1
2menu "Core Netfilter Configuration"
3 depends on NET && INET && NETFILTER
4
5config NETFILTER_INGRESS
6 bool "Netfilter ingress support"
7 default y
8 select NET_INGRESS
9 help
10 This allows you to classify packets from ingress using the Netfilter
11 infrastructure.
12
13config NETFILTER_NETLINK
14 tristate
15
16config NETFILTER_FAMILY_BRIDGE
17 bool
18
19config NETFILTER_FAMILY_ARP
20 bool
21
22config NETFILTER_NETLINK_ACCT
23 tristate "Netfilter NFACCT over NFNETLINK interface"
24 depends on NETFILTER_ADVANCED
25 select NETFILTER_NETLINK
26 help
27 If this option is enabled, the kernel will include support
28 for extended accounting via NFNETLINK.
29
30config NETFILTER_NETLINK_QUEUE
31 tristate "Netfilter NFQUEUE over NFNETLINK interface"
32 depends on NETFILTER_ADVANCED
33 select NETFILTER_NETLINK
34 help
35 If this option is enabled, the kernel will include support
36 for queueing packets via NFNETLINK.
37
38config NETFILTER_NETLINK_LOG
39 tristate "Netfilter LOG over NFNETLINK interface"
40 default m if NETFILTER_ADVANCED=n
41 select NETFILTER_NETLINK
42 help
43 If this option is enabled, the kernel will include support
44 for logging packets via NFNETLINK.
45
46 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
47 and is also scheduled to replace the old syslog-based ipt_LOG
48 and ip6t_LOG modules.
49
50config NETFILTER_NETLINK_OSF
51 tristate "Netfilter OSF over NFNETLINK interface"
52 depends on NETFILTER_ADVANCED
53 select NETFILTER_NETLINK
54 help
55 If this option is enabled, the kernel will include support
56 for passive OS fingerprint via NFNETLINK.
57
58config NF_CONNTRACK
59 tristate "Netfilter connection tracking support"
60 default m if NETFILTER_ADVANCED=n
61 select NF_DEFRAG_IPV4
62 select NF_DEFRAG_IPV6 if IPV6 != n
63 help
64 Connection tracking keeps a record of what packets have passed
65 through your machine, in order to figure out how they are related
66 into connections.
67
68 This is required to do Masquerading or other kinds of Network
69 Address Translation. It can also be used to enhance packet
70 filtering (see `Connection state match support' below).
71
72 To compile it as a module, choose M here. If unsure, say N.
73
74config NF_LOG_COMMON
75 tristate
76
77config NF_LOG_NETDEV
78 tristate "Netdev packet logging"
79 select NF_LOG_COMMON
80
81if NF_CONNTRACK
82config NETFILTER_CONNCOUNT
83 tristate
84
85config NF_CONNTRACK_MARK
86 bool 'Connection mark tracking support'
87 depends on NETFILTER_ADVANCED
88 help
89 This option enables support for connection marks, used by the
90 `CONNMARK' target and `connmark' match. Similar to the mark value
91 of packets, but this mark value is kept in the conntrack session
92 instead of the individual packets.
93
94config NF_CONNTRACK_SECMARK
95 bool 'Connection tracking security mark support'
96 depends on NETWORK_SECMARK
97 default m if NETFILTER_ADVANCED=n
98 help
99 This option enables security markings to be applied to
100 connections. Typically they are copied to connections from
101 packets using the CONNSECMARK target and copied back from
102 connections to packets with the same target, with the packets
103 being originally labeled via SECMARK.
104
105 If unsure, say 'N'.
106
107config NF_CONNTRACK_ZONES
108 bool 'Connection tracking zones'
109 depends on NETFILTER_ADVANCED
110 help
111 This option enables support for connection tracking zones.
112 Normally, each connection needs to have a unique system wide
113 identity. Connection tracking zones allow to have multiple
114 connections using the same identity, as long as they are
115 contained in different zones.
116
117 If unsure, say `N'.
118
119config NF_CONNTRACK_PROCFS
120 bool "Supply CT list in procfs (OBSOLETE)"
121 default y
122 depends on PROC_FS
123 help
124 This option enables for the list of known conntrack entries
125 to be shown in procfs under net/netfilter/nf_conntrack. This
126 is considered obsolete in favor of using the conntrack(8)
127 tool which uses Netlink.
128
129config NF_CONNTRACK_EVENTS
130 bool "Connection tracking events"
131 depends on NETFILTER_ADVANCED
132 help
133 If this option is enabled, the connection tracking code will
134 provide a notifier chain that can be used by other kernel code
135 to get notified about changes in the connection tracking state.
136
137 If unsure, say `N'.
138
139config NF_CONNTRACK_TIMEOUT
140 bool 'Connection tracking timeout'
141 depends on NETFILTER_ADVANCED
142 help
143 This option enables support for connection tracking timeout
144 extension. This allows you to attach timeout policies to flow
145 via the CT target.
146
147 If unsure, say `N'.
148
149config NF_CONNTRACK_TIMESTAMP
150 bool 'Connection tracking timestamping'
151 depends on NETFILTER_ADVANCED
152 help
153 This option enables support for connection tracking timestamping.
154 This allows you to store the flow start-time and to obtain
155 the flow-stop time (once it has been destroyed) via Connection
156 tracking events.
157
158 If unsure, say `N'.
159
160config NF_CONNTRACK_LABELS
161 bool "Connection tracking labels"
162 help
163 This option enables support for assigning user-defined flag bits
164 to connection tracking entries. It can be used with xtables connlabel
165 match and the nftables ct expression.
166
167config NF_CT_PROTO_DCCP
168 bool 'DCCP protocol connection tracking support'
169 depends on NETFILTER_ADVANCED
170 default y
171 help
172 With this option enabled, the layer 3 independent connection
173 tracking code will be able to do state tracking on DCCP connections.
174
175 If unsure, say Y.
176
177config NF_CT_PROTO_GRE
178 bool
179
180config NF_CT_PROTO_SCTP
181 bool 'SCTP protocol connection tracking support'
182 depends on NETFILTER_ADVANCED
183 default y
184 select LIBCRC32C
185 help
186 With this option enabled, the layer 3 independent connection
187 tracking code will be able to do state tracking on SCTP connections.
188
189 If unsure, say Y.
190
191config NF_CT_PROTO_UDPLITE
192 bool 'UDP-Lite protocol connection tracking support'
193 depends on NETFILTER_ADVANCED
194 default y
195 help
196 With this option enabled, the layer 3 independent connection
197 tracking code will be able to do state tracking on UDP-Lite
198 connections.
199
200 If unsure, say Y.
201
202config NF_CONNTRACK_AMANDA
203 tristate "Amanda backup protocol support"
204 depends on NETFILTER_ADVANCED
205 select TEXTSEARCH
206 select TEXTSEARCH_KMP
207 help
208 If you are running the Amanda backup package <http://www.amanda.org/>
209 on this machine or machines that will be MASQUERADED through this
210 machine, then you may want to enable this feature. This allows the
211 connection tracking and natting code to allow the sub-channels that
212 Amanda requires for communication of the backup data, messages and
213 index.
214
215 To compile it as a module, choose M here. If unsure, say N.
216
217config NF_CONNTRACK_FTP
218 tristate "FTP protocol support"
219 default m if NETFILTER_ADVANCED=n
220 help
221 Tracking FTP connections is problematic: special helpers are
222 required for tracking them, and doing masquerading and other forms
223 of Network Address Translation on them.
224
225 This is FTP support on Layer 3 independent connection tracking.
226
227 To compile it as a module, choose M here. If unsure, say N.
228
229config NF_CONNTRACK_H323
230 tristate "H.323 protocol support"
231 depends on IPV6 || IPV6=n
232 depends on NETFILTER_ADVANCED
233 help
234 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
235 important VoIP protocols, it is widely used by voice hardware and
236 software including voice gateways, IP phones, Netmeeting, OpenPhone,
237 Gnomemeeting, etc.
238
239 With this module you can support H.323 on a connection tracking/NAT
240 firewall.
241
242 This module supports RAS, Fast Start, H.245 Tunnelling, Call
243 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
244 whiteboard, file transfer, etc. For more information, please
245 visit http://nath323.sourceforge.net/.
246
247 To compile it as a module, choose M here. If unsure, say N.
248
249config NF_CONNTRACK_IRC
250 tristate "IRC protocol support"
251 default m if NETFILTER_ADVANCED=n
252 help
253 There is a commonly-used extension to IRC called
254 Direct Client-to-Client Protocol (DCC). This enables users to send
255 files to each other, and also chat to each other without the need
256 of a server. DCC Sending is used anywhere you send files over IRC,
257 and DCC Chat is most commonly used by Eggdrop bots. If you are
258 using NAT, this extension will enable you to send files and initiate
259 chats. Note that you do NOT need this extension to get files or
260 have others initiate chats, or everything else in IRC.
261
262 To compile it as a module, choose M here. If unsure, say N.
263
264config NF_CONNTRACK_BROADCAST
265 tristate
266
267config NF_CONNTRACK_NETBIOS_NS
268 tristate "NetBIOS name service protocol support"
269 select NF_CONNTRACK_BROADCAST
270 help
271 NetBIOS name service requests are sent as broadcast messages from an
272 unprivileged port and responded to with unicast messages to the
273 same port. This make them hard to firewall properly because connection
274 tracking doesn't deal with broadcasts. This helper tracks locally
275 originating NetBIOS name service requests and the corresponding
276 responses. It relies on correct IP address configuration, specifically
277 netmask and broadcast address. When properly configured, the output
278 of "ip address show" should look similar to this:
279
280 $ ip -4 address show eth0
281 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
282 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
283
284 To compile it as a module, choose M here. If unsure, say N.
285
286config NF_CONNTRACK_SNMP
287 tristate "SNMP service protocol support"
288 depends on NETFILTER_ADVANCED
289 select NF_CONNTRACK_BROADCAST
290 help
291 SNMP service requests are sent as broadcast messages from an
292 unprivileged port and responded to with unicast messages to the
293 same port. This make them hard to firewall properly because connection
294 tracking doesn't deal with broadcasts. This helper tracks locally
295 originating SNMP service requests and the corresponding
296 responses. It relies on correct IP address configuration, specifically
297 netmask and broadcast address.
298
299 To compile it as a module, choose M here. If unsure, say N.
300
301config NF_CONNTRACK_PPTP
302 tristate "PPtP protocol support"
303 depends on NETFILTER_ADVANCED
304 select NF_CT_PROTO_GRE
305 help
306 This module adds support for PPTP (Point to Point Tunnelling
307 Protocol, RFC2637) connection tracking and NAT.
308
309 If you are running PPTP sessions over a stateful firewall or NAT
310 box, you may want to enable this feature.
311
312 Please note that not all PPTP modes of operation are supported yet.
313 Specifically these limitations exist:
314 - Blindly assumes that control connections are always established
315 in PNS->PAC direction. This is a violation of RFC2637.
316 - Only supports a single call within each session
317
318 To compile it as a module, choose M here. If unsure, say N.
319
320config NF_CONNTRACK_SANE
321 tristate "SANE protocol support"
322 depends on NETFILTER_ADVANCED
323 help
324 SANE is a protocol for remote access to scanners as implemented
325 by the 'saned' daemon. Like FTP, it uses separate control and
326 data connections.
327
328 With this module you can support SANE on a connection tracking
329 firewall.
330
331 To compile it as a module, choose M here. If unsure, say N.
332
333config NF_CONNTRACK_SIP
334 tristate "SIP protocol support"
335 default m if NETFILTER_ADVANCED=n
336 help
337 SIP is an application-layer control protocol that can establish,
338 modify, and terminate multimedia sessions (conferences) such as
339 Internet telephony calls. With the nf_conntrack_sip and
340 the nf_nat_sip modules you can support the protocol on a connection
341 tracking/NATing firewall.
342
343 To compile it as a module, choose M here. If unsure, say N.
344
345config NF_CONNTRACK_TFTP
346 tristate "TFTP protocol support"
347 depends on NETFILTER_ADVANCED
348 help
349 TFTP connection tracking helper, this is required depending
350 on how restrictive your ruleset is.
351 If you are using a tftp client behind -j SNAT or -j MASQUERADING
352 you will need this.
353
354 To compile it as a module, choose M here. If unsure, say N.
355
356config NF_CT_NETLINK
357 tristate 'Connection tracking netlink interface'
358 select NETFILTER_NETLINK
359 default m if NETFILTER_ADVANCED=n
360 help
361 This option enables support for a netlink-based userspace interface
362
363config NF_CT_NETLINK_TIMEOUT
364 tristate 'Connection tracking timeout tuning via Netlink'
365 select NETFILTER_NETLINK
366 depends on NETFILTER_ADVANCED
367 depends on NF_CONNTRACK_TIMEOUT
368 help
369 This option enables support for connection tracking timeout
370 fine-grain tuning. This allows you to attach specific timeout
371 policies to flows, instead of using the global timeout policy.
372
373 If unsure, say `N'.
374
375config NF_CT_NETLINK_HELPER
376 tristate 'Connection tracking helpers in user-space via Netlink'
377 select NETFILTER_NETLINK
378 depends on NF_CT_NETLINK
379 depends on NETFILTER_NETLINK_QUEUE
380 depends on NETFILTER_NETLINK_GLUE_CT
381 depends on NETFILTER_ADVANCED
382 help
383 This option enables the user-space connection tracking helpers
384 infrastructure.
385
386 If unsure, say `N'.
387
388config NETFILTER_NETLINK_GLUE_CT
389 bool "NFQUEUE and NFLOG integration with Connection Tracking"
390 default n
391 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
392 help
393 If this option is enabled, NFQUEUE and NFLOG can include
394 Connection Tracking information together with the packet is
395 the enqueued via NFNETLINK.
396
397config NF_NAT
398 tristate "Network Address Translation support"
399 depends on NF_CONNTRACK
400 default m if NETFILTER_ADVANCED=n
401 help
402 The NAT option allows masquerading, port forwarding and other
403 forms of full Network Address Port Translation. This can be
404 controlled by iptables, ip6tables or nft.
405
406config NF_NAT_AMANDA
407 tristate
408 depends on NF_CONNTRACK && NF_NAT
409 default NF_NAT && NF_CONNTRACK_AMANDA
410
411config NF_NAT_FTP
412 tristate
413 depends on NF_CONNTRACK && NF_NAT
414 default NF_NAT && NF_CONNTRACK_FTP
415
416config NF_NAT_IRC
417 tristate
418 depends on NF_CONNTRACK && NF_NAT
419 default NF_NAT && NF_CONNTRACK_IRC
420
421config NF_NAT_SIP
422 tristate
423 depends on NF_CONNTRACK && NF_NAT
424 default NF_NAT && NF_CONNTRACK_SIP
425
426config NF_NAT_TFTP
427 tristate
428 depends on NF_CONNTRACK && NF_NAT
429 default NF_NAT && NF_CONNTRACK_TFTP
430
431config NF_NAT_REDIRECT
432 bool
433
434config NF_NAT_MASQUERADE
435 bool
436
437config NETFILTER_SYNPROXY
438 tristate
439
440endif
441
442config NF_TABLES
443 select NETFILTER_NETLINK
444 tristate "Netfilter nf_tables support"
445 help
446 nftables is the new packet classification framework that intends to
447 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
448 provides a pseudo-state machine with an extensible instruction-set
449 (also known as expressions) that the userspace 'nft' utility
450 (https://www.netfilter.org/projects/nftables) uses to build the
451 rule-set. It also comes with the generic set infrastructure that
452 allows you to construct mappings between matchings and actions
453 for performance lookups.
454
455 To compile it as a module, choose M here.
456
457if NF_TABLES
458config NF_TABLES_INET
459 depends on IPV6
460 select NF_TABLES_IPV4
461 select NF_TABLES_IPV6
462 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
463 help
464 This option enables support for a mixed IPv4/IPv6 "inet" table.
465
466config NF_TABLES_NETDEV
467 bool "Netfilter nf_tables netdev tables support"
468 help
469 This option enables support for the "netdev" table.
470
471config NFT_NUMGEN
472 tristate "Netfilter nf_tables number generator module"
473 help
474 This option adds the number generator expression used to perform
475 incremental counting and random numbers bound to a upper limit.
476
477config NFT_CT
478 depends on NF_CONNTRACK
479 tristate "Netfilter nf_tables conntrack module"
480 help
481 This option adds the "ct" expression that you can use to match
482 connection tracking information such as the flow state.
483
484config NFT_FLOW_OFFLOAD
485 depends on NF_CONNTRACK && NF_FLOW_TABLE
486 tristate "Netfilter nf_tables hardware flow offload module"
487 help
488 This option adds the "flow_offload" expression that you can use to
489 choose what flows are placed into the hardware.
490
491config NFT_COUNTER
492 tristate "Netfilter nf_tables counter module"
493 help
494 This option adds the "counter" expression that you can use to
495 include packet and byte counters in a rule.
496
497config NFT_CONNLIMIT
498 tristate "Netfilter nf_tables connlimit module"
499 depends on NF_CONNTRACK
500 depends on NETFILTER_ADVANCED
501 select NETFILTER_CONNCOUNT
502 help
503 This option adds the "connlimit" expression that you can use to
504 ratelimit rule matchings per connections.
505
506config NFT_LOG
507 tristate "Netfilter nf_tables log module"
508 help
509 This option adds the "log" expression that you can use to log
510 packets matching some criteria.
511
512config NFT_LIMIT
513 tristate "Netfilter nf_tables limit module"
514 help
515 This option adds the "limit" expression that you can use to
516 ratelimit rule matchings.
517
518config NFT_MASQ
519 depends on NF_CONNTRACK
520 depends on NF_NAT
521 select NF_NAT_MASQUERADE
522 tristate "Netfilter nf_tables masquerade support"
523 help
524 This option adds the "masquerade" expression that you can use
525 to perform NAT in the masquerade flavour.
526
527config NFT_REDIR
528 depends on NF_CONNTRACK
529 depends on NF_NAT
530 tristate "Netfilter nf_tables redirect support"
531 select NF_NAT_REDIRECT
532 help
533 This options adds the "redirect" expression that you can use
534 to perform NAT in the redirect flavour.
535
536config NFT_NAT
537 depends on NF_CONNTRACK
538 select NF_NAT
539 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
540 tristate "Netfilter nf_tables nat module"
541 help
542 This option adds the "nat" expression that you can use to perform
543 typical Network Address Translation (NAT) packet transformations.
544
545config NFT_TUNNEL
546 tristate "Netfilter nf_tables tunnel module"
547 help
548 This option adds the "tunnel" expression that you can use to set
549 tunneling policies.
550
551config NFT_OBJREF
552 tristate "Netfilter nf_tables stateful object reference module"
553 help
554 This option adds the "objref" expression that allows you to refer to
555 stateful objects, such as counters and quotas.
556
557config NFT_QUEUE
558 depends on NETFILTER_NETLINK_QUEUE
559 tristate "Netfilter nf_tables queue module"
560 help
561 This is required if you intend to use the userspace queueing
562 infrastructure (also known as NFQUEUE) from nftables.
563
564config NFT_QUOTA
565 tristate "Netfilter nf_tables quota module"
566 help
567 This option adds the "quota" expression that you can use to match
568 enforce bytes quotas.
569
570config NFT_REJECT
571 default m if NETFILTER_ADVANCED=n
572 tristate "Netfilter nf_tables reject support"
573 depends on !NF_TABLES_INET || (IPV6!=m || m)
574 help
575 This option adds the "reject" expression that you can use to
576 explicitly deny and notify via TCP reset/ICMP informational errors
577 unallowed traffic.
578
579config NFT_REJECT_INET
580 depends on NF_TABLES_INET
581 default NFT_REJECT
582 tristate
583
584config NFT_COMPAT
585 depends on NETFILTER_XTABLES
586 tristate "Netfilter x_tables over nf_tables module"
587 help
588 This is required if you intend to use any of existing
589 x_tables match/target extensions over the nf_tables
590 framework.
591
592config NFT_HASH
593 tristate "Netfilter nf_tables hash module"
594 help
595 This option adds the "hash" expression that you can use to perform
596 a hash operation on registers.
597
598config NFT_FIB
599 tristate
600
601config NFT_FIB_INET
602 depends on NF_TABLES_INET
603 depends on NFT_FIB_IPV4
604 depends on NFT_FIB_IPV6
605 tristate "Netfilter nf_tables fib inet support"
606 help
607 This option allows using the FIB expression from the inet table.
608 The lookup will be delegated to the IPv4 or IPv6 FIB depending
609 on the protocol of the packet.
610
611config NFT_XFRM
612 tristate "Netfilter nf_tables xfrm/IPSec security association matching"
613 depends on XFRM
614 help
615 This option adds an expression that you can use to extract properties
616 of a packets security association.
617
618config NFT_SOCKET
619 tristate "Netfilter nf_tables socket match support"
620 depends on IPV6 || IPV6=n
621 select NF_SOCKET_IPV4
622 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
623 help
624 This option allows matching for the presence or absence of a
625 corresponding socket and its attributes.
626
627config NFT_OSF
628 tristate "Netfilter nf_tables passive OS fingerprint support"
629 depends on NETFILTER_ADVANCED
630 select NETFILTER_NETLINK_OSF
631 help
632 This option allows matching packets from an specific OS.
633
634config NFT_TPROXY
635 tristate "Netfilter nf_tables tproxy support"
636 depends on IPV6 || IPV6=n
637 select NF_DEFRAG_IPV4
638 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
639 select NF_TPROXY_IPV4
640 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
641 help
642 This makes transparent proxy support available in nftables.
643
644config NFT_SYNPROXY
645 tristate "Netfilter nf_tables SYNPROXY expression support"
646 depends on NF_CONNTRACK && NETFILTER_ADVANCED
647 select NETFILTER_SYNPROXY
648 select SYN_COOKIES
649 help
650 The SYNPROXY expression allows you to intercept TCP connections and
651 establish them using syncookies before they are passed on to the
652 server. This allows to avoid conntrack and server resource usage
653 during SYN-flood attacks.
654
655if NF_TABLES_NETDEV
656
657config NF_DUP_NETDEV
658 tristate "Netfilter packet duplication support"
659 help
660 This option enables the generic packet duplication infrastructure
661 for Netfilter.
662
663config NFT_DUP_NETDEV
664 tristate "Netfilter nf_tables netdev packet duplication support"
665 select NF_DUP_NETDEV
666 help
667 This option enables packet duplication for the "netdev" family.
668
669config NFT_FWD_NETDEV
670 tristate "Netfilter nf_tables netdev packet forwarding support"
671 select NF_DUP_NETDEV
672 help
673 This option enables packet forwarding for the "netdev" family.
674
675config NFT_FIB_NETDEV
676 depends on NFT_FIB_IPV4
677 depends on NFT_FIB_IPV6
678 tristate "Netfilter nf_tables netdev fib lookups support"
679 help
680 This option allows using the FIB expression from the netdev table.
681 The lookup will be delegated to the IPv4 or IPv6 FIB depending
682 on the protocol of the packet.
683
684endif
685
686endif
687
688config NF_FLOW_TABLE_INET
689 tristate "Netfilter flow table mixed IPv4/IPv6 module"
690 depends on NF_FLOW_TABLE
691 help
692 This option adds the flow table mixed IPv4/IPv6 support.
693
694 To compile it as a module, choose M here.
695
696config NF_FLOW_TABLE
697 tristate "Netfilter flow table module"
698 depends on NETFILTER_INGRESS
699 depends on NF_CONNTRACK
700 depends on NF_TABLES
701 help
702 This option adds the flow table core infrastructure.
703
704 To compile it as a module, choose M here.
705
706config NETFILTER_XTABLES
707 tristate "Netfilter Xtables support (required for ip_tables)"
708 default m if NETFILTER_ADVANCED=n
709 help
710 This is required if you intend to use any of ip_tables,
711 ip6_tables or arp_tables.
712
713if NETFILTER_XTABLES
714
715comment "Xtables combined modules"
716
717config NETFILTER_XT_MARK
718 tristate 'nfmark target and match support'
719 default m if NETFILTER_ADVANCED=n
720 help
721 This option adds the "MARK" target and "mark" match.
722
723 Netfilter mark matching allows you to match packets based on the
724 "nfmark" value in the packet.
725 The target allows you to create rules in the "mangle" table which alter
726 the netfilter mark (nfmark) field associated with the packet.
727
728 Prior to routing, the nfmark can influence the routing method and can
729 also be used by other subsystems to change their behavior.
730
731config NETFILTER_XT_CONNMARK
732 tristate 'ctmark target and match support'
733 depends on NF_CONNTRACK
734 depends on NETFILTER_ADVANCED
735 select NF_CONNTRACK_MARK
736 help
737 This option adds the "CONNMARK" target and "connmark" match.
738
739 Netfilter allows you to store a mark value per connection (a.k.a.
740 ctmark), similarly to the packet mark (nfmark). Using this
741 target and match, you can set and match on this mark.
742
743config NETFILTER_XT_SET
744 tristate 'set target and match support'
745 depends on IP_SET
746 depends on NETFILTER_ADVANCED
747 help
748 This option adds the "SET" target and "set" match.
749
750 Using this target and match, you can add/delete and match
751 elements in the sets created by ipset(8).
752
753 To compile it as a module, choose M here. If unsure, say N.
754
755
756
757comment "Xtables targets"
758
759config NETFILTER_XT_TARGET_AUDIT
760 tristate "AUDIT target support"
761 depends on AUDIT
762 depends on NETFILTER_ADVANCED
763 help
764 This option adds a 'AUDIT' target, which can be used to create
765 audit records for packets dropped/accepted.
766
767 To compileit as a module, choose M here. If unsure, say N.
768
769config NETFILTER_XT_TARGET_CHECKSUM
770 tristate "CHECKSUM target support"
771 depends on IP_NF_MANGLE || IP6_NF_MANGLE
772 depends on NETFILTER_ADVANCED
773 help
774 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
775 table to work around buggy DHCP clients in virtualized environments.
776
777 Some old DHCP clients drop packets because they are not aware
778 that the checksum would normally be offloaded to hardware and
779 thus should be considered valid.
780 This target can be used to fill in the checksum using iptables
781 when such packets are sent via a virtual network device.
782
783 To compile it as a module, choose M here. If unsure, say N.
784
785config NETFILTER_XT_TARGET_CLASSIFY
786 tristate '"CLASSIFY" target support'
787 depends on NETFILTER_ADVANCED
788 help
789 This option adds a `CLASSIFY' target, which enables the user to set
790 the priority of a packet. Some qdiscs can use this value for
791 classification, among these are:
792
793 atm, cbq, dsmark, pfifo_fast, htb, prio
794
795 To compile it as a module, choose M here. If unsure, say N.
796
797config NETFILTER_XT_TARGET_CONNMARK
798 tristate '"CONNMARK" target support'
799 depends on NF_CONNTRACK
800 depends on NETFILTER_ADVANCED
801 select NETFILTER_XT_CONNMARK
802 help
803 This is a backwards-compat option for the user's convenience
804 (e.g. when running oldconfig). It selects
805 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
806
807config NETFILTER_XT_TARGET_CONNSECMARK
808 tristate '"CONNSECMARK" target support'
809 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
810 default m if NETFILTER_ADVANCED=n
811 help
812 The CONNSECMARK target copies security markings from packets
813 to connections, and restores security markings from connections
814 to packets (if the packets are not already marked). This would
815 normally be used in conjunction with the SECMARK target.
816
817 To compile it as a module, choose M here. If unsure, say N.
818
819config NETFILTER_XT_TARGET_CT
820 tristate '"CT" target support'
821 depends on NF_CONNTRACK
822 depends on IP_NF_RAW || IP6_NF_RAW
823 depends on NETFILTER_ADVANCED
824 help
825 This options adds a `CT' target, which allows to specify initial
826 connection tracking parameters like events to be delivered and
827 the helper to be used.
828
829 To compile it as a module, choose M here. If unsure, say N.
830
831config NETFILTER_XT_TARGET_DSCP
832 tristate '"DSCP" and "TOS" target support'
833 depends on IP_NF_MANGLE || IP6_NF_MANGLE
834 depends on NETFILTER_ADVANCED
835 help
836 This option adds a `DSCP' target, which allows you to manipulate
837 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
838
839 The DSCP field can have any value between 0x0 and 0x3f inclusive.
840
841 It also adds the "TOS" target, which allows you to create rules in
842 the "mangle" table which alter the Type Of Service field of an IPv4
843 or the Priority field of an IPv6 packet, prior to routing.
844
845 To compile it as a module, choose M here. If unsure, say N.
846
847config NETFILTER_XT_TARGET_HL
848 tristate '"HL" hoplimit target support'
849 depends on IP_NF_MANGLE || IP6_NF_MANGLE
850 depends on NETFILTER_ADVANCED
851 help
852 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
853 targets, which enable the user to change the
854 hoplimit/time-to-live value of the IP header.
855
856 While it is safe to decrement the hoplimit/TTL value, the
857 modules also allow to increment and set the hoplimit value of
858 the header to arbitrary values. This is EXTREMELY DANGEROUS
859 since you can easily create immortal packets that loop
860 forever on the network.
861
862config NETFILTER_XT_TARGET_HMARK
863 tristate '"HMARK" target support'
864 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
865 depends on NETFILTER_ADVANCED
866 help
867 This option adds the "HMARK" target.
868
869 The target allows you to create rules in the "raw" and "mangle" tables
870 which set the skbuff mark by means of hash calculation within a given
871 range. The nfmark can influence the routing method and can also be used
872 by other subsystems to change their behaviour.
873
874 To compile it as a module, choose M here. If unsure, say N.
875
876config NETFILTER_XT_TARGET_IDLETIMER
877 tristate "IDLETIMER target support"
878 depends on NETFILTER_ADVANCED
879 help
880
881 This option adds the `IDLETIMER' target. Each matching packet
882 resets the timer associated with label specified when the rule is
883 added. When the timer expires, it triggers a sysfs notification.
884 The remaining time for expiration can be read via sysfs.
885
886 To compile it as a module, choose M here. If unsure, say N.
887
888config NETFILTER_XT_TARGET_LED
889 tristate '"LED" target support'
890 depends on LEDS_CLASS && LEDS_TRIGGERS
891 depends on NETFILTER_ADVANCED
892 help
893 This option adds a `LED' target, which allows you to blink LEDs in
894 response to particular packets passing through your machine.
895
896 This can be used to turn a spare LED into a network activity LED,
897 which only flashes in response to FTP transfers, for example. Or
898 you could have an LED which lights up for a minute or two every time
899 somebody connects to your machine via SSH.
900
901 You will need support for the "led" class to make this work.
902
903 To create an LED trigger for incoming SSH traffic:
904 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
905
906 Then attach the new trigger to an LED on your system:
907 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
908
909 For more information on the LEDs available on your system, see
910 Documentation/leds/leds-class.rst
911
912config NETFILTER_XT_TARGET_LOG
913 tristate "LOG target support"
914 select NF_LOG_COMMON
915 select NF_LOG_IPV4
916 select NF_LOG_IPV6 if IP6_NF_IPTABLES
917 default m if NETFILTER_ADVANCED=n
918 help
919 This option adds a `LOG' target, which allows you to create rules in
920 any iptables table which records the packet header to the syslog.
921
922 To compile it as a module, choose M here. If unsure, say N.
923
924config NETFILTER_XT_TARGET_MARK
925 tristate '"MARK" target support'
926 depends on NETFILTER_ADVANCED
927 select NETFILTER_XT_MARK
928 help
929 This is a backwards-compat option for the user's convenience
930 (e.g. when running oldconfig). It selects
931 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
932
933config NETFILTER_XT_NAT
934 tristate '"SNAT and DNAT" targets support'
935 depends on NF_NAT
936 help
937 This option enables the SNAT and DNAT targets.
938
939 To compile it as a module, choose M here. If unsure, say N.
940
941config NETFILTER_XT_TARGET_NETMAP
942 tristate '"NETMAP" target support'
943 depends on NF_NAT
944 help
945 NETMAP is an implementation of static 1:1 NAT mapping of network
946 addresses. It maps the network address part, while keeping the host
947 address part intact.
948
949 To compile it as a module, choose M here. If unsure, say N.
950
951config NETFILTER_XT_TARGET_NFLOG
952 tristate '"NFLOG" target support'
953 default m if NETFILTER_ADVANCED=n
954 select NETFILTER_NETLINK_LOG
955 help
956 This option enables the NFLOG target, which allows to LOG
957 messages through nfnetlink_log.
958
959 To compile it as a module, choose M here. If unsure, say N.
960
961config NETFILTER_XT_TARGET_NFQUEUE
962 tristate '"NFQUEUE" target Support'
963 depends on NETFILTER_ADVANCED
964 select NETFILTER_NETLINK_QUEUE
965 help
966 This target replaced the old obsolete QUEUE target.
967
968 As opposed to QUEUE, it supports 65535 different queues,
969 not just one.
970
971 To compile it as a module, choose M here. If unsure, say N.
972
973config NETFILTER_XT_TARGET_NOTRACK
974 tristate '"NOTRACK" target support (DEPRECATED)'
975 depends on NF_CONNTRACK
976 depends on IP_NF_RAW || IP6_NF_RAW
977 depends on NETFILTER_ADVANCED
978 select NETFILTER_XT_TARGET_CT
979
980config NETFILTER_XT_TARGET_RATEEST
981 tristate '"RATEEST" target support'
982 depends on NETFILTER_ADVANCED
983 help
984 This option adds a `RATEEST' target, which allows to measure
985 rates similar to TC estimators. The `rateest' match can be
986 used to match on the measured rates.
987
988 To compile it as a module, choose M here. If unsure, say N.
989
990config NETFILTER_XT_TARGET_REDIRECT
991 tristate "REDIRECT target support"
992 depends on NF_NAT
993 select NF_NAT_REDIRECT
994 help
995 REDIRECT is a special case of NAT: all incoming connections are
996 mapped onto the incoming interface's address, causing the packets to
997 come to the local machine instead of passing through. This is
998 useful for transparent proxies.
999
1000 To compile it as a module, choose M here. If unsure, say N.
1001
1002config NETFILTER_XT_TARGET_MASQUERADE
1003 tristate "MASQUERADE target support"
1004 depends on NF_NAT
1005 default m if NETFILTER_ADVANCED=n
1006 select NF_NAT_MASQUERADE
1007 help
1008 Masquerading is a special case of NAT: all outgoing connections are
1009 changed to seem to come from a particular interface's address, and
1010 if the interface goes down, those connections are lost. This is
1011 only useful for dialup accounts with dynamic IP address (ie. your IP
1012 address will be different on next dialup).
1013
1014 To compile it as a module, choose M here. If unsure, say N.
1015
1016config NETFILTER_XT_TARGET_TEE
1017 tristate '"TEE" - packet cloning to alternate destination'
1018 depends on NETFILTER_ADVANCED
1019 depends on IPV6 || IPV6=n
1020 depends on !NF_CONNTRACK || NF_CONNTRACK
1021 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1022 select NF_DUP_IPV4
1023 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1024 help
1025 This option adds a "TEE" target with which a packet can be cloned and
1026 this clone be rerouted to another nexthop.
1027
1028config NETFILTER_XT_TARGET_TPROXY
1029 tristate '"TPROXY" target transparent proxying support'
1030 depends on NETFILTER_XTABLES
1031 depends on NETFILTER_ADVANCED
1032 depends on IPV6 || IPV6=n
1033 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1034 depends on IP_NF_MANGLE
1035 select NF_DEFRAG_IPV4
1036 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1037 select NF_TPROXY_IPV4
1038 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1039 help
1040 This option adds a `TPROXY' target, which is somewhat similar to
1041 REDIRECT. It can only be used in the mangle table and is useful
1042 to redirect traffic to a transparent proxy. It does _not_ depend
1043 on Netfilter connection tracking and NAT, unlike REDIRECT.
1044 For it to work you will have to configure certain iptables rules
1045 and use policy routing. For more information on how to set it up
1046 see Documentation/networking/tproxy.rst.
1047
1048 To compile it as a module, choose M here. If unsure, say N.
1049
1050config NETFILTER_XT_TARGET_TRACE
1051 tristate '"TRACE" target support'
1052 depends on IP_NF_RAW || IP6_NF_RAW
1053 depends on NETFILTER_ADVANCED
1054 help
1055 The TRACE target allows you to mark packets so that the kernel
1056 will log every rule which match the packets as those traverse
1057 the tables, chains, rules.
1058
1059 If you want to compile it as a module, say M here and read
1060 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1061
1062config NETFILTER_XT_TARGET_SECMARK
1063 tristate '"SECMARK" target support'
1064 depends on NETWORK_SECMARK
1065 default m if NETFILTER_ADVANCED=n
1066 help
1067 The SECMARK target allows security marking of network
1068 packets, for use with security subsystems.
1069
1070 To compile it as a module, choose M here. If unsure, say N.
1071
1072config NETFILTER_XT_TARGET_TCPMSS
1073 tristate '"TCPMSS" target support'
1074 depends on IPV6 || IPV6=n
1075 default m if NETFILTER_ADVANCED=n
1076 help
1077 This option adds a `TCPMSS' target, which allows you to alter the
1078 MSS value of TCP SYN packets, to control the maximum size for that
1079 connection (usually limiting it to your outgoing interface's MTU
1080 minus 40).
1081
1082 This is used to overcome criminally braindead ISPs or servers which
1083 block ICMP Fragmentation Needed packets. The symptoms of this
1084 problem are that everything works fine from your Linux
1085 firewall/router, but machines behind it can never exchange large
1086 packets:
1087 1) Web browsers connect, then hang with no data received.
1088 2) Small mail works fine, but large emails hang.
1089 3) ssh works fine, but scp hangs after initial handshaking.
1090
1091 Workaround: activate this option and add a rule to your firewall
1092 configuration like:
1093
1094 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1095 -j TCPMSS --clamp-mss-to-pmtu
1096
1097 To compile it as a module, choose M here. If unsure, say N.
1098
1099config NETFILTER_XT_TARGET_TCPOPTSTRIP
1100 tristate '"TCPOPTSTRIP" target support'
1101 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1102 depends on NETFILTER_ADVANCED
1103 help
1104 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1105 TCP options from TCP packets.
1106
1107
1108
1109comment "Xtables matches"
1110
1111config NETFILTER_XT_MATCH_ADDRTYPE
1112 tristate '"addrtype" address type match support'
1113 default m if NETFILTER_ADVANCED=n
1114 help
1115 This option allows you to match what routing thinks of an address,
1116 eg. UNICAST, LOCAL, BROADCAST, ...
1117
1118 If you want to compile it as a module, say M here and read
1119 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1120
1121config NETFILTER_XT_MATCH_BPF
1122 tristate '"bpf" match support'
1123 depends on NETFILTER_ADVANCED
1124 help
1125 BPF matching applies a linux socket filter to each packet and
1126 accepts those for which the filter returns non-zero.
1127
1128 To compile it as a module, choose M here. If unsure, say N.
1129
1130config NETFILTER_XT_MATCH_CGROUP
1131 tristate '"control group" match support'
1132 depends on NETFILTER_ADVANCED
1133 depends on CGROUPS
1134 select CGROUP_NET_CLASSID
1135 help
1136 Socket/process control group matching allows you to match locally
1137 generated packets based on which net_cls control group processes
1138 belong to.
1139
1140config NETFILTER_XT_MATCH_CLUSTER
1141 tristate '"cluster" match support'
1142 depends on NF_CONNTRACK
1143 depends on NETFILTER_ADVANCED
1144 help
1145 This option allows you to build work-load-sharing clusters of
1146 network servers/stateful firewalls without having a dedicated
1147 load-balancing router/server/switch. Basically, this match returns
1148 true when the packet must be handled by this cluster node. Thus,
1149 all nodes see all packets and this match decides which node handles
1150 what packets. The work-load sharing algorithm is based on source
1151 address hashing.
1152
1153 If you say Y or M here, try `iptables -m cluster --help` for
1154 more information.
1155
1156config NETFILTER_XT_MATCH_COMMENT
1157 tristate '"comment" match support'
1158 depends on NETFILTER_ADVANCED
1159 help
1160 This option adds a `comment' dummy-match, which allows you to put
1161 comments in your iptables ruleset.
1162
1163 If you want to compile it as a module, say M here and read
1164 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1165
1166config NETFILTER_XT_MATCH_CONNBYTES
1167 tristate '"connbytes" per-connection counter match support'
1168 depends on NF_CONNTRACK
1169 depends on NETFILTER_ADVANCED
1170 help
1171 This option adds a `connbytes' match, which allows you to match the
1172 number of bytes and/or packets for each direction within a connection.
1173
1174 If you want to compile it as a module, say M here and read
1175 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1176
1177config NETFILTER_XT_MATCH_CONNLABEL
1178 tristate '"connlabel" match support'
1179 select NF_CONNTRACK_LABELS
1180 depends on NF_CONNTRACK
1181 depends on NETFILTER_ADVANCED
1182 help
1183 This match allows you to test and assign userspace-defined labels names
1184 to a connection. The kernel only stores bit values - mapping
1185 names to bits is done by userspace.
1186
1187 Unlike connmark, more than 32 flag bits may be assigned to a
1188 connection simultaneously.
1189
1190config NETFILTER_XT_MATCH_CONNLIMIT
1191 tristate '"connlimit" match support'
1192 depends on NF_CONNTRACK
1193 depends on NETFILTER_ADVANCED
1194 select NETFILTER_CONNCOUNT
1195 help
1196 This match allows you to match against the number of parallel
1197 connections to a server per client IP address (or address block).
1198
1199config NETFILTER_XT_MATCH_CONNMARK
1200 tristate '"connmark" connection mark match support'
1201 depends on NF_CONNTRACK
1202 depends on NETFILTER_ADVANCED
1203 select NETFILTER_XT_CONNMARK
1204 help
1205 This is a backwards-compat option for the user's convenience
1206 (e.g. when running oldconfig). It selects
1207 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1208
1209config NETFILTER_XT_MATCH_CONNTRACK
1210 tristate '"conntrack" connection tracking match support'
1211 depends on NF_CONNTRACK
1212 default m if NETFILTER_ADVANCED=n
1213 help
1214 This is a general conntrack match module, a superset of the state match.
1215
1216 It allows matching on additional conntrack information, which is
1217 useful in complex configurations, such as NAT gateways with multiple
1218 internet links or tunnels.
1219
1220 To compile it as a module, choose M here. If unsure, say N.
1221
1222config NETFILTER_XT_MATCH_CPU
1223 tristate '"cpu" match support'
1224 depends on NETFILTER_ADVANCED
1225 help
1226 CPU matching allows you to match packets based on the CPU
1227 currently handling the packet.
1228
1229 To compile it as a module, choose M here. If unsure, say N.
1230
1231config NETFILTER_XT_MATCH_DCCP
1232 tristate '"dccp" protocol match support'
1233 depends on NETFILTER_ADVANCED
1234 default IP_DCCP
1235 help
1236 With this option enabled, you will be able to use the iptables
1237 `dccp' match in order to match on DCCP source/destination ports
1238 and DCCP flags.
1239
1240 If you want to compile it as a module, say M here and read
1241 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1242
1243config NETFILTER_XT_MATCH_DEVGROUP
1244 tristate '"devgroup" match support'
1245 depends on NETFILTER_ADVANCED
1246 help
1247 This options adds a `devgroup' match, which allows to match on the
1248 device group a network device is assigned to.
1249
1250 To compile it as a module, choose M here. If unsure, say N.
1251
1252config NETFILTER_XT_MATCH_DSCP
1253 tristate '"dscp" and "tos" match support'
1254 depends on NETFILTER_ADVANCED
1255 help
1256 This option adds a `DSCP' match, which allows you to match against
1257 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1258
1259 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1260
1261 It will also add a "tos" match, which allows you to match packets
1262 based on the Type Of Service fields of the IPv4 packet (which share
1263 the same bits as DSCP).
1264
1265 To compile it as a module, choose M here. If unsure, say N.
1266
1267config NETFILTER_XT_MATCH_ECN
1268 tristate '"ecn" match support'
1269 depends on NETFILTER_ADVANCED
1270 help
1271 This option adds an "ECN" match, which allows you to match against
1272 the IPv4 and TCP header ECN fields.
1273
1274 To compile it as a module, choose M here. If unsure, say N.
1275
1276config NETFILTER_XT_MATCH_ESP
1277 tristate '"esp" match support'
1278 depends on NETFILTER_ADVANCED
1279 help
1280 This match extension allows you to match a range of SPIs
1281 inside ESP header of IPSec packets.
1282
1283 To compile it as a module, choose M here. If unsure, say N.
1284
1285config NETFILTER_XT_MATCH_HASHLIMIT
1286 tristate '"hashlimit" match support'
1287 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1288 depends on NETFILTER_ADVANCED
1289 help
1290 This option adds a `hashlimit' match.
1291
1292 As opposed to `limit', this match dynamically creates a hash table
1293 of limit buckets, based on your selection of source/destination
1294 addresses and/or ports.
1295
1296 It enables you to express policies like `10kpps for any given
1297 destination address' or `500pps from any given source address'
1298 with a single rule.
1299
1300config NETFILTER_XT_MATCH_HELPER
1301 tristate '"helper" match support'
1302 depends on NF_CONNTRACK
1303 depends on NETFILTER_ADVANCED
1304 help
1305 Helper matching allows you to match packets in dynamic connections
1306 tracked by a conntrack-helper, ie. nf_conntrack_ftp
1307
1308 To compile it as a module, choose M here. If unsure, say Y.
1309
1310config NETFILTER_XT_MATCH_HL
1311 tristate '"hl" hoplimit/TTL match support'
1312 depends on NETFILTER_ADVANCED
1313 help
1314 HL matching allows you to match packets based on the hoplimit
1315 in the IPv6 header, or the time-to-live field in the IPv4
1316 header of the packet.
1317
1318config NETFILTER_XT_MATCH_IPCOMP
1319 tristate '"ipcomp" match support'
1320 depends on NETFILTER_ADVANCED
1321 help
1322 This match extension allows you to match a range of CPIs(16 bits)
1323 inside IPComp header of IPSec packets.
1324
1325 To compile it as a module, choose M here. If unsure, say N.
1326
1327config NETFILTER_XT_MATCH_IPRANGE
1328 tristate '"iprange" address range match support'
1329 depends on NETFILTER_ADVANCED
1330 help
1331 This option adds a "iprange" match, which allows you to match based on
1332 an IP address range. (Normal iptables only matches on single addresses
1333 with an optional mask.)
1334
1335 If unsure, say M.
1336
1337config NETFILTER_XT_MATCH_IPVS
1338 tristate '"ipvs" match support'
1339 depends on IP_VS
1340 depends on NETFILTER_ADVANCED
1341 depends on NF_CONNTRACK
1342 help
1343 This option allows you to match against IPVS properties of a packet.
1344
1345 If unsure, say N.
1346
1347config NETFILTER_XT_MATCH_L2TP
1348 tristate '"l2tp" match support'
1349 depends on NETFILTER_ADVANCED
1350 default L2TP
1351 help
1352 This option adds an "L2TP" match, which allows you to match against
1353 L2TP protocol header fields.
1354
1355 To compile it as a module, choose M here. If unsure, say N.
1356
1357config NETFILTER_XT_MATCH_LENGTH
1358 tristate '"length" match support'
1359 depends on NETFILTER_ADVANCED
1360 help
1361 This option allows you to match the length of a packet against a
1362 specific value or range of values.
1363
1364 To compile it as a module, choose M here. If unsure, say N.
1365
1366config NETFILTER_XT_MATCH_LIMIT
1367 tristate '"limit" match support'
1368 depends on NETFILTER_ADVANCED
1369 help
1370 limit matching allows you to control the rate at which a rule can be
1371 matched: mainly useful in combination with the LOG target ("LOG
1372 target support", below) and to avoid some Denial of Service attacks.
1373
1374 To compile it as a module, choose M here. If unsure, say N.
1375
1376config NETFILTER_XT_MATCH_MAC
1377 tristate '"mac" address match support'
1378 depends on NETFILTER_ADVANCED
1379 help
1380 MAC matching allows you to match packets based on the source
1381 Ethernet address of the packet.
1382
1383 To compile it as a module, choose M here. If unsure, say N.
1384
1385config NETFILTER_XT_MATCH_MARK
1386 tristate '"mark" match support'
1387 depends on NETFILTER_ADVANCED
1388 select NETFILTER_XT_MARK
1389 help
1390 This is a backwards-compat option for the user's convenience
1391 (e.g. when running oldconfig). It selects
1392 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1393
1394config NETFILTER_XT_MATCH_MULTIPORT
1395 tristate '"multiport" Multiple port match support'
1396 depends on NETFILTER_ADVANCED
1397 help
1398 Multiport matching allows you to match TCP or UDP packets based on
1399 a series of source or destination ports: normally a rule can only
1400 match a single range of ports.
1401
1402 To compile it as a module, choose M here. If unsure, say N.
1403
1404config NETFILTER_XT_MATCH_NFACCT
1405 tristate '"nfacct" match support'
1406 depends on NETFILTER_ADVANCED
1407 select NETFILTER_NETLINK_ACCT
1408 help
1409 This option allows you to use the extended accounting through
1410 nfnetlink_acct.
1411
1412 To compile it as a module, choose M here. If unsure, say N.
1413
1414config NETFILTER_XT_MATCH_OSF
1415 tristate '"osf" Passive OS fingerprint match'
1416 depends on NETFILTER_ADVANCED
1417 select NETFILTER_NETLINK_OSF
1418 help
1419 This option selects the Passive OS Fingerprinting match module
1420 that allows to passively match the remote operating system by
1421 analyzing incoming TCP SYN packets.
1422
1423 Rules and loading software can be downloaded from
1424 http://www.ioremap.net/projects/osf
1425
1426 To compile it as a module, choose M here. If unsure, say N.
1427
1428config NETFILTER_XT_MATCH_OWNER
1429 tristate '"owner" match support'
1430 depends on NETFILTER_ADVANCED
1431 help
1432 Socket owner matching allows you to match locally-generated packets
1433 based on who created the socket: the user or group. It is also
1434 possible to check whether a socket actually exists.
1435
1436config NETFILTER_XT_MATCH_POLICY
1437 tristate 'IPsec "policy" match support'
1438 depends on XFRM
1439 default m if NETFILTER_ADVANCED=n
1440 help
1441 Policy matching allows you to match packets based on the
1442 IPsec policy that was used during decapsulation/will
1443 be used during encapsulation.
1444
1445 To compile it as a module, choose M here. If unsure, say N.
1446
1447config NETFILTER_XT_MATCH_PHYSDEV
1448 tristate '"physdev" match support'
1449 depends on BRIDGE && BRIDGE_NETFILTER
1450 depends on NETFILTER_ADVANCED
1451 help
1452 Physdev packet matching matches against the physical bridge ports
1453 the IP packet arrived on or will leave by.
1454
1455 To compile it as a module, choose M here. If unsure, say N.
1456
1457config NETFILTER_XT_MATCH_PKTTYPE
1458 tristate '"pkttype" packet type match support'
1459 depends on NETFILTER_ADVANCED
1460 help
1461 Packet type matching allows you to match a packet by
1462 its "class", eg. BROADCAST, MULTICAST, ...
1463
1464 Typical usage:
1465 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1466
1467 To compile it as a module, choose M here. If unsure, say N.
1468
1469config NETFILTER_XT_MATCH_QUOTA
1470 tristate '"quota" match support'
1471 depends on NETFILTER_ADVANCED
1472 help
1473 This option adds a `quota' match, which allows to match on a
1474 byte counter.
1475
1476 If you want to compile it as a module, say M here and read
1477 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1478
1479config NETFILTER_XT_MATCH_RATEEST
1480 tristate '"rateest" match support'
1481 depends on NETFILTER_ADVANCED
1482 select NETFILTER_XT_TARGET_RATEEST
1483 help
1484 This option adds a `rateest' match, which allows to match on the
1485 rate estimated by the RATEEST target.
1486
1487 To compile it as a module, choose M here. If unsure, say N.
1488
1489config NETFILTER_XT_MATCH_REALM
1490 tristate '"realm" match support'
1491 depends on NETFILTER_ADVANCED
1492 select IP_ROUTE_CLASSID
1493 help
1494 This option adds a `realm' match, which allows you to use the realm
1495 key from the routing subsystem inside iptables.
1496
1497 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1498 in tc world.
1499
1500 If you want to compile it as a module, say M here and read
1501 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1502
1503config NETFILTER_XT_MATCH_RECENT
1504 tristate '"recent" match support'
1505 depends on NETFILTER_ADVANCED
1506 help
1507 This match is used for creating one or many lists of recently
1508 used addresses and then matching against that/those list(s).
1509
1510 Short options are available by using 'iptables -m recent -h'
1511 Official Website: <http://snowman.net/projects/ipt_recent/>
1512
1513config NETFILTER_XT_MATCH_SCTP
1514 tristate '"sctp" protocol match support'
1515 depends on NETFILTER_ADVANCED
1516 default IP_SCTP
1517 help
1518 With this option enabled, you will be able to use the
1519 `sctp' match in order to match on SCTP source/destination ports
1520 and SCTP chunk types.
1521
1522 If you want to compile it as a module, say M here and read
1523 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1524
1525config NETFILTER_XT_MATCH_SOCKET
1526 tristate '"socket" match support'
1527 depends on NETFILTER_XTABLES
1528 depends on NETFILTER_ADVANCED
1529 depends on IPV6 || IPV6=n
1530 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1531 select NF_SOCKET_IPV4
1532 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1533 select NF_DEFRAG_IPV4
1534 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1535 help
1536 This option adds a `socket' match, which can be used to match
1537 packets for which a TCP or UDP socket lookup finds a valid socket.
1538 It can be used in combination with the MARK target and policy
1539 routing to implement full featured non-locally bound sockets.
1540
1541 To compile it as a module, choose M here. If unsure, say N.
1542
1543config NETFILTER_XT_MATCH_STATE
1544 tristate '"state" match support'
1545 depends on NF_CONNTRACK
1546 default m if NETFILTER_ADVANCED=n
1547 help
1548 Connection state matching allows you to match packets based on their
1549 relationship to a tracked connection (ie. previous packets). This
1550 is a powerful tool for packet classification.
1551
1552 To compile it as a module, choose M here. If unsure, say N.
1553
1554config NETFILTER_XT_MATCH_STATISTIC
1555 tristate '"statistic" match support'
1556 depends on NETFILTER_ADVANCED
1557 help
1558 This option adds a `statistic' match, which allows you to match
1559 on packets periodically or randomly with a given percentage.
1560
1561 To compile it as a module, choose M here. If unsure, say N.
1562
1563config NETFILTER_XT_MATCH_STRING
1564 tristate '"string" match support'
1565 depends on NETFILTER_ADVANCED
1566 select TEXTSEARCH
1567 select TEXTSEARCH_KMP
1568 select TEXTSEARCH_BM
1569 select TEXTSEARCH_FSM
1570 help
1571 This option adds a `string' match, which allows you to look for
1572 pattern matchings in packets.
1573
1574 To compile it as a module, choose M here. If unsure, say N.
1575
1576config NETFILTER_XT_MATCH_TCPMSS
1577 tristate '"tcpmss" match support'
1578 depends on NETFILTER_ADVANCED
1579 help
1580 This option adds a `tcpmss' match, which allows you to examine the
1581 MSS value of TCP SYN packets, which control the maximum packet size
1582 for that connection.
1583
1584 To compile it as a module, choose M here. If unsure, say N.
1585
1586config NETFILTER_XT_MATCH_TIME
1587 tristate '"time" match support'
1588 depends on NETFILTER_ADVANCED
1589 help
1590 This option adds a "time" match, which allows you to match based on
1591 the packet arrival time (at the machine which netfilter is running)
1592 on) or departure time/date (for locally generated packets).
1593
1594 If you say Y here, try `iptables -m time --help` for
1595 more information.
1596
1597 If you want to compile it as a module, say M here.
1598 If unsure, say N.
1599
1600config NETFILTER_XT_MATCH_U32
1601 tristate '"u32" match support'
1602 depends on NETFILTER_ADVANCED
1603 help
1604 u32 allows you to extract quantities of up to 4 bytes from a packet,
1605 AND them with specified masks, shift them by specified amounts and
1606 test whether the results are in any of a set of specified ranges.
1607 The specification of what to extract is general enough to skip over
1608 headers with lengths stored in the packet, as in IP or TCP header
1609 lengths.
1610
1611 Details and examples are in the kernel module source.
1612
1613endif
1614
1615endmenu
1616
1617source "net/netfilter/ipset/Kconfig"
1618
1619source "net/netfilter/ipvs/Kconfig"
1620
