1
2menu "Core Netfilter Configuration"
3 depends on NET && INET && NETFILTER
4
5config NETFILTER_INGRESS
6 bool "Netfilter ingress support"
7 default y
8 select NET_INGRESS
9 help
10 This allows you to classify packets from ingress using the Netfilter
11 infrastructure.
12
13config NETFILTER_NETLINK
14 tristate
15
16config NETFILTER_FAMILY_BRIDGE
17 bool
18
19config NETFILTER_FAMILY_ARP
20 bool
21
22config NETFILTER_NETLINK_ACCT
23 tristate "Netfilter NFACCT over NFNETLINK interface"
24 depends on NETFILTER_ADVANCED
25 select NETFILTER_NETLINK
26 help
27 If this option is enabled, the kernel will include support
28 for extended accounting via NFNETLINK.
29
30config NETFILTER_NETLINK_QUEUE
31 tristate "Netfilter NFQUEUE over NFNETLINK interface"
32 depends on NETFILTER_ADVANCED
33 select NETFILTER_NETLINK
34 help
35 If this option is enabled, the kernel will include support
36 for queueing packets via NFNETLINK.
37
38config NETFILTER_NETLINK_LOG
39 tristate "Netfilter LOG over NFNETLINK interface"
40 default m if NETFILTER_ADVANCED=n
41 select NETFILTER_NETLINK
42 help
43 If this option is enabled, the kernel will include support
44 for logging packets via NFNETLINK.
45
46 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
47 and is also scheduled to replace the old syslog-based ipt_LOG
48 and ip6t_LOG modules.
49
50config NETFILTER_NETLINK_OSF
51 tristate "Netfilter OSF over NFNETLINK interface"
52 depends on NETFILTER_ADVANCED
53 select NETFILTER_NETLINK
54 help
55 If this option is enabled, the kernel will include support
56 for passive OS fingerprint via NFNETLINK.
57
58config NF_CONNTRACK
59 tristate "Netfilter connection tracking support"
60 default m if NETFILTER_ADVANCED=n
61 select NF_DEFRAG_IPV4
62 select NF_DEFRAG_IPV6 if IPV6 != n
63 help
64 Connection tracking keeps a record of what packets have passed
65 through your machine, in order to figure out how they are related
66 into connections.
67
68 This is required to do Masquerading or other kinds of Network
69 Address Translation. It can also be used to enhance packet
70 filtering (see `Connection state match support' below).
71
72 To compile it as a module, choose M here. If unsure, say N.
73
74config NF_LOG_COMMON
75 tristate
76
77config NF_LOG_NETDEV
78 tristate "Netdev packet logging"
79 select NF_LOG_COMMON
80
81if NF_CONNTRACK
82config NETFILTER_CONNCOUNT
83 tristate
84
85config NF_CONNTRACK_MARK
86 bool 'Connection mark tracking support'
87 depends on NETFILTER_ADVANCED
88 help
89 This option enables support for connection marks, used by the
90 `CONNMARK' target and `connmark' match. Similar to the mark value
91 of packets, but this mark value is kept in the conntrack session
92 instead of the individual packets.
93
94config NF_CONNTRACK_SECMARK
95 bool 'Connection tracking security mark support'
96 depends on NETWORK_SECMARK
97 default m if NETFILTER_ADVANCED=n
98 help
99 This option enables security markings to be applied to
100 connections. Typically they are copied to connections from
101 packets using the CONNSECMARK target and copied back from
102 connections to packets with the same target, with the packets
103 being originally labeled via SECMARK.
104
105 If unsure, say 'N'.
106
107config NF_CONNTRACK_ZONES
108 bool 'Connection tracking zones'
109 depends on NETFILTER_ADVANCED
110 help
111 This option enables support for connection tracking zones.
112 Normally, each connection needs to have a unique system wide
113 identity. Connection tracking zones allow to have multiple
114 connections using the same identity, as long as they are
115 contained in different zones.
116
117 If unsure, say `N'.
118
119config NF_CONNTRACK_PROCFS
120 bool "Supply CT list in procfs (OBSOLETE)"
121 default y
122 depends on PROC_FS
123 ---help---
124 This option enables for the list of known conntrack entries
125 to be shown in procfs under net/netfilter/nf_conntrack. This
126 is considered obsolete in favor of using the conntrack(8)
127 tool which uses Netlink.
128
129config NF_CONNTRACK_EVENTS
130 bool "Connection tracking events"
131 depends on NETFILTER_ADVANCED
132 help
133 If this option is enabled, the connection tracking code will
134 provide a notifier chain that can be used by other kernel code
135 to get notified about changes in the connection tracking state.
136
137 If unsure, say `N'.
138
139config NF_CONNTRACK_TIMEOUT
140 bool 'Connection tracking timeout'
141 depends on NETFILTER_ADVANCED
142 help
143 This option enables support for connection tracking timeout
144 extension. This allows you to attach timeout policies to flow
145 via the CT target.
146
147 If unsure, say `N'.
148
149config NF_CONNTRACK_TIMESTAMP
150 bool 'Connection tracking timestamping'
151 depends on NETFILTER_ADVANCED
152 help
153 This option enables support for connection tracking timestamping.
154 This allows you to store the flow start-time and to obtain
155 the flow-stop time (once it has been destroyed) via Connection
156 tracking events.
157
158 If unsure, say `N'.
159
160config NF_CONNTRACK_LABELS
161 bool "Connection tracking labels"
162 help
163 This option enables support for assigning user-defined flag bits
164 to connection tracking entries. It can be used with xtables connlabel
165 match and the nftables ct expression.
166
167config NF_CT_PROTO_DCCP
168 bool 'DCCP protocol connection tracking support'
169 depends on NETFILTER_ADVANCED
170 default y
171 help
172 With this option enabled, the layer 3 independent connection
173 tracking code will be able to do state tracking on DCCP connections.
174
175 If unsure, say Y.
176
177config NF_CT_PROTO_GRE
178 bool
179
180config NF_CT_PROTO_SCTP
181 bool 'SCTP protocol connection tracking support'
182 depends on NETFILTER_ADVANCED
183 default y
184 select LIBCRC32C
185 help
186 With this option enabled, the layer 3 independent connection
187 tracking code will be able to do state tracking on SCTP connections.
188
189 If unsure, say Y.
190
191config NF_CT_PROTO_UDPLITE
192 bool 'UDP-Lite protocol connection tracking support'
193 depends on NETFILTER_ADVANCED
194 default y
195 help
196 With this option enabled, the layer 3 independent connection
197 tracking code will be able to do state tracking on UDP-Lite
198 connections.
199
200 If unsure, say Y.
201
202config NF_CONNTRACK_AMANDA
203 tristate "Amanda backup protocol support"
204 depends on NETFILTER_ADVANCED
205 select TEXTSEARCH
206 select TEXTSEARCH_KMP
207 help
208 If you are running the Amanda backup package <http://www.amanda.org/>
209 on this machine or machines that will be MASQUERADED through this
210 machine, then you may want to enable this feature. This allows the
211 connection tracking and natting code to allow the sub-channels that
212 Amanda requires for communication of the backup data, messages and
213 index.
214
215 To compile it as a module, choose M here. If unsure, say N.
216
217config NF_CONNTRACK_FTP
218 tristate "FTP protocol support"
219 default m if NETFILTER_ADVANCED=n
220 help
221 Tracking FTP connections is problematic: special helpers are
222 required for tracking them, and doing masquerading and other forms
223 of Network Address Translation on them.
224
225 This is FTP support on Layer 3 independent connection tracking.
226
227 To compile it as a module, choose M here. If unsure, say N.
228
229config NF_CONNTRACK_H323
230 tristate "H.323 protocol support"
231 depends on IPV6 || IPV6=n
232 depends on NETFILTER_ADVANCED
233 help
234 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
235 important VoIP protocols, it is widely used by voice hardware and
236 software including voice gateways, IP phones, Netmeeting, OpenPhone,
237 Gnomemeeting, etc.
238
239 With this module you can support H.323 on a connection tracking/NAT
240 firewall.
241
242 This module supports RAS, Fast Start, H.245 Tunnelling, Call
243 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
244 whiteboard, file transfer, etc. For more information, please
245 visit http://nath323.sourceforge.net/.
246
247 To compile it as a module, choose M here. If unsure, say N.
248
249config NF_CONNTRACK_IRC
250 tristate "IRC protocol support"
251 default m if NETFILTER_ADVANCED=n
252 help
253 There is a commonly-used extension to IRC called
254 Direct Client-to-Client Protocol (DCC). This enables users to send
255 files to each other, and also chat to each other without the need
256 of a server. DCC Sending is used anywhere you send files over IRC,
257 and DCC Chat is most commonly used by Eggdrop bots. If you are
258 using NAT, this extension will enable you to send files and initiate
259 chats. Note that you do NOT need this extension to get files or
260 have others initiate chats, or everything else in IRC.
261
262 To compile it as a module, choose M here. If unsure, say N.
263
264config NF_CONNTRACK_BROADCAST
265 tristate
266
267config NF_CONNTRACK_NETBIOS_NS
268 tristate "NetBIOS name service protocol support"
269 select NF_CONNTRACK_BROADCAST
270 help
271 NetBIOS name service requests are sent as broadcast messages from an
272 unprivileged port and responded to with unicast messages to the
273 same port. This make them hard to firewall properly because connection
274 tracking doesn't deal with broadcasts. This helper tracks locally
275 originating NetBIOS name service requests and the corresponding
276 responses. It relies on correct IP address configuration, specifically
277 netmask and broadcast address. When properly configured, the output
278 of "ip address show" should look similar to this:
279
280 $ ip -4 address show eth0
281 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
282 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
283
284 To compile it as a module, choose M here. If unsure, say N.
285
286config NF_CONNTRACK_SNMP
287 tristate "SNMP service protocol support"
288 depends on NETFILTER_ADVANCED
289 select NF_CONNTRACK_BROADCAST
290 help
291 SNMP service requests are sent as broadcast messages from an
292 unprivileged port and responded to with unicast messages to the
293 same port. This make them hard to firewall properly because connection
294 tracking doesn't deal with broadcasts. This helper tracks locally
295 originating SNMP service requests and the corresponding
296 responses. It relies on correct IP address configuration, specifically
297 netmask and broadcast address.
298
299 To compile it as a module, choose M here. If unsure, say N.
300
301config NF_CONNTRACK_PPTP
302 tristate "PPtP protocol support"
303 depends on NETFILTER_ADVANCED
304 select NF_CT_PROTO_GRE
305 help
306 This module adds support for PPTP (Point to Point Tunnelling
307 Protocol, RFC2637) connection tracking and NAT.
308
309 If you are running PPTP sessions over a stateful firewall or NAT
310 box, you may want to enable this feature.
311
312 Please note that not all PPTP modes of operation are supported yet.
313 Specifically these limitations exist:
314 - Blindly assumes that control connections are always established
315 in PNS->PAC direction. This is a violation of RFC2637.
316 - Only supports a single call within each session
317
318 To compile it as a module, choose M here. If unsure, say N.
319
320config NF_CONNTRACK_SANE
321 tristate "SANE protocol support"
322 depends on NETFILTER_ADVANCED
323 help
324 SANE is a protocol for remote access to scanners as implemented
325 by the 'saned' daemon. Like FTP, it uses separate control and
326 data connections.
327
328 With this module you can support SANE on a connection tracking
329 firewall.
330
331 To compile it as a module, choose M here. If unsure, say N.
332
333config NF_CONNTRACK_SIP
334 tristate "SIP protocol support"
335 default m if NETFILTER_ADVANCED=n
336 help
337 SIP is an application-layer control protocol that can establish,
338 modify, and terminate multimedia sessions (conferences) such as
339 Internet telephony calls. With the nf_conntrack_sip and
340 the nf_nat_sip modules you can support the protocol on a connection
341 tracking/NATing firewall.
342
343 To compile it as a module, choose M here. If unsure, say N.
344
345config NF_CONNTRACK_TFTP
346 tristate "TFTP protocol support"
347 depends on NETFILTER_ADVANCED
348 help
349 TFTP connection tracking helper, this is required depending
350 on how restrictive your ruleset is.
351 If you are using a tftp client behind -j SNAT or -j MASQUERADING
352 you will need this.
353
354 To compile it as a module, choose M here. If unsure, say N.
355
356config NF_CT_NETLINK
357 tristate 'Connection tracking netlink interface'
358 select NETFILTER_NETLINK
359 default m if NETFILTER_ADVANCED=n
360 help
361 This option enables support for a netlink-based userspace interface
362
363config NF_CT_NETLINK_TIMEOUT
364 tristate 'Connection tracking timeout tuning via Netlink'
365 select NETFILTER_NETLINK
366 depends on NETFILTER_ADVANCED
367 depends on NF_CONNTRACK_TIMEOUT
368 help
369 This option enables support for connection tracking timeout
370 fine-grain tuning. This allows you to attach specific timeout
371 policies to flows, instead of using the global timeout policy.
372
373 If unsure, say `N'.
374
375config NF_CT_NETLINK_HELPER
376 tristate 'Connection tracking helpers in user-space via Netlink'
377 select NETFILTER_NETLINK
378 depends on NF_CT_NETLINK
379 depends on NETFILTER_NETLINK_QUEUE
380 depends on NETFILTER_NETLINK_GLUE_CT
381 depends on NETFILTER_ADVANCED
382 help
383 This option enables the user-space connection tracking helpers
384 infrastructure.
385
386 If unsure, say `N'.
387
388config NETFILTER_NETLINK_GLUE_CT
389 bool "NFQUEUE and NFLOG integration with Connection Tracking"
390 default n
391 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
392 help
393 If this option is enabled, NFQUEUE and NFLOG can include
394 Connection Tracking information together with the packet is
395 the enqueued via NFNETLINK.
396
397config NF_NAT
398 tristate "Network Address Translation support"
399 depends on NF_CONNTRACK
400 default m if NETFILTER_ADVANCED=n
401 help
402 The NAT option allows masquerading, port forwarding and other
403 forms of full Network Address Port Translation. This can be
404 controlled by iptables, ip6tables or nft.
405
406config NF_NAT_AMANDA
407 tristate
408 depends on NF_CONNTRACK && NF_NAT
409 default NF_NAT && NF_CONNTRACK_AMANDA
410
411config NF_NAT_FTP
412 tristate
413 depends on NF_CONNTRACK && NF_NAT
414 default NF_NAT && NF_CONNTRACK_FTP
415
416config NF_NAT_IRC
417 tristate
418 depends on NF_CONNTRACK && NF_NAT
419 default NF_NAT && NF_CONNTRACK_IRC
420
421config NF_NAT_SIP
422 tristate
423 depends on NF_CONNTRACK && NF_NAT
424 default NF_NAT && NF_CONNTRACK_SIP
425
426config NF_NAT_TFTP
427 tristate
428 depends on NF_CONNTRACK && NF_NAT
429 default NF_NAT && NF_CONNTRACK_TFTP
430
431config NF_NAT_REDIRECT
432 bool
433
434config NF_NAT_MASQUERADE
435 bool
436
437config NETFILTER_SYNPROXY
438 tristate
439
440endif
441
442config NF_TABLES
443 select NETFILTER_NETLINK
444 tristate "Netfilter nf_tables support"
445 help
446 nftables is the new packet classification framework that intends to
447 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
448 provides a pseudo-state machine with an extensible instruction-set
449 (also known as expressions) that the userspace 'nft' utility
450 (http://www.netfilter.org/projects/nftables) uses to build the
451 rule-set. It also comes with the generic set infrastructure that
452 allows you to construct mappings between matchings and actions
453 for performance lookups.
454
455 To compile it as a module, choose M here.
456
457if NF_TABLES
458
459config NF_TABLES_SET
460 tristate "Netfilter nf_tables set infrastructure"
461 help
462 This option enables the nf_tables set infrastructure that allows to
463 look up for elements in a set and to build one-way mappings between
464 matchings and actions.
465
466config NF_TABLES_INET
467 depends on IPV6
468 select NF_TABLES_IPV4
469 select NF_TABLES_IPV6
470 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
471 help
472 This option enables support for a mixed IPv4/IPv6 "inet" table.
473
474config NF_TABLES_NETDEV
475 bool "Netfilter nf_tables netdev tables support"
476 help
477 This option enables support for the "netdev" table.
478
479config NFT_NUMGEN
480 tristate "Netfilter nf_tables number generator module"
481 help
482 This option adds the number generator expression used to perform
483 incremental counting and random numbers bound to a upper limit.
484
485config NFT_CT
486 depends on NF_CONNTRACK
487 tristate "Netfilter nf_tables conntrack module"
488 help
489 This option adds the "ct" expression that you can use to match
490 connection tracking information such as the flow state.
491
492config NFT_FLOW_OFFLOAD
493 depends on NF_CONNTRACK && NF_FLOW_TABLE
494 tristate "Netfilter nf_tables hardware flow offload module"
495 help
496 This option adds the "flow_offload" expression that you can use to
497 choose what flows are placed into the hardware.
498
499config NFT_COUNTER
500 tristate "Netfilter nf_tables counter module"
501 help
502 This option adds the "counter" expression that you can use to
503 include packet and byte counters in a rule.
504
505config NFT_CONNLIMIT
506 tristate "Netfilter nf_tables connlimit module"
507 depends on NF_CONNTRACK
508 depends on NETFILTER_ADVANCED
509 select NETFILTER_CONNCOUNT
510 help
511 This option adds the "connlimit" expression that you can use to
512 ratelimit rule matchings per connections.
513
514config NFT_LOG
515 tristate "Netfilter nf_tables log module"
516 help
517 This option adds the "log" expression that you can use to log
518 packets matching some criteria.
519
520config NFT_LIMIT
521 tristate "Netfilter nf_tables limit module"
522 help
523 This option adds the "limit" expression that you can use to
524 ratelimit rule matchings.
525
526config NFT_MASQ
527 depends on NF_CONNTRACK
528 depends on NF_NAT
529 select NF_NAT_MASQUERADE
530 tristate "Netfilter nf_tables masquerade support"
531 help
532 This option adds the "masquerade" expression that you can use
533 to perform NAT in the masquerade flavour.
534
535config NFT_REDIR
536 depends on NF_CONNTRACK
537 depends on NF_NAT
538 tristate "Netfilter nf_tables redirect support"
539 select NF_NAT_REDIRECT
540 help
541 This options adds the "redirect" expression that you can use
542 to perform NAT in the redirect flavour.
543
544config NFT_NAT
545 depends on NF_CONNTRACK
546 select NF_NAT
547 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
548 tristate "Netfilter nf_tables nat module"
549 help
550 This option adds the "nat" expression that you can use to perform
551 typical Network Address Translation (NAT) packet transformations.
552
553config NFT_TUNNEL
554 tristate "Netfilter nf_tables tunnel module"
555 help
556 This option adds the "tunnel" expression that you can use to set
557 tunneling policies.
558
559config NFT_OBJREF
560 tristate "Netfilter nf_tables stateful object reference module"
561 help
562 This option adds the "objref" expression that allows you to refer to
563 stateful objects, such as counters and quotas.
564
565config NFT_QUEUE
566 depends on NETFILTER_NETLINK_QUEUE
567 tristate "Netfilter nf_tables queue module"
568 help
569 This is required if you intend to use the userspace queueing
570 infrastructure (also known as NFQUEUE) from nftables.
571
572config NFT_QUOTA
573 tristate "Netfilter nf_tables quota module"
574 help
575 This option adds the "quota" expression that you can use to match
576 enforce bytes quotas.
577
578config NFT_REJECT
579 default m if NETFILTER_ADVANCED=n
580 tristate "Netfilter nf_tables reject support"
581 depends on !NF_TABLES_INET || (IPV6!=m || m)
582 help
583 This option adds the "reject" expression that you can use to
584 explicitly deny and notify via TCP reset/ICMP informational errors
585 unallowed traffic.
586
587config NFT_REJECT_INET
588 depends on NF_TABLES_INET
589 default NFT_REJECT
590 tristate
591
592config NFT_COMPAT
593 depends on NETFILTER_XTABLES
594 tristate "Netfilter x_tables over nf_tables module"
595 help
596 This is required if you intend to use any of existing
597 x_tables match/target extensions over the nf_tables
598 framework.
599
600config NFT_HASH
601 tristate "Netfilter nf_tables hash module"
602 help
603 This option adds the "hash" expression that you can use to perform
604 a hash operation on registers.
605
606config NFT_FIB
607 tristate
608
609config NFT_FIB_INET
610 depends on NF_TABLES_INET
611 depends on NFT_FIB_IPV4
612 depends on NFT_FIB_IPV6
613 tristate "Netfilter nf_tables fib inet support"
614 help
615 This option allows using the FIB expression from the inet table.
616 The lookup will be delegated to the IPv4 or IPv6 FIB depending
617 on the protocol of the packet.
618
619config NFT_XFRM
620 tristate "Netfilter nf_tables xfrm/IPSec security association matching"
621 depends on XFRM
622 help
623 This option adds an expression that you can use to extract properties
624 of a packets security association.
625
626config NFT_SOCKET
627 tristate "Netfilter nf_tables socket match support"
628 depends on IPV6 || IPV6=n
629 select NF_SOCKET_IPV4
630 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
631 help
632 This option allows matching for the presence or absence of a
633 corresponding socket and its attributes.
634
635config NFT_OSF
636 tristate "Netfilter nf_tables passive OS fingerprint support"
637 depends on NETFILTER_ADVANCED
638 select NETFILTER_NETLINK_OSF
639 help
640 This option allows matching packets from an specific OS.
641
642config NFT_TPROXY
643 tristate "Netfilter nf_tables tproxy support"
644 depends on IPV6 || IPV6=n
645 select NF_DEFRAG_IPV4
646 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
647 select NF_TPROXY_IPV4
648 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
649 help
650 This makes transparent proxy support available in nftables.
651
652config NFT_SYNPROXY
653 tristate "Netfilter nf_tables SYNPROXY expression support"
654 depends on NF_CONNTRACK && NETFILTER_ADVANCED
655 select NETFILTER_SYNPROXY
656 select SYN_COOKIES
657 help
658 The SYNPROXY expression allows you to intercept TCP connections and
659 establish them using syncookies before they are passed on to the
660 server. This allows to avoid conntrack and server resource usage
661 during SYN-flood attacks.
662
663if NF_TABLES_NETDEV
664
665config NF_DUP_NETDEV
666 tristate "Netfilter packet duplication support"
667 help
668 This option enables the generic packet duplication infrastructure
669 for Netfilter.
670
671config NFT_DUP_NETDEV
672 tristate "Netfilter nf_tables netdev packet duplication support"
673 select NF_DUP_NETDEV
674 help
675 This option enables packet duplication for the "netdev" family.
676
677config NFT_FWD_NETDEV
678 tristate "Netfilter nf_tables netdev packet forwarding support"
679 select NF_DUP_NETDEV
680 help
681 This option enables packet forwarding for the "netdev" family.
682
683config NFT_FIB_NETDEV
684 depends on NFT_FIB_IPV4
685 depends on NFT_FIB_IPV6
686 tristate "Netfilter nf_tables netdev fib lookups support"
687 help
688 This option allows using the FIB expression from the netdev table.
689 The lookup will be delegated to the IPv4 or IPv6 FIB depending
690 on the protocol of the packet.
691
692endif
693
694endif
695
696config NF_FLOW_TABLE_INET
697 tristate "Netfilter flow table mixed IPv4/IPv6 module"
698 depends on NF_FLOW_TABLE
699 help
700 This option adds the flow table mixed IPv4/IPv6 support.
701
702 To compile it as a module, choose M here.
703
704config NF_FLOW_TABLE
705 tristate "Netfilter flow table module"
706 depends on NETFILTER_INGRESS
707 depends on NF_CONNTRACK
708 depends on NF_TABLES
709 help
710 This option adds the flow table core infrastructure.
711
712 To compile it as a module, choose M here.
713
714config NETFILTER_XTABLES
715 tristate "Netfilter Xtables support (required for ip_tables)"
716 default m if NETFILTER_ADVANCED=n
717 help
718 This is required if you intend to use any of ip_tables,
719 ip6_tables or arp_tables.
720
721if NETFILTER_XTABLES
722
723comment "Xtables combined modules"
724
725config NETFILTER_XT_MARK
726 tristate 'nfmark target and match support'
727 default m if NETFILTER_ADVANCED=n
728 ---help---
729 This option adds the "MARK" target and "mark" match.
730
731 Netfilter mark matching allows you to match packets based on the
732 "nfmark" value in the packet.
733 The target allows you to create rules in the "mangle" table which alter
734 the netfilter mark (nfmark) field associated with the packet.
735
736 Prior to routing, the nfmark can influence the routing method and can
737 also be used by other subsystems to change their behavior.
738
739config NETFILTER_XT_CONNMARK
740 tristate 'ctmark target and match support'
741 depends on NF_CONNTRACK
742 depends on NETFILTER_ADVANCED
743 select NF_CONNTRACK_MARK
744 ---help---
745 This option adds the "CONNMARK" target and "connmark" match.
746
747 Netfilter allows you to store a mark value per connection (a.k.a.
748 ctmark), similarly to the packet mark (nfmark). Using this
749 target and match, you can set and match on this mark.
750
751config NETFILTER_XT_SET
752 tristate 'set target and match support'
753 depends on IP_SET
754 depends on NETFILTER_ADVANCED
755 help
756 This option adds the "SET" target and "set" match.
757
758 Using this target and match, you can add/delete and match
759 elements in the sets created by ipset(8).
760
761 To compile it as a module, choose M here. If unsure, say N.
762
763
764
765comment "Xtables targets"
766
767config NETFILTER_XT_TARGET_AUDIT
768 tristate "AUDIT target support"
769 depends on AUDIT
770 depends on NETFILTER_ADVANCED
771 ---help---
772 This option adds a 'AUDIT' target, which can be used to create
773 audit records for packets dropped/accepted.
774
775 To compileit as a module, choose M here. If unsure, say N.
776
777config NETFILTER_XT_TARGET_CHECKSUM
778 tristate "CHECKSUM target support"
779 depends on IP_NF_MANGLE || IP6_NF_MANGLE
780 depends on NETFILTER_ADVANCED
781 ---help---
782 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
783 table to work around buggy DHCP clients in virtualized environments.
784
785 Some old DHCP clients drop packets because they are not aware
786 that the checksum would normally be offloaded to hardware and
787 thus should be considered valid.
788 This target can be used to fill in the checksum using iptables
789 when such packets are sent via a virtual network device.
790
791 To compile it as a module, choose M here. If unsure, say N.
792
793config NETFILTER_XT_TARGET_CLASSIFY
794 tristate '"CLASSIFY" target support'
795 depends on NETFILTER_ADVANCED
796 help
797 This option adds a `CLASSIFY' target, which enables the user to set
798 the priority of a packet. Some qdiscs can use this value for
799 classification, among these are:
800
801 atm, cbq, dsmark, pfifo_fast, htb, prio
802
803 To compile it as a module, choose M here. If unsure, say N.
804
805config NETFILTER_XT_TARGET_CONNMARK
806 tristate '"CONNMARK" target support'
807 depends on NF_CONNTRACK
808 depends on NETFILTER_ADVANCED
809 select NETFILTER_XT_CONNMARK
810 ---help---
811 This is a backwards-compat option for the user's convenience
812 (e.g. when running oldconfig). It selects
813 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
814
815config NETFILTER_XT_TARGET_CONNSECMARK
816 tristate '"CONNSECMARK" target support'
817 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
818 default m if NETFILTER_ADVANCED=n
819 help
820 The CONNSECMARK target copies security markings from packets
821 to connections, and restores security markings from connections
822 to packets (if the packets are not already marked). This would
823 normally be used in conjunction with the SECMARK target.
824
825 To compile it as a module, choose M here. If unsure, say N.
826
827config NETFILTER_XT_TARGET_CT
828 tristate '"CT" target support'
829 depends on NF_CONNTRACK
830 depends on IP_NF_RAW || IP6_NF_RAW
831 depends on NETFILTER_ADVANCED
832 help
833 This options adds a `CT' target, which allows to specify initial
834 connection tracking parameters like events to be delivered and
835 the helper to be used.
836
837 To compile it as a module, choose M here. If unsure, say N.
838
839config NETFILTER_XT_TARGET_DSCP
840 tristate '"DSCP" and "TOS" target support'
841 depends on IP_NF_MANGLE || IP6_NF_MANGLE
842 depends on NETFILTER_ADVANCED
843 help
844 This option adds a `DSCP' target, which allows you to manipulate
845 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
846
847 The DSCP field can have any value between 0x0 and 0x3f inclusive.
848
849 It also adds the "TOS" target, which allows you to create rules in
850 the "mangle" table which alter the Type Of Service field of an IPv4
851 or the Priority field of an IPv6 packet, prior to routing.
852
853 To compile it as a module, choose M here. If unsure, say N.
854
855config NETFILTER_XT_TARGET_HL
856 tristate '"HL" hoplimit target support'
857 depends on IP_NF_MANGLE || IP6_NF_MANGLE
858 depends on NETFILTER_ADVANCED
859 ---help---
860 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
861 targets, which enable the user to change the
862 hoplimit/time-to-live value of the IP header.
863
864 While it is safe to decrement the hoplimit/TTL value, the
865 modules also allow to increment and set the hoplimit value of
866 the header to arbitrary values. This is EXTREMELY DANGEROUS
867 since you can easily create immortal packets that loop
868 forever on the network.
869
870config NETFILTER_XT_TARGET_HMARK
871 tristate '"HMARK" target support'
872 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
873 depends on NETFILTER_ADVANCED
874 ---help---
875 This option adds the "HMARK" target.
876
877 The target allows you to create rules in the "raw" and "mangle" tables
878 which set the skbuff mark by means of hash calculation within a given
879 range. The nfmark can influence the routing method and can also be used
880 by other subsystems to change their behaviour.
881
882 To compile it as a module, choose M here. If unsure, say N.
883
884config NETFILTER_XT_TARGET_IDLETIMER
885 tristate "IDLETIMER target support"
886 depends on NETFILTER_ADVANCED
887 help
888
889 This option adds the `IDLETIMER' target. Each matching packet
890 resets the timer associated with label specified when the rule is
891 added. When the timer expires, it triggers a sysfs notification.
892 The remaining time for expiration can be read via sysfs.
893
894 To compile it as a module, choose M here. If unsure, say N.
895
896config NETFILTER_XT_TARGET_LED
897 tristate '"LED" target support'
898 depends on LEDS_CLASS && LEDS_TRIGGERS
899 depends on NETFILTER_ADVANCED
900 help
901 This option adds a `LED' target, which allows you to blink LEDs in
902 response to particular packets passing through your machine.
903
904 This can be used to turn a spare LED into a network activity LED,
905 which only flashes in response to FTP transfers, for example. Or
906 you could have an LED which lights up for a minute or two every time
907 somebody connects to your machine via SSH.
908
909 You will need support for the "led" class to make this work.
910
911 To create an LED trigger for incoming SSH traffic:
912 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
913
914 Then attach the new trigger to an LED on your system:
915 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
916
917 For more information on the LEDs available on your system, see
918 Documentation/leds/leds-class.rst
919
920config NETFILTER_XT_TARGET_LOG
921 tristate "LOG target support"
922 select NF_LOG_COMMON
923 select NF_LOG_IPV4
924 select NF_LOG_IPV6 if IP6_NF_IPTABLES
925 default m if NETFILTER_ADVANCED=n
926 help
927 This option adds a `LOG' target, which allows you to create rules in
928 any iptables table which records the packet header to the syslog.
929
930 To compile it as a module, choose M here. If unsure, say N.
931
932config NETFILTER_XT_TARGET_MARK
933 tristate '"MARK" target support'
934 depends on NETFILTER_ADVANCED
935 select NETFILTER_XT_MARK
936 ---help---
937 This is a backwards-compat option for the user's convenience
938 (e.g. when running oldconfig). It selects
939 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
940
941config NETFILTER_XT_NAT
942 tristate '"SNAT and DNAT" targets support'
943 depends on NF_NAT
944 ---help---
945 This option enables the SNAT and DNAT targets.
946
947 To compile it as a module, choose M here. If unsure, say N.
948
949config NETFILTER_XT_TARGET_NETMAP
950 tristate '"NETMAP" target support'
951 depends on NF_NAT
952 ---help---
953 NETMAP is an implementation of static 1:1 NAT mapping of network
954 addresses. It maps the network address part, while keeping the host
955 address part intact.
956
957 To compile it as a module, choose M here. If unsure, say N.
958
959config NETFILTER_XT_TARGET_NFLOG
960 tristate '"NFLOG" target support'
961 default m if NETFILTER_ADVANCED=n
962 select NETFILTER_NETLINK_LOG
963 help
964 This option enables the NFLOG target, which allows to LOG
965 messages through nfnetlink_log.
966
967 To compile it as a module, choose M here. If unsure, say N.
968
969config NETFILTER_XT_TARGET_NFQUEUE
970 tristate '"NFQUEUE" target Support'
971 depends on NETFILTER_ADVANCED
972 select NETFILTER_NETLINK_QUEUE
973 help
974 This target replaced the old obsolete QUEUE target.
975
976 As opposed to QUEUE, it supports 65535 different queues,
977 not just one.
978
979 To compile it as a module, choose M here. If unsure, say N.
980
981config NETFILTER_XT_TARGET_NOTRACK
982 tristate '"NOTRACK" target support (DEPRECATED)'
983 depends on NF_CONNTRACK
984 depends on IP_NF_RAW || IP6_NF_RAW
985 depends on NETFILTER_ADVANCED
986 select NETFILTER_XT_TARGET_CT
987
988config NETFILTER_XT_TARGET_RATEEST
989 tristate '"RATEEST" target support'
990 depends on NETFILTER_ADVANCED
991 help
992 This option adds a `RATEEST' target, which allows to measure
993 rates similar to TC estimators. The `rateest' match can be
994 used to match on the measured rates.
995
996 To compile it as a module, choose M here. If unsure, say N.
997
998config NETFILTER_XT_TARGET_REDIRECT
999 tristate "REDIRECT target support"
1000 depends on NF_NAT
1001 select NF_NAT_REDIRECT
1002 ---help---
1003 REDIRECT is a special case of NAT: all incoming connections are
1004 mapped onto the incoming interface's address, causing the packets to
1005 come to the local machine instead of passing through. This is
1006 useful for transparent proxies.
1007
1008 To compile it as a module, choose M here. If unsure, say N.
1009
1010config NETFILTER_XT_TARGET_MASQUERADE
1011 tristate "MASQUERADE target support"
1012 depends on NF_NAT
1013 default m if NETFILTER_ADVANCED=n
1014 select NF_NAT_MASQUERADE
1015 help
1016 Masquerading is a special case of NAT: all outgoing connections are
1017 changed to seem to come from a particular interface's address, and
1018 if the interface goes down, those connections are lost. This is
1019 only useful for dialup accounts with dynamic IP address (ie. your IP
1020 address will be different on next dialup).
1021
1022 To compile it as a module, choose M here. If unsure, say N.
1023
1024config NETFILTER_XT_TARGET_TEE
1025 tristate '"TEE" - packet cloning to alternate destination'
1026 depends on NETFILTER_ADVANCED
1027 depends on IPV6 || IPV6=n
1028 depends on !NF_CONNTRACK || NF_CONNTRACK
1029 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1030 select NF_DUP_IPV4
1031 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1032 ---help---
1033 This option adds a "TEE" target with which a packet can be cloned and
1034 this clone be rerouted to another nexthop.
1035
1036config NETFILTER_XT_TARGET_TPROXY
1037 tristate '"TPROXY" target transparent proxying support'
1038 depends on NETFILTER_XTABLES
1039 depends on NETFILTER_ADVANCED
1040 depends on IPV6 || IPV6=n
1041 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1042 depends on IP_NF_MANGLE
1043 select NF_DEFRAG_IPV4
1044 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1045 select NF_TPROXY_IPV4
1046 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1047 help
1048 This option adds a `TPROXY' target, which is somewhat similar to
1049 REDIRECT. It can only be used in the mangle table and is useful
1050 to redirect traffic to a transparent proxy. It does _not_ depend
1051 on Netfilter connection tracking and NAT, unlike REDIRECT.
1052 For it to work you will have to configure certain iptables rules
1053 and use policy routing. For more information on how to set it up
1054 see Documentation/networking/tproxy.txt.
1055
1056 To compile it as a module, choose M here. If unsure, say N.
1057
1058config NETFILTER_XT_TARGET_TRACE
1059 tristate '"TRACE" target support'
1060 depends on IP_NF_RAW || IP6_NF_RAW
1061 depends on NETFILTER_ADVANCED
1062 help
1063 The TRACE target allows you to mark packets so that the kernel
1064 will log every rule which match the packets as those traverse
1065 the tables, chains, rules.
1066
1067 If you want to compile it as a module, say M here and read
1068 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1069
1070config NETFILTER_XT_TARGET_SECMARK
1071 tristate '"SECMARK" target support'
1072 depends on NETWORK_SECMARK
1073 default m if NETFILTER_ADVANCED=n
1074 help
1075 The SECMARK target allows security marking of network
1076 packets, for use with security subsystems.
1077
1078 To compile it as a module, choose M here. If unsure, say N.
1079
1080config NETFILTER_XT_TARGET_TCPMSS
1081 tristate '"TCPMSS" target support'
1082 depends on IPV6 || IPV6=n
1083 default m if NETFILTER_ADVANCED=n
1084 ---help---
1085 This option adds a `TCPMSS' target, which allows you to alter the
1086 MSS value of TCP SYN packets, to control the maximum size for that
1087 connection (usually limiting it to your outgoing interface's MTU
1088 minus 40).
1089
1090 This is used to overcome criminally braindead ISPs or servers which
1091 block ICMP Fragmentation Needed packets. The symptoms of this
1092 problem are that everything works fine from your Linux
1093 firewall/router, but machines behind it can never exchange large
1094 packets:
1095 1) Web browsers connect, then hang with no data received.
1096 2) Small mail works fine, but large emails hang.
1097 3) ssh works fine, but scp hangs after initial handshaking.
1098
1099 Workaround: activate this option and add a rule to your firewall
1100 configuration like:
1101
1102 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1103 -j TCPMSS --clamp-mss-to-pmtu
1104
1105 To compile it as a module, choose M here. If unsure, say N.
1106
1107config NETFILTER_XT_TARGET_TCPOPTSTRIP
1108 tristate '"TCPOPTSTRIP" target support'
1109 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1110 depends on NETFILTER_ADVANCED
1111 help
1112 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1113 TCP options from TCP packets.
1114
1115
1116
1117comment "Xtables matches"
1118
1119config NETFILTER_XT_MATCH_ADDRTYPE
1120 tristate '"addrtype" address type match support'
1121 default m if NETFILTER_ADVANCED=n
1122 ---help---
1123 This option allows you to match what routing thinks of an address,
1124 eg. UNICAST, LOCAL, BROADCAST, ...
1125
1126 If you want to compile it as a module, say M here and read
1127 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1128
1129config NETFILTER_XT_MATCH_BPF
1130 tristate '"bpf" match support'
1131 depends on NETFILTER_ADVANCED
1132 help
1133 BPF matching applies a linux socket filter to each packet and
1134 accepts those for which the filter returns non-zero.
1135
1136 To compile it as a module, choose M here. If unsure, say N.
1137
1138config NETFILTER_XT_MATCH_CGROUP
1139 tristate '"control group" match support'
1140 depends on NETFILTER_ADVANCED
1141 depends on CGROUPS
1142 select CGROUP_NET_CLASSID
1143 ---help---
1144 Socket/process control group matching allows you to match locally
1145 generated packets based on which net_cls control group processes
1146 belong to.
1147
1148config NETFILTER_XT_MATCH_CLUSTER
1149 tristate '"cluster" match support'
1150 depends on NF_CONNTRACK
1151 depends on NETFILTER_ADVANCED
1152 ---help---
1153 This option allows you to build work-load-sharing clusters of
1154 network servers/stateful firewalls without having a dedicated
1155 load-balancing router/server/switch. Basically, this match returns
1156 true when the packet must be handled by this cluster node. Thus,
1157 all nodes see all packets and this match decides which node handles
1158 what packets. The work-load sharing algorithm is based on source
1159 address hashing.
1160
1161 If you say Y or M here, try `iptables -m cluster --help` for
1162 more information.
1163
1164config NETFILTER_XT_MATCH_COMMENT
1165 tristate '"comment" match support'
1166 depends on NETFILTER_ADVANCED
1167 help
1168 This option adds a `comment' dummy-match, which allows you to put
1169 comments in your iptables ruleset.
1170
1171 If you want to compile it as a module, say M here and read
1172 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1173
1174config NETFILTER_XT_MATCH_CONNBYTES
1175 tristate '"connbytes" per-connection counter match support'
1176 depends on NF_CONNTRACK
1177 depends on NETFILTER_ADVANCED
1178 help
1179 This option adds a `connbytes' match, which allows you to match the
1180 number of bytes and/or packets for each direction within a connection.
1181
1182 If you want to compile it as a module, say M here and read
1183 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1184
1185config NETFILTER_XT_MATCH_CONNLABEL
1186 tristate '"connlabel" match support'
1187 select NF_CONNTRACK_LABELS
1188 depends on NF_CONNTRACK
1189 depends on NETFILTER_ADVANCED
1190 ---help---
1191 This match allows you to test and assign userspace-defined labels names
1192 to a connection. The kernel only stores bit values - mapping
1193 names to bits is done by userspace.
1194
1195 Unlike connmark, more than 32 flag bits may be assigned to a
1196 connection simultaneously.
1197
1198config NETFILTER_XT_MATCH_CONNLIMIT
1199 tristate '"connlimit" match support'
1200 depends on NF_CONNTRACK
1201 depends on NETFILTER_ADVANCED
1202 select NETFILTER_CONNCOUNT
1203 ---help---
1204 This match allows you to match against the number of parallel
1205 connections to a server per client IP address (or address block).
1206
1207config NETFILTER_XT_MATCH_CONNMARK
1208 tristate '"connmark" connection mark match support'
1209 depends on NF_CONNTRACK
1210 depends on NETFILTER_ADVANCED
1211 select NETFILTER_XT_CONNMARK
1212 ---help---
1213 This is a backwards-compat option for the user's convenience
1214 (e.g. when running oldconfig). It selects
1215 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1216
1217config NETFILTER_XT_MATCH_CONNTRACK
1218 tristate '"conntrack" connection tracking match support'
1219 depends on NF_CONNTRACK
1220 default m if NETFILTER_ADVANCED=n
1221 help
1222 This is a general conntrack match module, a superset of the state match.
1223
1224 It allows matching on additional conntrack information, which is
1225 useful in complex configurations, such as NAT gateways with multiple
1226 internet links or tunnels.
1227
1228 To compile it as a module, choose M here. If unsure, say N.
1229
1230config NETFILTER_XT_MATCH_CPU
1231 tristate '"cpu" match support'
1232 depends on NETFILTER_ADVANCED
1233 help
1234 CPU matching allows you to match packets based on the CPU
1235 currently handling the packet.
1236
1237 To compile it as a module, choose M here. If unsure, say N.
1238
1239config NETFILTER_XT_MATCH_DCCP
1240 tristate '"dccp" protocol match support'
1241 depends on NETFILTER_ADVANCED
1242 default IP_DCCP
1243 help
1244 With this option enabled, you will be able to use the iptables
1245 `dccp' match in order to match on DCCP source/destination ports
1246 and DCCP flags.
1247
1248 If you want to compile it as a module, say M here and read
1249 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1250
1251config NETFILTER_XT_MATCH_DEVGROUP
1252 tristate '"devgroup" match support'
1253 depends on NETFILTER_ADVANCED
1254 help
1255 This options adds a `devgroup' match, which allows to match on the
1256 device group a network device is assigned to.
1257
1258 To compile it as a module, choose M here. If unsure, say N.
1259
1260config NETFILTER_XT_MATCH_DSCP
1261 tristate '"dscp" and "tos" match support'
1262 depends on NETFILTER_ADVANCED
1263 help
1264 This option adds a `DSCP' match, which allows you to match against
1265 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1266
1267 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1268
1269 It will also add a "tos" match, which allows you to match packets
1270 based on the Type Of Service fields of the IPv4 packet (which share
1271 the same bits as DSCP).
1272
1273 To compile it as a module, choose M here. If unsure, say N.
1274
1275config NETFILTER_XT_MATCH_ECN
1276 tristate '"ecn" match support'
1277 depends on NETFILTER_ADVANCED
1278 ---help---
1279 This option adds an "ECN" match, which allows you to match against
1280 the IPv4 and TCP header ECN fields.
1281
1282 To compile it as a module, choose M here. If unsure, say N.
1283
1284config NETFILTER_XT_MATCH_ESP
1285 tristate '"esp" match support'
1286 depends on NETFILTER_ADVANCED
1287 help
1288 This match extension allows you to match a range of SPIs
1289 inside ESP header of IPSec packets.
1290
1291 To compile it as a module, choose M here. If unsure, say N.
1292
1293config NETFILTER_XT_MATCH_HASHLIMIT
1294 tristate '"hashlimit" match support'
1295 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1296 depends on NETFILTER_ADVANCED
1297 help
1298 This option adds a `hashlimit' match.
1299
1300 As opposed to `limit', this match dynamically creates a hash table
1301 of limit buckets, based on your selection of source/destination
1302 addresses and/or ports.
1303
1304 It enables you to express policies like `10kpps for any given
1305 destination address' or `500pps from any given source address'
1306 with a single rule.
1307
1308config NETFILTER_XT_MATCH_HELPER
1309 tristate '"helper" match support'
1310 depends on NF_CONNTRACK
1311 depends on NETFILTER_ADVANCED
1312 help
1313 Helper matching allows you to match packets in dynamic connections
1314 tracked by a conntrack-helper, ie. nf_conntrack_ftp
1315
1316 To compile it as a module, choose M here. If unsure, say Y.
1317
1318config NETFILTER_XT_MATCH_HL
1319 tristate '"hl" hoplimit/TTL match support'
1320 depends on NETFILTER_ADVANCED
1321 ---help---
1322 HL matching allows you to match packets based on the hoplimit
1323 in the IPv6 header, or the time-to-live field in the IPv4
1324 header of the packet.
1325
1326config NETFILTER_XT_MATCH_IPCOMP
1327 tristate '"ipcomp" match support'
1328 depends on NETFILTER_ADVANCED
1329 help
1330 This match extension allows you to match a range of CPIs(16 bits)
1331 inside IPComp header of IPSec packets.
1332
1333 To compile it as a module, choose M here. If unsure, say N.
1334
1335config NETFILTER_XT_MATCH_IPRANGE
1336 tristate '"iprange" address range match support'
1337 depends on NETFILTER_ADVANCED
1338 ---help---
1339 This option adds a "iprange" match, which allows you to match based on
1340 an IP address range. (Normal iptables only matches on single addresses
1341 with an optional mask.)
1342
1343 If unsure, say M.
1344
1345config NETFILTER_XT_MATCH_IPVS
1346 tristate '"ipvs" match support'
1347 depends on IP_VS
1348 depends on NETFILTER_ADVANCED
1349 depends on NF_CONNTRACK
1350 help
1351 This option allows you to match against IPVS properties of a packet.
1352
1353 If unsure, say N.
1354
1355config NETFILTER_XT_MATCH_L2TP
1356 tristate '"l2tp" match support'
1357 depends on NETFILTER_ADVANCED
1358 default L2TP
1359 ---help---
1360 This option adds an "L2TP" match, which allows you to match against
1361 L2TP protocol header fields.
1362
1363 To compile it as a module, choose M here. If unsure, say N.
1364
1365config NETFILTER_XT_MATCH_LENGTH
1366 tristate '"length" match support'
1367 depends on NETFILTER_ADVANCED
1368 help
1369 This option allows you to match the length of a packet against a
1370 specific value or range of values.
1371
1372 To compile it as a module, choose M here. If unsure, say N.
1373
1374config NETFILTER_XT_MATCH_LIMIT
1375 tristate '"limit" match support'
1376 depends on NETFILTER_ADVANCED
1377 help
1378 limit matching allows you to control the rate at which a rule can be
1379 matched: mainly useful in combination with the LOG target ("LOG
1380 target support", below) and to avoid some Denial of Service attacks.
1381
1382 To compile it as a module, choose M here. If unsure, say N.
1383
1384config NETFILTER_XT_MATCH_MAC
1385 tristate '"mac" address match support'
1386 depends on NETFILTER_ADVANCED
1387 help
1388 MAC matching allows you to match packets based on the source
1389 Ethernet address of the packet.
1390
1391 To compile it as a module, choose M here. If unsure, say N.
1392
1393config NETFILTER_XT_MATCH_MARK
1394 tristate '"mark" match support'
1395 depends on NETFILTER_ADVANCED
1396 select NETFILTER_XT_MARK
1397 ---help---
1398 This is a backwards-compat option for the user's convenience
1399 (e.g. when running oldconfig). It selects
1400 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1401
1402config NETFILTER_XT_MATCH_MULTIPORT
1403 tristate '"multiport" Multiple port match support'
1404 depends on NETFILTER_ADVANCED
1405 help
1406 Multiport matching allows you to match TCP or UDP packets based on
1407 a series of source or destination ports: normally a rule can only
1408 match a single range of ports.
1409
1410 To compile it as a module, choose M here. If unsure, say N.
1411
1412config NETFILTER_XT_MATCH_NFACCT
1413 tristate '"nfacct" match support'
1414 depends on NETFILTER_ADVANCED
1415 select NETFILTER_NETLINK_ACCT
1416 help
1417 This option allows you to use the extended accounting through
1418 nfnetlink_acct.
1419
1420 To compile it as a module, choose M here. If unsure, say N.
1421
1422config NETFILTER_XT_MATCH_OSF
1423 tristate '"osf" Passive OS fingerprint match'
1424 depends on NETFILTER_ADVANCED
1425 select NETFILTER_NETLINK_OSF
1426 help
1427 This option selects the Passive OS Fingerprinting match module
1428 that allows to passively match the remote operating system by
1429 analyzing incoming TCP SYN packets.
1430
1431 Rules and loading software can be downloaded from
1432 http://www.ioremap.net/projects/osf
1433
1434 To compile it as a module, choose M here. If unsure, say N.
1435
1436config NETFILTER_XT_MATCH_OWNER
1437 tristate '"owner" match support'
1438 depends on NETFILTER_ADVANCED
1439 ---help---
1440 Socket owner matching allows you to match locally-generated packets
1441 based on who created the socket: the user or group. It is also
1442 possible to check whether a socket actually exists.
1443
1444config NETFILTER_XT_MATCH_POLICY
1445 tristate 'IPsec "policy" match support'
1446 depends on XFRM
1447 default m if NETFILTER_ADVANCED=n
1448 help
1449 Policy matching allows you to match packets based on the
1450 IPsec policy that was used during decapsulation/will
1451 be used during encapsulation.
1452
1453 To compile it as a module, choose M here. If unsure, say N.
1454
1455config NETFILTER_XT_MATCH_PHYSDEV
1456 tristate '"physdev" match support'
1457 depends on BRIDGE && BRIDGE_NETFILTER
1458 depends on NETFILTER_ADVANCED
1459 help
1460 Physdev packet matching matches against the physical bridge ports
1461 the IP packet arrived on or will leave by.
1462
1463 To compile it as a module, choose M here. If unsure, say N.
1464
1465config NETFILTER_XT_MATCH_PKTTYPE
1466 tristate '"pkttype" packet type match support'
1467 depends on NETFILTER_ADVANCED
1468 help
1469 Packet type matching allows you to match a packet by
1470 its "class", eg. BROADCAST, MULTICAST, ...
1471
1472 Typical usage:
1473 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1474
1475 To compile it as a module, choose M here. If unsure, say N.
1476
1477config NETFILTER_XT_MATCH_QUOTA
1478 tristate '"quota" match support'
1479 depends on NETFILTER_ADVANCED
1480 help
1481 This option adds a `quota' match, which allows to match on a
1482 byte counter.
1483
1484 If you want to compile it as a module, say M here and read
1485 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1486
1487config NETFILTER_XT_MATCH_RATEEST
1488 tristate '"rateest" match support'
1489 depends on NETFILTER_ADVANCED
1490 select NETFILTER_XT_TARGET_RATEEST
1491 help
1492 This option adds a `rateest' match, which allows to match on the
1493 rate estimated by the RATEEST target.
1494
1495 To compile it as a module, choose M here. If unsure, say N.
1496
1497config NETFILTER_XT_MATCH_REALM
1498 tristate '"realm" match support'
1499 depends on NETFILTER_ADVANCED
1500 select IP_ROUTE_CLASSID
1501 help
1502 This option adds a `realm' match, which allows you to use the realm
1503 key from the routing subsystem inside iptables.
1504
1505 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1506 in tc world.
1507
1508 If you want to compile it as a module, say M here and read
1509 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1510
1511config NETFILTER_XT_MATCH_RECENT
1512 tristate '"recent" match support'
1513 depends on NETFILTER_ADVANCED
1514 ---help---
1515 This match is used for creating one or many lists of recently
1516 used addresses and then matching against that/those list(s).
1517
1518 Short options are available by using 'iptables -m recent -h'
1519 Official Website: <http://snowman.net/projects/ipt_recent/>
1520
1521config NETFILTER_XT_MATCH_SCTP
1522 tristate '"sctp" protocol match support'
1523 depends on NETFILTER_ADVANCED
1524 default IP_SCTP
1525 help
1526 With this option enabled, you will be able to use the
1527 `sctp' match in order to match on SCTP source/destination ports
1528 and SCTP chunk types.
1529
1530 If you want to compile it as a module, say M here and read
1531 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1532
1533config NETFILTER_XT_MATCH_SOCKET
1534 tristate '"socket" match support'
1535 depends on NETFILTER_XTABLES
1536 depends on NETFILTER_ADVANCED
1537 depends on IPV6 || IPV6=n
1538 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1539 select NF_SOCKET_IPV4
1540 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1541 select NF_DEFRAG_IPV4
1542 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1543 help
1544 This option adds a `socket' match, which can be used to match
1545 packets for which a TCP or UDP socket lookup finds a valid socket.
1546 It can be used in combination with the MARK target and policy
1547 routing to implement full featured non-locally bound sockets.
1548
1549 To compile it as a module, choose M here. If unsure, say N.
1550
1551config NETFILTER_XT_MATCH_STATE
1552 tristate '"state" match support'
1553 depends on NF_CONNTRACK
1554 default m if NETFILTER_ADVANCED=n
1555 help
1556 Connection state matching allows you to match packets based on their
1557 relationship to a tracked connection (ie. previous packets). This
1558 is a powerful tool for packet classification.
1559
1560 To compile it as a module, choose M here. If unsure, say N.
1561
1562config NETFILTER_XT_MATCH_STATISTIC
1563 tristate '"statistic" match support'
1564 depends on NETFILTER_ADVANCED
1565 help
1566 This option adds a `statistic' match, which allows you to match
1567 on packets periodically or randomly with a given percentage.
1568
1569 To compile it as a module, choose M here. If unsure, say N.
1570
1571config NETFILTER_XT_MATCH_STRING
1572 tristate '"string" match support'
1573 depends on NETFILTER_ADVANCED
1574 select TEXTSEARCH
1575 select TEXTSEARCH_KMP
1576 select TEXTSEARCH_BM
1577 select TEXTSEARCH_FSM
1578 help
1579 This option adds a `string' match, which allows you to look for
1580 pattern matchings in packets.
1581
1582 To compile it as a module, choose M here. If unsure, say N.
1583
1584config NETFILTER_XT_MATCH_TCPMSS
1585 tristate '"tcpmss" match support'
1586 depends on NETFILTER_ADVANCED
1587 help
1588 This option adds a `tcpmss' match, which allows you to examine the
1589 MSS value of TCP SYN packets, which control the maximum packet size
1590 for that connection.
1591
1592 To compile it as a module, choose M here. If unsure, say N.
1593
1594config NETFILTER_XT_MATCH_TIME
1595 tristate '"time" match support'
1596 depends on NETFILTER_ADVANCED
1597 ---help---
1598 This option adds a "time" match, which allows you to match based on
1599 the packet arrival time (at the machine which netfilter is running)
1600 on) or departure time/date (for locally generated packets).
1601
1602 If you say Y here, try `iptables -m time --help` for
1603 more information.
1604
1605 If you want to compile it as a module, say M here.
1606 If unsure, say N.
1607
1608config NETFILTER_XT_MATCH_U32
1609 tristate '"u32" match support'
1610 depends on NETFILTER_ADVANCED
1611 ---help---
1612 u32 allows you to extract quantities of up to 4 bytes from a packet,
1613 AND them with specified masks, shift them by specified amounts and
1614 test whether the results are in any of a set of specified ranges.
1615 The specification of what to extract is general enough to skip over
1616 headers with lengths stored in the packet, as in IP or TCP header
1617 lengths.
1618
1619 Details and examples are in the kernel module source.
1620
1621endif
1622
1623endmenu
1624
1625source "net/netfilter/ipset/Kconfig"
1626
1627source "net/netfilter/ipvs/Kconfig"
1628
