFILTER_ADVANCED=n 747 help 748 This is required if you intend to use any of ip_tables, 749 ip6_tables or arp_tables. 750 751if NETFILTER_XTABLES 752 753config NETFILTER_XTABLES_COMPAT 754 bool "Netfilter Xtables 32bit support" 755 depends on COMPAT 756 help 757 This option provides a translation layer to run 32bit arp,ip(6),ebtables 758 binaries on 64bit kernels. 759 760 If unsure, say N. 761 762comment "Xtables combined modules" 763 764config NETFILTER_XT_MARK 765 tristate 'nfmark target and match support' 766 default m if NETFILTER_ADVANCED=n 767 help 768 This option adds the "MARK" target and "mark" match. 769 770 Netfilter mark matching allows you to match packets based on the 771 "nfmark" value in the packet. 772 The target allows you to create rules in the "mangle" table which alter 773 the netfilter mark (nfmark) field associated with the packet. 774 775 Prior to routing, the nfmark can influence the routing method and can 776 also be used by other subsystems to change their behavior. 777 778config NETFILTER_XT_CONNMARK 779 tristate 'ctmark target and match support' 780 depends on NF_CONNTRACK 781 depends on NETFILTER_ADVANCED 782 select NF_CONNTRACK_MARK 783 help 784 This option adds the "CONNMARK" target and "connmark" match. 785 786 Netfilter allows you to store a mark value per connection (a.k.a. 787 ctmark), similarly to the packet mark (nfmark). Using this 788 target and match, you can set and match on this mark. 789 790config NETFILTER_XT_SET 791 tristate 'set target and match support' 792 depends on IP_SET 793 depends on NETFILTER_ADVANCED 794 help 795 This option adds the "SET" target and "set" match. 796 797 Using this target and match, you can add/delete and match 798 elements in the sets created by ipset(8). 799 800 To compile it as a module, choose M here. If unsure, say N. 801 802# alphabetically ordered list of targets 803 804comment "Xtables targets" 805 806config NETFILTER_XT_TARGET_AUDIT 807 tristate "AUDIT target support" 808 depends on AUDIT 809 depends on NETFILTER_ADVANCED 810 help 811 This option adds a 'AUDIT' target, which can be used to create 812 audit records for packets dropped/accepted. 813 814 To compileit as a module, choose M here. If unsure, say N. 815 816config NETFILTER_XT_TARGET_CHECKSUM 817 tristate "CHECKSUM target support" 818 depends on IP_NF_MANGLE || IP6_NF_MANGLE 819 depends on NETFILTER_ADVANCED 820 help 821 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 822 table to work around buggy DHCP clients in virtualized environments. 823 824 Some old DHCP clients drop packets because they are not aware 825 that the checksum would normally be offloaded to hardware and 826 thus should be considered valid. 827 This target can be used to fill in the checksum using iptables 828 when such packets are sent via a virtual network device. 829 830 To compile it as a module, choose M here. If unsure, say N. 831 832config NETFILTER_XT_TARGET_CLASSIFY 833 tristate '"CLASSIFY" target support' 834 depends on NETFILTER_ADVANCED 835 help 836 This option adds a `CLASSIFY' target, which enables the user to set 837 the priority of a packet. Some qdiscs can use this value for 838 classification, among these are: 839 840 atm, cbq, dsmark, pfifo_fast, htb, prio 841 842 To compile it as a module, choose M here. If unsure, say N. 843 844config NETFILTER_XT_TARGET_CONNMARK 845 tristate '"CONNMARK" target support' 846 depends on NF_CONNTRACK 847 depends on NETFILTER_ADVANCED 848 select NETFILTER_XT_CONNMARK 849 help 850 This is a backwards-compat option for the user's convenience 851 (e.g. when running oldconfig). It selects 852 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 853 854config NETFILTER_XT_TARGET_CONNSECMARK 855 tristate '"CONNSECMARK" target support' 856 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 857 default m if NETFILTER_ADVANCED=n 858 help 859 The CONNSECMARK target copies security markings from packets 860 to connections, and restores security markings from connections 861 to packets (if the packets are not already marked). This would 862 normally be used in conjunction with the SECMARK target. 863 864 To compile it as a module, choose M here. If unsure, say N. 865 866config NETFILTER_XT_TARGET_CT 867 tristate '"CT" target support' 868 depends on NF_CONNTRACK 869 depends on IP_NF_RAW || IP6_NF_RAW 870 depends on NETFILTER_ADVANCED 871 help 872 This options adds a `CT' target, which allows to specify initial 873 connection tracking parameters like events to be delivered and 874 the helper to be used. 875 876 To compile it as a module, choose M here. If unsure, say N. 877 878config NETFILTER_XT_TARGET_DSCP 879 tristate '"DSCP" and "TOS" target support' 880 depends on IP_NF_MANGLE || IP6_NF_MANGLE 881 depends on NETFILTER_ADVANCED 882 help 883 This option adds a `DSCP' target, which allows you to manipulate 884 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 885 886 The DSCP field can have any value between 0x0 and 0x3f inclusive. 887 888 It also adds the "TOS" target, which allows you to create rules in 889 the "mangle" table which alter the Type Of Service field of an IPv4 890 or the Priority field of an IPv6 packet, prior to routing. 891 892 To compile it as a module, choose M here. If unsure, say N. 893 894config NETFILTER_XT_TARGET_HL 895 tristate '"HL" hoplimit target support' 896 depends on IP_NF_MANGLE || IP6_NF_MANGLE 897 depends on NETFILTER_ADVANCED 898 help 899 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 900 targets, which enable the user to change the 901 hoplimit/time-to-live value of the IP header. 902 903 While it is safe to decrement the hoplimit/TTL value, the 904 modules also allow to increment and set the hoplimit value of 905 the header to arbitrary values. This is EXTREMELY DANGEROUS 906 since you can easily create immortal packets that loop 907 forever on the network. 908 909config NETFILTER_XT_TARGET_HMARK 910 tristate '"HMARK" target support' 911 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 912 depends on NETFILTER_ADVANCED 913 help 914 This option adds the "HMARK" target. 915 916 The target allows you to create rules in the "raw" and "mangle" tables 917 which set the skbuff mark by means of hash calculation within a given 918 range. The nfmark can influence the routing method and can also be used 919 by other subsystems to change their behaviour. 920 921 To compile it as a module, choose M here. If unsure, say N. 922 923config NETFILTER_XT_TARGET_IDLETIMER 924 tristate "IDLETIMER target support" 925 depends on NETFILTER_ADVANCED 926 help 927 928 This option adds the `IDLETIMER' target. Each matching packet 929 resets the timer associated with label specified when the rule is 930 added. When the timer expires, it triggers a sysfs notification. 931 The remaining time for expiration can be read via sysfs. 932 933 To compile it as a module, choose M here. If unsure, say N. 934 935config NETFILTER_XT_TARGET_LED 936 tristate '"LED" target support' 937 depends on LEDS_CLASS && LEDS_TRIGGERS 938 depends on NETFILTER_ADVANCED 939 help 940 This option adds a `LED' target, which allows you to blink LEDs in 941 response to particular packets passing through your machine. 942 943 This can be used to turn a spare LED into a network activity LED, 944 which only flashes in response to FTP transfers, for example. Or 945 you could have an LED which lights up for a minute or two every time 946 somebody connects to your machine via SSH. 947 948 You will need support for the "led" class to make this work. 949 950 To create an LED trigger for incoming SSH traffic: 951 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 952 953 Then attach the new trigger to an LED on your system: 954 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 955 956 For more information on the LEDs available on your system, see 957 Documentation/leds/leds-class.rst 958 959config NETFILTER_XT_TARGET_LOG 960 tristate "LOG target support" 961 select NF_LOG_SYSLOG 962 select NF_LOG_IPV6 if IP6_NF_IPTABLES 963 default m if NETFILTER_ADVANCED=n 964 help 965 This option adds a `LOG' target, which allows you to create rules in 966 any iptables table which records the packet header to the syslog. 967 968 To compile it as a module, choose M here. If unsure, say N. 969 970config NETFILTER_XT_TARGET_MARK 971 tristate '"MARK" target support' 972 depends on NETFILTER_ADVANCED 973 select NETFILTER_XT_MARK 974 help 975 This is a backwards-compat option for the user's convenience 976 (e.g. when running oldconfig). It selects 977 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 978 979config NETFILTER_XT_NAT 980 tristate '"SNAT and DNAT" targets support' 981 depends on NF_NAT 982 help 983 This option enables the SNAT and DNAT targets. 984 985 To compile it as a module, choose M here. If unsure, say N. 986 987config NETFILTER_XT_TARGET_NETMAP 988 tristate '"NETMAP" target support' 989 depends on NF_NAT 990 help 991 NETMAP is an implementation of static 1:1 NAT mapping of network 992 addresses. It maps the network address part, while keeping the host 993 address part intact. 994 995 To compile it as a module, choose M here. If unsure, say N. 996 997config NETFILTER_XT_TARGET_NFLOG 998 tristate '"NFLOG" target support' 999 default m if NETFILTER_ADVANCED=n 1000 select NETFILTER_NETLINK_LOG 1001 help 1002 This option enables the NFLOG target, which allows to LOG 1003 messages through nfnetlink_log. 1004 1005 To compile it as a module, choose M here. If unsure, say N. 1006 1007config NETFILTER_XT_TARGET_NFQUEUE 1008 tristate '"NFQUEUE" target Support' 1009 depends on NETFILTER_ADVANCED 1010 select NETFILTER_NETLINK_QUEUE 1011 help 1012 This target replaced the old obsolete QUEUE target. 1013 1014 As opposed to QUEUE, it supports 65535 different queues, 1015 not just one. 1016 1017 To compile it as a module, choose M here. If unsure, say N. 1018 1019config NETFILTER_XT_TARGET_NOTRACK 1020 tristate '"NOTRACK" target support (DEPRECATED)' 1021 depends on NF_CONNTRACK 1022 depends on IP_NF_RAW || IP6_NF_RAW 1023 depends on NETFILTER_ADVANCED 1024 select NETFILTER_XT_TARGET_CT 1025 1026config NETFILTER_XT_TARGET_RATEEST 1027 tristate '"RATEEST" target support' 1028 depends on NETFILTER_ADVANCED 1029 help 1030 This option adds a `RATEEST' target, which allows to measure 1031 rates similar to TC estimators. The `rateest' match can be 1032 used to match on the measured rates. 1033 1034 To compile it as a module, choose M here. If unsure, say N. 1035 1036config NETFILTER_XT_TARGET_REDIRECT 1037 tristate "REDIRECT target support" 1038 depends on NF_NAT 1039 select NF_NAT_REDIRECT 1040 help 1041 REDIRECT is a special case of NAT: all incoming connections are 1042 mapped onto the incoming interface's address, causing the packets to 1043 come to the local machine instead of passing through. This is 1044 useful for transparent proxies. 1045 1046 To compile it as a module, choose M here. If unsure, say N. 1047 1048config NETFILTER_XT_TARGET_MASQUERADE 1049 tristate "MASQUERADE target support" 1050 depends on NF_NAT 1051 default m if NETFILTER_ADVANCED=n 1052 select NF_NAT_MASQUERADE 1053 help 1054 Masquerading is a special case of NAT: all outgoing connections are 1055 changed to seem to come from a particular interface's address, and 1056 if the interface goes down, those connections are lost. This is 1057 only useful for dialup accounts with dynamic IP address (ie. your IP 1058 address will be different on next dialup). 1059 1060 To compile it as a module, choose M here. If unsure, say N. 1061 1062config NETFILTER_XT_TARGET_TEE 1063 tristate '"TEE" - packet cloning to alternate destination' 1064 depends on NETFILTER_ADVANCED 1065 depends on IPV6 || IPV6=n 1066 depends on !NF_CONNTRACK || NF_CONNTRACK 1067 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES 1068 select NF_DUP_IPV4 1069 select NF_DUP_IPV6 if IP6_NF_IPTABLES 1070 help 1071 This option adds a "TEE" target with which a packet can be cloned and 1072 this clone be rerouted to another nexthop. 1073 1074config NETFILTER_XT_TARGET_TPROXY 1075 tristate '"TPROXY" target transparent proxying support' 1076 depends on NETFILTER_XTABLES 1077 depends on NETFILTER_ADVANCED 1078 depends on IPV6 || IPV6=n 1079 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1080 depends on IP_NF_MANGLE 1081 select NF_DEFRAG_IPV4 1082 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1083 select NF_TPROXY_IPV4 1084 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES 1085 help 1086 This option adds a `TPROXY' target, which is somewhat similar to 1087 REDIRECT. It can only be used in the mangle table and is useful 1088 to redirect traffic to a transparent proxy. It does _not_ depend 1089 on Netfilter connection tracking and NAT, unlike REDIRECT. 1090 For it to work you will have to configure certain iptables rules 1091 and use policy routing. For more information on how to set it up 1092 see Documentation/networking/tproxy.rst. 1093 1094 To compile it as a module, choose M here. If unsure, say N. 1095 1096config NETFILTER_XT_TARGET_TRACE 1097 tristate '"TRACE" target support' 1098 depends on IP_NF_RAW || IP6_NF_RAW 1099 depends on NETFILTER_ADVANCED 1100 help 1101 The TRACE target allows you to mark packets so that the kernel 1102 will log every rule which match the packets as those traverse 1103 the tables, chains, rules. 1104 1105 If you want to compile it as a module, say M here and read 1106 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1107 1108config NETFILTER_XT_TARGET_SECMARK 1109 tristate '"SECMARK" target support' 1110 depends on NETWORK_SECMARK 1111 default m if NETFILTER_ADVANCED=n 1112 help 1113 The SECMARK target allows security marking of network 1114 packets, for use with security subsystems. 1115 1116 To compile it as a module, choose M here. If unsure, say N. 1117 1118config NETFILTER_XT_TARGET_TCPMSS 1119 tristate '"TCPMSS" target support' 1120 depends on IPV6 || IPV6=n 1121 default m if NETFILTER_ADVANCED=n 1122 help 1123 This option adds a `TCPMSS' target, which allows you to alter the 1124 MSS value of TCP SYN packets, to control the maximum size for that 1125 connection (usually limiting it to your outgoing interface's MTU 1126 minus 40). 1127 1128 This is used to overcome criminally braindead ISPs or servers which 1129 block ICMP Fragmentation Needed packets. The symptoms of this 1130 problem are that everything works fine from your Linux 1131 firewall/router, but machines behind it can never exchange large 1132 packets: 1133 1) Web browsers connect, then hang with no data received. 1134 2) Small mail works fine, but large emails hang. 1135 3) ssh works fine, but scp hangs after initial handshaking. 1136 1137 Workaround: activate this option and add a rule to your firewall 1138 configuration like: 1139 1140 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1141 -j TCPMSS --clamp-mss-to-pmtu 1142 1143 To compile it as a module, choose M here. If unsure, say N. 1144 1145config NETFILTER_XT_TARGET_TCPOPTSTRIP 1146 tristate '"TCPOPTSTRIP" target support' 1147 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1148 depends on NETFILTER_ADVANCED 1149 help 1150 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1151 TCP options from TCP packets. 1152 1153# alphabetically ordered list of matches 1154 1155comment "Xtables matches" 1156 1157config NETFILTER_XT_MATCH_ADDRTYPE 1158 tristate '"addrtype" address type match support' 1159 default m if NETFILTER_ADVANCED=n 1160 help 1161 This option allows you to match what routing thinks of an address, 1162 eg. UNICAST, LOCAL, BROADCAST, ... 1163 1164 If you want to compile it as a module, say M here and read 1165 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1166 1167config NETFILTER_XT_MATCH_BPF 1168 tristate '"bpf" match support' 1169 depends on NETFILTER_ADVANCED 1170 help 1171 BPF matching applies a linux socket filter to each packet and 1172 accepts those for which the filter returns non-zero. 1173 1174 To compile it as a module, choose M here. If unsure, say N. 1175 1176config NETFILTER_XT_MATCH_CGROUP 1177 tristate '"control group" match support' 1178 depends on NETFILTER_ADVANCED 1179 depends on CGROUPS 1180 select CGROUP_NET_CLASSID 1181 help 1182 Socket/process control group matching allows you to match locally 1183 generated packets based on which net_cls control group processes 1184 belong to. 1185 1186config NETFILTER_XT_MATCH_CLUSTER 1187 tristate '"cluster" match support' 1188 depends on NF_CONNTRACK 1189 depends on NETFILTER_ADVANCED 1190 help 1191 This option allows you to build work-load-sharing clusters of 1192 network servers/stateful firewalls without having a dedicated 1193 load-balancing router/server/switch. Basically, this match returns 1194 true when the packet must be handled by this cluster node. Thus, 1195 all nodes see all packets and this match decides which node handles 1196 what packets. The work-load sharing algorithm is based on source 1197 address hashing. 1198 1199 If you say Y or M here, try `iptables -m cluster --help` for 1200 more information. 1201 1202config NETFILTER_XT_MATCH_COMMENT 1203 tristate '"comment" match support' 1204 depends on NETFILTER_ADVANCED 1205 help 1206 This option adds a `comment' dummy-match, which allows you to put 1207 comments in your iptables ruleset. 1208 1209 If you want to compile it as a module, say M here and read 1210 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1211 1212config NETFILTER_XT_MATCH_CONNBYTES 1213 tristate '"connbytes" per-connection counter match support' 1214 depends on NF_CONNTRACK 1215 depends on NETFILTER_ADVANCED 1216 help 1217 This option adds a `connbytes' match, which allows you to match the 1218 number of bytes and/or packets for each direction within a connection. 1219 1220 If you want to compile it as a module, say M here and read 1221 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1222 1223config NETFILTER_XT_MATCH_CONNLABEL 1224 tristate '"connlabel" match support' 1225 select NF_CONNTRACK_LABELS 1226 depends on NF_CONNTRACK 1227 depends on NETFILTER_ADVANCED 1228 help 1229 This match allows you to test and assign userspace-defined labels names 1230 to a connection. The kernel only stores bit values - mapping 1231 names to bits is done by userspace. 1232 1233 Unlike connmark, more than 32 flag bits may be assigned to a 1234 connection simultaneously. 1235 1236config NETFILTER_XT_MATCH_CONNLIMIT 1237 tristate '"connlimit" match support' 1238 depends on NF_CONNTRACK 1239 depends on NETFILTER_ADVANCED 1240 select NETFILTER_CONNCOUNT 1241 help 1242 This match allows you to match against the number of parallel 1243 connections to a server per client IP address (or address block). 1244 1245config NETFILTER_XT_MATCH_CONNMARK 1246 tristate '"connmark" connection mark match support' 1247 depends on NF_CONNTRACK 1248 depends on NETFILTER_ADVANCED 1249 select NETFILTER_XT_CONNMARK 1250 help 1251 This is a backwards-compat option for the user's convenience 1252 (e.g. when running oldconfig). It selects 1253 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1254 1255config NETFILTER_XT_MATCH_CONNTRACK 1256 tristate '"conntrack" connection tracking match support' 1257 depends on NF_CONNTRACK 1258 default m if NETFILTER_ADVANCED=n 1259 help 1260 This is a general conntrack match module, a superset of the state match. 1261 1262 It allows matching on additional conntrack information, which is 1263 useful in complex configurations, such as NAT gateways with multiple 1264 internet links or tunnels. 1265 1266 To compile it as a module, choose M here. If unsure, say N. 1267 1268config NETFILTER_XT_MATCH_CPU 1269 tristate '"cpu" match support' 1270 depends on NETFILTER_ADVANCED 1271 help 1272 CPU matching allows you to match packets based on the CPU 1273 currently handling the packet. 1274 1275 To compile it as a module, choose M here. If unsure, say N. 1276 1277config NETFILTER_XT_MATCH_DCCP 1278 tristate '"dccp" protocol match support' 1279 depends on NETFILTER_ADVANCED 1280 default IP_DCCP 1281 help 1282 With this option enabled, you will be able to use the iptables 1283 `dccp' match in order to match on DCCP source/destination ports 1284 and DCCP flags. 1285 1286 If you want to compile it as a module, say M here and read 1287 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1288 1289config NETFILTER_XT_MATCH_DEVGROUP 1290 tristate '"devgroup" match support' 1291 depends on NETFILTER_ADVANCED 1292 help 1293 This options adds a `devgroup' match, which allows to match on the 1294 device group a network device is assigned to. 1295 1296 To compile it as a module, choose M here. If unsure, say N. 1297 1298config NETFILTER_XT_MATCH_DSCP 1299 tristate '"dscp" and "tos" match support' 1300 depends on NETFILTER_ADVANCED 1301 help 1302 This option adds a `DSCP' match, which allows you to match against 1303 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1304 1305 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1306 1307 It will also add a "tos" match, which allows you to match packets 1308 based on the Type Of Service fields of the IPv4 packet (which share 1309 the same bits as DSCP). 1310 1311 To compile it as a module, choose M here. If unsure, say N. 1312 1313config NETFILTER_XT_MATCH_ECN 1314 tristate '"ecn" match support' 1315 depends on NETFILTER_ADVANCED 1316 help 1317 This option adds an "ECN" match, which allows you to match against 1318 the IPv4 and TCP header ECN fields. 1319 1320 To compile it as a module, choose M here. If unsure, say N. 1321 1322config NETFILTER_XT_MATCH_ESP 1323 tristate '"esp" match support' 1324 depends on NETFILTER_ADVANCED 1325 help 1326 This match extension allows you to match a range of SPIs 1327 inside ESP header of IPSec packets. 1328 1329 To compile it as a module, choose M here. If unsure, say N. 1330 1331config NETFILTER_XT_MATCH_HASHLIMIT 1332 tristate '"hashlimit" match support' 1333 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1334 depends on NETFILTER_ADVANCED 1335 help 1336 This option adds a `hashlimit' match. 1337 1338 As opposed to `limit', this match dynamically creates a hash table 1339 of limit buckets, based on your selection of source/destination 1340 addresses and/or ports. 1341 1342 It enables you to express policies like `10kpps for any given 1343 destination address' or `500pps from any given source address' 1344 with a single rule. 1345 1346config NETFILTER_XT_MATCH_HELPER 1347 tristate '"helper" match support' 1348 depends on NF_CONNTRACK 1349 depends on NETFILTER_ADVANCED 1350 help 1351 Helper matching allows you to match packets in dynamic connections 1352 tracked by a conntrack-helper, ie. nf_conntrack_ftp 1353 1354 To compile it as a module, choose M here. If unsure, say Y. 1355 1356config NETFILTER_XT_MATCH_HL 1357 tristate '"hl" hoplimit/TTL match support' 1358 depends on NETFILTER_ADVANCED 1359 help 1360 HL matching allows you to match packets based on the hoplimit 1361 in the IPv6 header, or the time-to-live field in the IPv4 1362 header of the packet. 1363 1364config NETFILTER_XT_MATCH_IPCOMP 1365 tristate '"ipcomp" match support' 1366 depends on NETFILTER_ADVANCED 1367 help 1368 This match extension allows you to match a range of CPIs(16 bits) 1369 inside IPComp header of IPSec packets. 1370 1371 To compile it as a module, choose M here. If unsure, say N. 1372 1373config NETFILTER_XT_MATCH_IPRANGE 1374 tristate '"iprange" address range match support' 1375 depends on NETFILTER_ADVANCED 1376 help 1377 This option adds a "iprange" match, which allows you to match based on 1378 an IP address range. (Normal iptables only matches on single addresses 1379 with an optional mask.) 1380 1381 If unsure, say M. 1382 1383config NETFILTER_XT_MATCH_IPVS 1384 tristate '"ipvs" match support' 1385 depends on IP_VS 1386 depends on NETFILTER_ADVANCED 1387 depends on NF_CONNTRACK 1388 help 1389 This option allows you to match against IPVS properties of a packet. 1390 1391 If unsure, say N. 1392 1393config NETFILTER_XT_MATCH_L2TP 1394 tristate '"l2tp" match support' 1395 depends on NETFILTER_ADVANCED 1396 default L2TP 1397 help 1398 This option adds an "L2TP" match, which allows you to match against 1399 L2TP protocol header fields. 1400 1401 To compile it as a module, choose M here. If unsure, say N. 1402 1403config NETFILTER_XT_MATCH_LENGTH 1404 tristate '"length" match support' 1405 depends on NETFILTER_ADVANCED 1406 help 1407 This option allows you to match the length of a packet against a 1408 specific value or range of values. 1409 1410 To compile it as a module, choose M here. If unsure, say N. 1411 1412config NETFILTER_XT_MATCH_LIMIT 1413 tristate '"limit" match support' 1414 depends on NETFILTER_ADVANCED 1415 help 1416 limit matching allows you to control the rate at which a rule can be 1417 matched: mainly useful in combination with the LOG target ("LOG 1418 target support", below) and to avoid some Denial of Service attacks. 1419 1420 To compile it as a module, choose M here. If unsure, say N. 1421 1422config NETFILTER_XT_MATCH_MAC 1423 tristate '"mac" address match support' 1424 depends on NETFILTER_ADVANCED 1425 help 1426 MAC matching allows you to match packets based on the source 1427 Ethernet address of the packet. 1428 1429 To compile it as a module, choose M here. If unsure, say N. 1430 1431config NETFILTER_XT_MATCH_MARK 1432 tristate '"mark" match support' 1433 depends on NETFILTER_ADVANCED 1434 select NETFILTER_XT_MARK 1435 help 1436 This is a backwards-compat option for the user's convenience 1437 (e.g. when running oldconfig). It selects 1438 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1439 1440config NETFILTER_XT_MATCH_MULTIPORT 1441 tristate '"multiport" Multiple port match support' 1442 depends on NETFILTER_ADVANCED 1443 help 1444 Multiport matching allows you to match TCP or UDP packets based on 1445 a series of source or destination ports: normally a rule can only 1446 match a single range of ports. 1447 1448 To compile it as a module, choose M here. If unsure, say N. 1449 1450config NETFILTER_XT_MATCH_NFACCT 1451 tristate '"nfacct" match support' 1452 depends on NETFILTER_ADVANCED 1453 select NETFILTER_NETLINK_ACCT 1454 help 1455 This option allows you to use the extended accounting through 1456 nfnetlink_acct. 1457 1458 To compile it as a module, choose M here. If unsure, say N. 1459 1460config NETFILTER_XT_MATCH_OSF 1461 tristate '"osf" Passive OS fingerprint match' 1462 depends on NETFILTER_ADVANCED 1463 select NETFILTER_NETLINK_OSF 1464 help 1465 This option selects the Passive OS Fingerprinting match module 1466 that allows to passively match the remote operating system by 1467 analyzing incoming TCP SYN packets. 1468 1469 Rules and loading software can be downloaded from 1470 http://www.ioremap.net/projects/osf 1471 1472 To compile it as a module, choose M here. If unsure, say N. 1473 1474config NETFILTER_XT_MATCH_OWNER 1475 tristate '"owner" match support' 1476 depends on NETFILTER_ADVANCED 1477 help 1478 Socket owner matching allows you to match locally-generated packets 1479 based on who created the socket: the user or group. It is also 1480 possible to check whether a socket actually exists. 1481 1482config NETFILTER_XT_MATCH_POLICY 1483 tristate 'IPsec "policy" match support' 1484 depends on XFRM 1485 default m if NETFILTER_ADVANCED=n 1486 help 1487 Policy matching allows you to match packets based on the 1488 IPsec policy that was used during decapsulation/will 1489 be used during encapsulation. 1490 1491 To compile it as a module, choose M here. If unsure, say N. 1492 1493config NETFILTER_XT_MATCH_PHYSDEV 1494 tristate '"physdev" match support' 1495 depends on BRIDGE && BRIDGE_NETFILTER 1496 depends on NETFILTER_ADVANCED 1497 help 1498 Physdev packet matching matches against the physical bridge ports 1499 the IP packet arrived on or will leave by. 1500 1501 To compile it as a module, choose M here. If unsure, say N. 1502 1503config NETFILTER_XT_MATCH_PKTTYPE 1504 tristate '"pkttype" packet type match support' 1505 depends on NETFILTER_ADVANCED 1506 help 1507 Packet type matching allows you to match a packet by 1508 its "class", eg. BROADCAST, MULTICAST, ... 1509 1510 Typical usage: 1511 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1512 1513 To compile it as a module, choose M here. If unsure, say N. 1514 1515config NETFILTER_XT_MATCH_QUOTA 1516 tristate '"quota" match support' 1517 depends on NETFILTER_ADVANCED 1518 help 1519 This option adds a `quota' match, which allows to match on a 1520 byte counter. 1521 1522 If you want to compile it as a module, say M here and read 1523 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1524 1525config NETFILTER_XT_MATCH_RATEEST 1526 tristate '"rateest" match support' 1527 depends on NETFILTER_ADVANCED 1528 select NETFILTER_XT_TARGET_RATEEST 1529 help 1530 This option adds a `rateest' match, which allows to match on the 1531 rate estimated by the RATEEST target. 1532 1533 To compile it as a module, choose M here. If unsure, say N. 1534 1535config NETFILTER_XT_MATCH_REALM 1536 tristate '"realm" match support' 1537 depends on NETFILTER_ADVANCED 1538 select IP_ROUTE_CLASSID 1539 help 1540 This option adds a `realm' match, which allows you to use the realm 1541 key from the routing subsystem inside iptables. 1542 1543 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1544 in tc world. 1545 1546 If you want to compile it as a module, say M here and read 1547 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1548 1549config NETFILTER_XT_MATCH_RECENT 1550 tristate '"recent" match support' 1551 depends on NETFILTER_ADVANCED 1552 help 1553 This match is used for creating one or many lists of recently 1554 used addresses and then matching against that/those list(s). 1555 1556 Short options are available by using 'iptables -m recent -h' 1557 Official Website: <http://snowman.net/projects/ipt_recent/> 1558 1559config NETFILTER_XT_MATCH_SCTP 1560 tristate '"sctp" protocol match support' 1561 depends on NETFILTER_ADVANCED 1562 default IP_SCTP 1563 help 1564 With this option enabled, you will be able to use the 1565 `sctp' match in order to match on SCTP source/destination ports 1566 and SCTP chunk types. 1567 1568 If you want to compile it as a module, say M here and read 1569 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1570 1571config NETFILTER_XT_MATCH_SOCKET 1572 tristate '"socket" match support' 1573 depends on NETFILTER_XTABLES 1574 depends on NETFILTER_ADVANCED 1575 depends on IPV6 || IPV6=n 1576 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1577 select NF_SOCKET_IPV4 1578 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES 1579 select NF_DEFRAG_IPV4 1580 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1581 help 1582 This option adds a `socket' match, which can be used to match 1583 packets for which a TCP or UDP socket lookup finds a valid socket. 1584 It can be used in combination with the MARK target and policy 1585 routing to implement full featured non-locally bound sockets. 1586 1587 To compile it as a module, choose M here. If unsure, say N. 1588 1589config NETFILTER_XT_MATCH_STATE 1590 tristate '"state" match support' 1591 depends on NF_CONNTRACK 1592 default m if NETFILTER_ADVANCED=n 1593 help 1594 Connection state matching allows you to match packets based on their 1595 relationship to a tracked connection (ie. previous packets). This 1596 is a powerful tool for packet classification. 1597 1598 To compile it as a module, choose M here. If unsure, say N. 1599 1600config NETFILTER_XT_MATCH_STATISTIC 1601 tristate '"statistic" match support' 1602 depends on NETFILTER_ADVANCED 1603 help 1604 This option adds a `statistic' match, which allows you to match 1605 on packets periodically or randomly with a given percentage. 1606 1607 To compile it as a module, choose M here. If unsure, say N. 1608 1609config NETFILTER_XT_MATCH_STRING 1610 tristate '"string" match support' 1611 depends on NETFILTER_ADVANCED 1612 select TEXTSEARCH 1613 select TEXTSEARCH_KMP 1614 select TEXTSEARCH_BM 1615 select TEXTSEARCH_FSM 1616 help 1617 This option adds a `string' match, which allows you to look for 1618 pattern matchings in packets. 1619 1620 To compile it as a module, choose M here. If unsure, say N. 1621 1622config NETFILTER_XT_MATCH_TCPMSS 1623 tristate '"tcpmss" match support' 1624 depends on NETFILTER_ADVANCED 1625 help 1626 This option adds a `tcpmss' match, which allows you to examine the 1627 MSS value of TCP SYN packets, which control the maximum packet size 1628 for that connection. 1629 1630 To compile it as a module, choose M here. If unsure, say N. 1631 1632config NETFILTER_XT_MATCH_TIME 1633 tristate '"time" match support' 1634 depends on NETFILTER_ADVANCED 1635 help 1636 This option adds a "time" match, which allows you to match based on 1637 the packet arrival time (at the machine which netfilter is running) 1638 on) or departure time/date (for locally generated packets). 1639 1640 If you say Y here, try `iptables -m time --help` for 1641 more information. 1642 1643 If you want to compile it as a module, say M here. 1644 If unsure, say N. 1645 1646config NETFILTER_XT_MATCH_U32 1647 tristate '"u32" match support' 1648 depends on NETFILTER_ADVANCED 1649 help 1650 u32 allows you to extract quantities of up to 4 bytes from a packet, 1651 AND them with specified masks, shift them by specified amounts and 1652 test whether the results are in any of a set of specified ranges. 1653 The specification of what to extract is general enough to skip over 1654 headers with lengths stored in the packet, as in IP or TCP header 1655 lengths. 1656 1657 Details and examples are in the kernel module source. 1658 1659endif # NETFILTER_XTABLES 1660 1661endmenu 1662 1663source "net/netfilter/ipset/Kconfig" 1664 1665source "net/netfilter/ipvs/Kconfig" 1666