1
2menu "Core Netfilter Configuration"
3 depends on INET && NETFILTER
4
5config NETFILTER_INGRESS
6 bool "Netfilter ingress support"
7 default y
8 select NET_INGRESS
9 help
10 This allows you to classify packets from ingress using the Netfilter
11 infrastructure.
12
13config NETFILTER_NETLINK
14 tristate
15
16config NETFILTER_FAMILY_BRIDGE
17 bool
18
19config NETFILTER_FAMILY_ARP
20 bool
21
22config NETFILTER_NETLINK_HOOK
23 tristate "Netfilter base hook dump support"
24 depends on NETFILTER_ADVANCED
25 depends on NF_TABLES
26 select NETFILTER_NETLINK
27 help
28 If this option is enabled, the kernel will include support
29 to list the base netfilter hooks via NFNETLINK.
30 This is helpful for debugging.
31
32config NETFILTER_NETLINK_ACCT
33 tristate "Netfilter NFACCT over NFNETLINK interface"
34 depends on NETFILTER_ADVANCED
35 select NETFILTER_NETLINK
36 help
37 If this option is enabled, the kernel will include support
38 for extended accounting via NFNETLINK.
39
40config NETFILTER_NETLINK_QUEUE
41 tristate "Netfilter NFQUEUE over NFNETLINK interface"
42 depends on NETFILTER_ADVANCED
43 select NETFILTER_NETLINK
44 help
45 If this option is enabled, the kernel will include support
46 for queueing packets via NFNETLINK.
47
48config NETFILTER_NETLINK_LOG
49 tristate "Netfilter LOG over NFNETLINK interface"
50 default m if NETFILTER_ADVANCED=n
51 select NETFILTER_NETLINK
52 help
53 If this option is enabled, the kernel will include support
54 for logging packets via NFNETLINK.
55
56 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
57 and is also scheduled to replace the old syslog-based ipt_LOG
58 and ip6t_LOG modules.
59
60config NETFILTER_NETLINK_OSF
61 tristate "Netfilter OSF over NFNETLINK interface"
62 depends on NETFILTER_ADVANCED
63 select NETFILTER_NETLINK
64 help
65 If this option is enabled, the kernel will include support
66 for passive OS fingerprint via NFNETLINK.
67
68config NF_CONNTRACK
69 tristate "Netfilter connection tracking support"
70 default m if NETFILTER_ADVANCED=n
71 select NF_DEFRAG_IPV4
72 select NF_DEFRAG_IPV6 if IPV6 != n
73 help
74 Connection tracking keeps a record of what packets have passed
75 through your machine, in order to figure out how they are related
76 into connections.
77
78 This is required to do Masquerading or other kinds of Network
79 Address Translation. It can also be used to enhance packet
80 filtering (see `Connection state match support' below).
81
82 To compile it as a module, choose M here. If unsure, say N.
83
84config NF_LOG_SYSLOG
85 tristate "Syslog packet logging"
86 default m if NETFILTER_ADVANCED=n
87 help
88 This option enable support for packet logging via syslog.
89 It supports IPv4, IPV6, ARP and common transport protocols such
90 as TCP and UDP.
91 This is a simpler but less flexible logging method compared to
92 CONFIG_NETFILTER_NETLINK_LOG.
93 If both are enabled the backend to use can be configured at run-time
94 by means of per-address-family sysctl tunables.
95
96if NF_CONNTRACK
97config NETFILTER_CONNCOUNT
98 tristate
99
100config NF_CONNTRACK_MARK
101 bool 'Connection mark tracking support'
102 depends on NETFILTER_ADVANCED
103 help
104 This option enables support for connection marks, used by the
105 `CONNMARK' target and `connmark' match. Similar to the mark value
106 of packets, but this mark value is kept in the conntrack session
107 instead of the individual packets.
108
109config NF_CONNTRACK_SECMARK
110 bool 'Connection tracking security mark support'
111 depends on NETWORK_SECMARK
112 default y if NETFILTER_ADVANCED=n
113 help
114 This option enables security markings to be applied to
115 connections. Typically they are copied to connections from
116 packets using the CONNSECMARK target and copied back from
117 connections to packets with the same target, with the packets
118 being originally labeled via SECMARK.
119
120 If unsure, say 'N'.
121
122config NF_CONNTRACK_ZONES
123 bool 'Connection tracking zones'
124 depends on NETFILTER_ADVANCED
125 help
126 This option enables support for connection tracking zones.
127 Normally, each connection needs to have a unique system wide
128 identity. Connection tracking zones allow to have multiple
129 connections using the same identity, as long as they are
130 contained in different zones.
131
132 If unsure, say `N'.
133
134config NF_CONNTRACK_PROCFS
135 bool "Supply CT list in procfs (OBSOLETE)"
136 default y
137 depends on PROC_FS
138 help
139 This option enables for the list of known conntrack entries
140 to be shown in procfs under net/netfilter/nf_conntrack. This
141 is considered obsolete in favor of using the conntrack(8)
142 tool which uses Netlink.
143
144config NF_CONNTRACK_EVENTS
145 bool "Connection tracking events"
146 depends on NETFILTER_ADVANCED
147 help
148 If this option is enabled, the connection tracking code will
149 provide a notifier chain that can be used by other kernel code
150 to get notified about changes in the connection tracking state.
151
152 If unsure, say `N'.
153
154config NF_CONNTRACK_TIMEOUT
155 bool 'Connection tracking timeout'
156 depends on NETFILTER_ADVANCED
157 help
158 This option enables support for connection tracking timeout
159 extension. This allows you to attach timeout policies to flow
160 via the CT target.
161
162 If unsure, say `N'.
163
164config NF_CONNTRACK_TIMESTAMP
165 bool 'Connection tracking timestamping'
166 depends on NETFILTER_ADVANCED
167 help
168 This option enables support for connection tracking timestamping.
169 This allows you to store the flow start-time and to obtain
170 the flow-stop time (once it has been destroyed) via Connection
171 tracking events.
172
173 If unsure, say `N'.
174
175config NF_CONNTRACK_LABELS
176 bool "Connection tracking labels"
177 help
178 This option enables support for assigning user-defined flag bits
179 to connection tracking entries. It can be used with xtables connlabel
180 match and the nftables ct expression.
181
182config NF_CT_PROTO_DCCP
183 bool 'DCCP protocol connection tracking support'
184 depends on NETFILTER_ADVANCED
185 default y
186 help
187 With this option enabled, the layer 3 independent connection
188 tracking code will be able to do state tracking on DCCP connections.
189
190 If unsure, say Y.
191
192config NF_CT_PROTO_GRE
193 bool
194
195config NF_CT_PROTO_SCTP
196 bool 'SCTP protocol connection tracking support'
197 depends on NETFILTER_ADVANCED
198 default y
199 select LIBCRC32C
200 help
201 With this option enabled, the layer 3 independent connection
202 tracking code will be able to do state tracking on SCTP connections.
203
204 If unsure, say Y.
205
206config NF_CT_PROTO_UDPLITE
207 bool 'UDP-Lite protocol connection tracking support'
208 depends on NETFILTER_ADVANCED
209 default y
210 help
211 With this option enabled, the layer 3 independent connection
212 tracking code will be able to do state tracking on UDP-Lite
213 connections.
214
215 If unsure, say Y.
216
217config NF_CONNTRACK_AMANDA
218 tristate "Amanda backup protocol support"
219 depends on NETFILTER_ADVANCED
220 select TEXTSEARCH
221 select TEXTSEARCH_KMP
222 help
223 If you are running the Amanda backup package <http://www.amanda.org/>
224 on this machine or machines that will be MASQUERADED through this
225 machine, then you may want to enable this feature. This allows the
226 connection tracking and natting code to allow the sub-channels that
227 Amanda requires for communication of the backup data, messages and
228 index.
229
230 To compile it as a module, choose M here. If unsure, say N.
231
232config NF_CONNTRACK_FTP
233 tristate "FTP protocol support"
234 default m if NETFILTER_ADVANCED=n
235 help
236 Tracking FTP connections is problematic: special helpers are
237 required for tracking them, and doing masquerading and other forms
238 of Network Address Translation on them.
239
240 This is FTP support on Layer 3 independent connection tracking.
241
242 To compile it as a module, choose M here. If unsure, say N.
243
244config NF_CONNTRACK_H323
245 tristate "H.323 protocol support"
246 depends on IPV6 || IPV6=n
247 depends on NETFILTER_ADVANCED
248 help
249 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
250 important VoIP protocols, it is widely used by voice hardware and
251 software including voice gateways, IP phones, Netmeeting, OpenPhone,
252 Gnomemeeting, etc.
253
254 With this module you can support H.323 on a connection tracking/NAT
255 firewall.
256
257 This module supports RAS, Fast Start, H.245 Tunnelling, Call
258 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
259 whiteboard, file transfer, etc. For more information, please
260 visit http://nath323.sourceforge.net/.
261
262 To compile it as a module, choose M here. If unsure, say N.
263
264config NF_CONNTRACK_IRC
265 tristate "IRC protocol support"
266 default m if NETFILTER_ADVANCED=n
267 help
268 There is a commonly-used extension to IRC called
269 Direct Client-to-Client Protocol (DCC). This enables users to send
270 files to each other, and also chat to each other without the need
271 of a server. DCC Sending is used anywhere you send files over IRC,
272 and DCC Chat is most commonly used by Eggdrop bots. If you are
273 using NAT, this extension will enable you to send files and initiate
274 chats. Note that you do NOT need this extension to get files or
275 have others initiate chats, or everything else in IRC.
276
277 To compile it as a module, choose M here. If unsure, say N.
278
279config NF_CONNTRACK_BROADCAST
280 tristate
281
282config NF_CONNTRACK_NETBIOS_NS
283 tristate "NetBIOS name service protocol support"
284 select NF_CONNTRACK_BROADCAST
285 help
286 NetBIOS name service requests are sent as broadcast messages from an
287 unprivileged port and responded to with unicast messages to the
288 same port. This make them hard to firewall properly because connection
289 tracking doesn't deal with broadcasts. This helper tracks locally
290 originating NetBIOS name service requests and the corresponding
291 responses. It relies on correct IP address configuration, specifically
292 netmask and broadcast address. When properly configured, the output
293 of "ip address show" should look similar to this:
294
295 $ ip -4 address show eth0
296 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
297 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
298
299 To compile it as a module, choose M here. If unsure, say N.
300
301config NF_CONNTRACK_SNMP
302 tristate "SNMP service protocol support"
303 depends on NETFILTER_ADVANCED
304 select NF_CONNTRACK_BROADCAST
305 help
306 SNMP service requests are sent as broadcast messages from an
307 unprivileged port and responded to with unicast messages to the
308 same port. This make them hard to firewall properly because connection
309 tracking doesn't deal with broadcasts. This helper tracks locally
310 originating SNMP service requests and the corresponding
311 responses. It relies on correct IP address configuration, specifically
312 netmask and broadcast address.
313
314 To compile it as a module, choose M here. If unsure, say N.
315
316config NF_CONNTRACK_PPTP
317 tristate "PPtP protocol support"
318 depends on NETFILTER_ADVANCED
319 select NF_CT_PROTO_GRE
320 help
321 This module adds support for PPTP (Point to Point Tunnelling
322 Protocol, RFC2637) connection tracking and NAT.
323
324 If you are running PPTP sessions over a stateful firewall or NAT
325 box, you may want to enable this feature.
326
327 Please note that not all PPTP modes of operation are supported yet.
328 Specifically these limitations exist:
329 - Blindly assumes that control connections are always established
330 in PNS->PAC direction. This is a violation of RFC2637.
331 - Only supports a single call within each session
332
333 To compile it as a module, choose M here. If unsure, say N.
334
335config NF_CONNTRACK_SANE
336 tristate "SANE protocol support"
337 depends on NETFILTER_ADVANCED
338 help
339 SANE is a protocol for remote access to scanners as implemented
340 by the 'saned' daemon. Like FTP, it uses separate control and
341 data connections.
342
343 With this module you can support SANE on a connection tracking
344 firewall.
345
346 To compile it as a module, choose M here. If unsure, say N.
347
348config NF_CONNTRACK_SIP
349 tristate "SIP protocol support"
350 default m if NETFILTER_ADVANCED=n
351 help
352 SIP is an application-layer control protocol that can establish,
353 modify, and terminate multimedia sessions (conferences) such as
354 Internet telephony calls. With the nf_conntrack_sip and
355 the nf_nat_sip modules you can support the protocol on a connection
356 tracking/NATing firewall.
357
358 To compile it as a module, choose M here. If unsure, say N.
359
360config NF_CONNTRACK_TFTP
361 tristate "TFTP protocol support"
362 depends on NETFILTER_ADVANCED
363 help
364 TFTP connection tracking helper, this is required depending
365 on how restrictive your ruleset is.
366 If you are using a tftp client behind -j SNAT or -j MASQUERADING
367 you will need this.
368
369 To compile it as a module, choose M here. If unsure, say N.
370
371config NF_CT_NETLINK
372 tristate 'Connection tracking netlink interface'
373 select NETFILTER_NETLINK
374 default m if NETFILTER_ADVANCED=n
375 help
376 This option enables support for a netlink-based userspace interface
377
378config NF_CT_NETLINK_TIMEOUT
379 tristate 'Connection tracking timeout tuning via Netlink'
380 select NETFILTER_NETLINK
381 depends on NETFILTER_ADVANCED
382 depends on NF_CONNTRACK_TIMEOUT
383 help
384 This option enables support for connection tracking timeout
385 fine-grain tuning. This allows you to attach specific timeout
386 policies to flows, instead of using the global timeout policy.
387
388 If unsure, say `N'.
389
390config NF_CT_NETLINK_HELPER
391 tristate 'Connection tracking helpers in user-space via Netlink'
392 select NETFILTER_NETLINK
393 depends on NF_CT_NETLINK
394 depends on NETFILTER_NETLINK_QUEUE
395 depends on NETFILTER_NETLINK_GLUE_CT
396 depends on NETFILTER_ADVANCED
397 help
398 This option enables the user-space connection tracking helpers
399 infrastructure.
400
401 If unsure, say `N'.
402
403config NETFILTER_NETLINK_GLUE_CT
404 bool "NFQUEUE and NFLOG integration with Connection Tracking"
405 default n
406 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
407 help
408 If this option is enabled, NFQUEUE and NFLOG can include
409 Connection Tracking information together with the packet is
410 the enqueued via NFNETLINK.
411
412config NF_NAT
413 tristate "Network Address Translation support"
414 depends on NF_CONNTRACK
415 default m if NETFILTER_ADVANCED=n
416 help
417 The NAT option allows masquerading, port forwarding and other
418 forms of full Network Address Port Translation. This can be
419 controlled by iptables, ip6tables or nft.
420
421config NF_NAT_AMANDA
422 tristate
423 depends on NF_CONNTRACK && NF_NAT
424 default NF_NAT && NF_CONNTRACK_AMANDA
425
426config NF_NAT_FTP
427 tristate
428 depends on NF_CONNTRACK && NF_NAT
429 default NF_NAT && NF_CONNTRACK_FTP
430
431config NF_NAT_IRC
432 tristate
433 depends on NF_CONNTRACK && NF_NAT
434 default NF_NAT && NF_CONNTRACK_IRC
435
436config NF_NAT_SIP
437 tristate
438 depends on NF_CONNTRACK && NF_NAT
439 default NF_NAT && NF_CONNTRACK_SIP
440
441config NF_NAT_TFTP
442 tristate
443 depends on NF_CONNTRACK && NF_NAT
444 default NF_NAT && NF_CONNTRACK_TFTP
445
446config NF_NAT_REDIRECT
447 bool
448
449config NF_NAT_MASQUERADE
450 bool
451
452config NETFILTER_SYNPROXY
453 tristate
454
455endif
456
457config NF_TABLES
458 select NETFILTER_NETLINK
459 select LIBCRC32C
460 tristate "Netfilter nf_tables support"
461 help
462 nftables is the new packet classification framework that intends to
463 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
464 provides a pseudo-state machine with an extensible instruction-set
465 (also known as expressions) that the userspace 'nft' utility
466 (https://www.netfilter.org/projects/nftables) uses to build the
467 rule-set. It also comes with the generic set infrastructure that
468 allows you to construct mappings between matchings and actions
469 for performance lookups.
470
471 To compile it as a module, choose M here.
472
473if NF_TABLES
474config NF_TABLES_INET
475 depends on IPV6
476 select NF_TABLES_IPV4
477 select NF_TABLES_IPV6
478 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
479 help
480 This option enables support for a mixed IPv4/IPv6 "inet" table.
481
482config NF_TABLES_NETDEV
483 bool "Netfilter nf_tables netdev tables support"
484 help
485 This option enables support for the "netdev" table.
486
487config NFT_NUMGEN
488 tristate "Netfilter nf_tables number generator module"
489 help
490 This option adds the number generator expression used to perform
491 incremental counting and random numbers bound to a upper limit.
492
493config NFT_CT
494 depends on NF_CONNTRACK
495 tristate "Netfilter nf_tables conntrack module"
496 help
497 This option adds the "ct" expression that you can use to match
498 connection tracking information such as the flow state.
499
500config NFT_FLOW_OFFLOAD
501 depends on NF_CONNTRACK && NF_FLOW_TABLE
502 tristate "Netfilter nf_tables hardware flow offload module"
503 help
504 This option adds the "flow_offload" expression that you can use to
505 choose what flows are placed into the hardware.
506
507config NFT_COUNTER
508 tristate "Netfilter nf_tables counter module"
509 help
510 This option adds the "counter" expression that you can use to
511 include packet and byte counters in a rule.
512
513config NFT_CONNLIMIT
514 tristate "Netfilter nf_tables connlimit module"
515 depends on NF_CONNTRACK
516 depends on NETFILTER_ADVANCED
517 select NETFILTER_CONNCOUNT
518 help
519 This option adds the "connlimit" expression that you can use to
520 ratelimit rule matchings per connections.
521
522config NFT_LOG
523 tristate "Netfilter nf_tables log module"
524 help
525 This option adds the "log" expression that you can use to log
526 packets matching some criteria.
527
528config NFT_LIMIT
529 tristate "Netfilter nf_tables limit module"
530 help
531 This option adds the "limit" expression that you can use to
532 ratelimit rule matchings.
533
534config NFT_MASQ
535 depends on NF_CONNTRACK
536 depends on NF_NAT
537 select NF_NAT_MASQUERADE
538 tristate "Netfilter nf_tables masquerade support"
539 help
540 This option adds the "masquerade" expression that you can use
541 to perform NAT in the masquerade flavour.
542
543config NFT_REDIR
544 depends on NF_CONNTRACK
545 depends on NF_NAT
546 tristate "Netfilter nf_tables redirect support"
547 select NF_NAT_REDIRECT
548 help
549 This options adds the "redirect" expression that you can use
550 to perform NAT in the redirect flavour.
551
552config NFT_NAT
553 depends on NF_CONNTRACK
554 select NF_NAT
555 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
556 tristate "Netfilter nf_tables nat module"
557 help
558 This option adds the "nat" expression that you can use to perform
559 typical Network Address Translation (NAT) packet transformations.
560
561config NFT_TUNNEL
562 tristate "Netfilter nf_tables tunnel module"
563 help
564 This option adds the "tunnel" expression that you can use to set
565 tunneling policies.
566
567config NFT_OBJREF
568 tristate "Netfilter nf_tables stateful object reference module"
569 help
570 This option adds the "objref" expression that allows you to refer to
571 stateful objects, such as counters and quotas.
572
573config NFT_QUEUE
574 depends on NETFILTER_NETLINK_QUEUE
575 tristate "Netfilter nf_tables queue module"
576 help
577 This is required if you intend to use the userspace queueing
578 infrastructure (also known as NFQUEUE) from nftables.
579
580config NFT_QUOTA
581 tristate "Netfilter nf_tables quota module"
582 help
583 This option adds the "quota" expression that you can use to match
584 enforce bytes quotas.
585
586config NFT_REJECT
587 default m if NETFILTER_ADVANCED=n
588 tristate "Netfilter nf_tables reject support"
589 depends on !NF_TABLES_INET || (IPV6!=m || m)
590 help
591 This option adds the "reject" expression that you can use to
592 explicitly deny and notify via TCP reset/ICMP informational errors
593 unallowed traffic.
594
595config NFT_REJECT_INET
596 depends on NF_TABLES_INET
597 default NFT_REJECT
598 tristate
599
600config NFT_COMPAT
601 depends on NETFILTER_XTABLES
602 tristate "Netfilter x_tables over nf_tables module"
603 help
604 This is required if you intend to use any of existing
605 x_tables match/target extensions over the nf_tables
606 framework.
607
608config NFT_HASH
609 tristate "Netfilter nf_tables hash module"
610 help
611 This option adds the "hash" expression that you can use to perform
612 a hash operation on registers.
613
614config NFT_FIB
615 tristate
616
617config NFT_FIB_INET
618 depends on NF_TABLES_INET
619 depends on NFT_FIB_IPV4
620 depends on NFT_FIB_IPV6
621 tristate "Netfilter nf_tables fib inet support"
622 help
623 This option allows using the FIB expression from the inet table.
624 The lookup will be delegated to the IPv4 or IPv6 FIB depending
625 on the protocol of the packet.
626
627config NFT_XFRM
628 tristate "Netfilter nf_tables xfrm/IPSec security association matching"
629 depends on XFRM
630 help
631 This option adds an expression that you can use to extract properties
632 of a packets security association.
633
634config NFT_SOCKET
635 tristate "Netfilter nf_tables socket match support"
636 depends on IPV6 || IPV6=n
637 select NF_SOCKET_IPV4
638 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
639 help
640 This option allows matching for the presence or absence of a
641 corresponding socket and its attributes.
642
643config NFT_OSF
644 tristate "Netfilter nf_tables passive OS fingerprint support"
645 depends on NETFILTER_ADVANCED
646 select NETFILTER_NETLINK_OSF
647 help
648 This option allows matching packets from an specific OS.
649
650config NFT_TPROXY
651 tristate "Netfilter nf_tables tproxy support"
652 depends on IPV6 || IPV6=n
653 select NF_DEFRAG_IPV4
654 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
655 select NF_TPROXY_IPV4
656 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
657 help
658 This makes transparent proxy support available in nftables.
659
660config NFT_SYNPROXY
661 tristate "Netfilter nf_tables SYNPROXY expression support"
662 depends on NF_CONNTRACK && NETFILTER_ADVANCED
663 select NETFILTER_SYNPROXY
664 select SYN_COOKIES
665 help
666 The SYNPROXY expression allows you to intercept TCP connections and
667 establish them using syncookies before they are passed on to the
668 server. This allows to avoid conntrack and server resource usage
669 during SYN-flood attacks.
670
671if NF_TABLES_NETDEV
672
673config NF_DUP_NETDEV
674 tristate "Netfilter packet duplication support"
675 help
676 This option enables the generic packet duplication infrastructure
677 for Netfilter.
678
679config NFT_DUP_NETDEV
680 tristate "Netfilter nf_tables netdev packet duplication support"
681 select NF_DUP_NETDEV
682 help
683 This option enables packet duplication for the "netdev" family.
684
685config NFT_FWD_NETDEV
686 tristate "Netfilter nf_tables netdev packet forwarding support"
687 select NF_DUP_NETDEV
688 help
689 This option enables packet forwarding for the "netdev" family.
690
691config NFT_FIB_NETDEV
692 depends on NFT_FIB_IPV4
693 depends on NFT_FIB_IPV6
694 tristate "Netfilter nf_tables netdev fib lookups support"
695 help
696 This option allows using the FIB expression from the netdev table.
697 The lookup will be delegated to the IPv4 or IPv6 FIB depending
698 on the protocol of the packet.
699
700config NFT_REJECT_NETDEV
701 depends on NFT_REJECT_IPV4
702 depends on NFT_REJECT_IPV6
703 tristate "Netfilter nf_tables netdev REJECT support"
704 help
705 This option enables the REJECT support from the netdev table.
706 The return packet generation will be delegated to the IPv4
707 or IPv6 ICMP or TCP RST implementation depending on the
708 protocol of the packet.
709
710endif
711
712endif
713
714config NF_FLOW_TABLE_INET
715 tristate "Netfilter flow table mixed IPv4/IPv6 module"
716 depends on NF_FLOW_TABLE
717 help
718 This option adds the flow table mixed IPv4/IPv6 support.
719
720 To compile it as a module, choose M here.
721
722config NF_FLOW_TABLE
723 tristate "Netfilter flow table module"
724 depends on NETFILTER_INGRESS
725 depends on NF_CONNTRACK
726 depends on NF_TABLES
727 help
728 This option adds the flow table core infrastructure.
729
730 To compile it as a module, choose M here.
731
732config NETFILTER_XTABLES
733 tristate "Netfilter Xtables support (required for ip_tables)"
734 default m if NETFILTER_ADVANCED=n
735 help
736 This is required if you intend to use any of ip_tables,
737 ip6_tables or arp_tables.
738
739if NETFILTER_XTABLES
740
741config NETFILTER_XTABLES_COMPAT
742 bool "Netfilter Xtables 32bit support"
743 depends on COMPAT
744 default y
745 help
746 This option provides a translation layer to run 32bit arp,ip(6),ebtables
747 binaries on 64bit kernels.
748
749 If unsure, say N.
750
751comment "Xtables combined modules"
752
753config NETFILTER_XT_MARK
754 tristate 'nfmark target and match support'
755 default m if NETFILTER_ADVANCED=n
756 help
757 This option adds the "MARK" target and "mark" match.
758
759 Netfilter mark matching allows you to match packets based on the
760 "nfmark" value in the packet.
761 The target allows you to create rules in the "mangle" table which alter
762 the netfilter mark (nfmark) field associated with the packet.
763
764 Prior to routing, the nfmark can influence the routing method and can
765 also be used by other subsystems to change their behavior.
766
767config NETFILTER_XT_CONNMARK
768 tristate 'ctmark target and match support'
769 depends on NF_CONNTRACK
770 depends on NETFILTER_ADVANCED
771 select NF_CONNTRACK_MARK
772 help
773 This option adds the "CONNMARK" target and "connmark" match.
774
775 Netfilter allows you to store a mark value per connection (a.k.a.
776 ctmark), similarly to the packet mark (nfmark). Using this
777 target and match, you can set and match on this mark.
778
779config NETFILTER_XT_SET
780 tristate 'set target and match support'
781 depends on IP_SET
782 depends on NETFILTER_ADVANCED
783 help
784 This option adds the "SET" target and "set" match.
785
786 Using this target and match, you can add/delete and match
787 elements in the sets created by ipset(8).
788
789 To compile it as a module, choose M here. If unsure, say N.
790
791
792
793comment "Xtables targets"
794
795config NETFILTER_XT_TARGET_AUDIT
796 tristate "AUDIT target support"
797 depends on AUDIT
798 depends on NETFILTER_ADVANCED
799 help
800 This option adds a 'AUDIT' target, which can be used to create
801 audit records for packets dropped/accepted.
802
803 To compileit as a module, choose M here. If unsure, say N.
804
805config NETFILTER_XT_TARGET_CHECKSUM
806 tristate "CHECKSUM target support"
807 depends on IP_NF_MANGLE || IP6_NF_MANGLE
808 depends on NETFILTER_ADVANCED
809 help
810 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
811 table to work around buggy DHCP clients in virtualized environments.
812
813 Some old DHCP clients drop packets because they are not aware
814 that the checksum would normally be offloaded to hardware and
815 thus should be considered valid.
816 This target can be used to fill in the checksum using iptables
817 when such packets are sent via a virtual network device.
818
819 To compile it as a module, choose M here. If unsure, say N.
820
821config NETFILTER_XT_TARGET_CLASSIFY
822 tristate '"CLASSIFY" target support'
823 depends on NETFILTER_ADVANCED
824 help
825 This option adds a `CLASSIFY' target, which enables the user to set
826 the priority of a packet. Some qdiscs can use this value for
827 classification, among these are:
828
829 atm, cbq, dsmark, pfifo_fast, htb, prio
830
831 To compile it as a module, choose M here. If unsure, say N.
832
833config NETFILTER_XT_TARGET_CONNMARK
834 tristate '"CONNMARK" target support'
835 depends on NF_CONNTRACK
836 depends on NETFILTER_ADVANCED
837 select NETFILTER_XT_CONNMARK
838 help
839 This is a backwards-compat option for the user's convenience
840 (e.g. when running oldconfig). It selects
841 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
842
843config NETFILTER_XT_TARGET_CONNSECMARK
844 tristate '"CONNSECMARK" target support'
845 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
846 default m if NETFILTER_ADVANCED=n
847 help
848 The CONNSECMARK target copies security markings from packets
849 to connections, and restores security markings from connections
850 to packets (if the packets are not already marked). This would
851 normally be used in conjunction with the SECMARK target.
852
853 To compile it as a module, choose M here. If unsure, say N.
854
855config NETFILTER_XT_TARGET_CT
856 tristate '"CT" target support'
857 depends on NF_CONNTRACK
858 depends on IP_NF_RAW || IP6_NF_RAW
859 depends on NETFILTER_ADVANCED
860 help
861 This options adds a `CT' target, which allows to specify initial
862 connection tracking parameters like events to be delivered and
863 the helper to be used.
864
865 To compile it as a module, choose M here. If unsure, say N.
866
867config NETFILTER_XT_TARGET_DSCP
868 tristate '"DSCP" and "TOS" target support'
869 depends on IP_NF_MANGLE || IP6_NF_MANGLE
870 depends on NETFILTER_ADVANCED
871 help
872 This option adds a `DSCP' target, which allows you to manipulate
873 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
874
875 The DSCP field can have any value between 0x0 and 0x3f inclusive.
876
877 It also adds the "TOS" target, which allows you to create rules in
878 the "mangle" table which alter the Type Of Service field of an IPv4
879 or the Priority field of an IPv6 packet, prior to routing.
880
881 To compile it as a module, choose M here. If unsure, say N.
882
883config NETFILTER_XT_TARGET_HL
884 tristate '"HL" hoplimit target support'
885 depends on IP_NF_MANGLE || IP6_NF_MANGLE
886 depends on NETFILTER_ADVANCED
887 help
888 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
889 targets, which enable the user to change the
890 hoplimit/time-to-live value of the IP header.
891
892 While it is safe to decrement the hoplimit/TTL value, the
893 modules also allow to increment and set the hoplimit value of
894 the header to arbitrary values. This is EXTREMELY DANGEROUS
895 since you can easily create immortal packets that loop
896 forever on the network.
897
898config NETFILTER_XT_TARGET_HMARK
899 tristate '"HMARK" target support'
900 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
901 depends on NETFILTER_ADVANCED
902 help
903 This option adds the "HMARK" target.
904
905 The target allows you to create rules in the "raw" and "mangle" tables
906 which set the skbuff mark by means of hash calculation within a given
907 range. The nfmark can influence the routing method and can also be used
908 by other subsystems to change their behaviour.
909
910 To compile it as a module, choose M here. If unsure, say N.
911
912config NETFILTER_XT_TARGET_IDLETIMER
913 tristate "IDLETIMER target support"
914 depends on NETFILTER_ADVANCED
915 help
916
917 This option adds the `IDLETIMER' target. Each matching packet
918 resets the timer associated with label specified when the rule is
919 added. When the timer expires, it triggers a sysfs notification.
920 The remaining time for expiration can be read via sysfs.
921
922 To compile it as a module, choose M here. If unsure, say N.
923
924config NETFILTER_XT_TARGET_LED
925 tristate '"LED" target support'
926 depends on LEDS_CLASS && LEDS_TRIGGERS
927 depends on NETFILTER_ADVANCED
928 help
929 This option adds a `LED' target, which allows you to blink LEDs in
930 response to particular packets passing through your machine.
931
932 This can be used to turn a spare LED into a network activity LED,
933 which only flashes in response to FTP transfers, for example. Or
934 you could have an LED which lights up for a minute or two every time
935 somebody connects to your machine via SSH.
936
937 You will need support for the "led" class to make this work.
938
939 To create an LED trigger for incoming SSH traffic:
940 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
941
942 Then attach the new trigger to an LED on your system:
943 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
944
945 For more information on the LEDs available on your system, see
946 Documentation/leds/leds-class.rst
947
948config NETFILTER_XT_TARGET_LOG
949 tristate "LOG target support"
950 select NF_LOG_SYSLOG
951 select NF_LOG_IPV6 if IP6_NF_IPTABLES
952 default m if NETFILTER_ADVANCED=n
953 help
954 This option adds a `LOG' target, which allows you to create rules in
955 any iptables table which records the packet header to the syslog.
956
957 To compile it as a module, choose M here. If unsure, say N.
958
959config NETFILTER_XT_TARGET_MARK
960 tristate '"MARK" target support'
961 depends on NETFILTER_ADVANCED
962 select NETFILTER_XT_MARK
963 help
964 This is a backwards-compat option for the user's convenience
965 (e.g. when running oldconfig). It selects
966 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
967
968config NETFILTER_XT_NAT
969 tristate '"SNAT and DNAT" targets support'
970 depends on NF_NAT
971 help
972 This option enables the SNAT and DNAT targets.
973
974 To compile it as a module, choose M here. If unsure, say N.
975
976config NETFILTER_XT_TARGET_NETMAP
977 tristate '"NETMAP" target support'
978 depends on NF_NAT
979 help
980 NETMAP is an implementation of static 1:1 NAT mapping of network
981 addresses. It maps the network address part, while keeping the host
982 address part intact.
983
984 To compile it as a module, choose M here. If unsure, say N.
985
986config NETFILTER_XT_TARGET_NFLOG
987 tristate '"NFLOG" target support'
988 default m if NETFILTER_ADVANCED=n
989 select NETFILTER_NETLINK_LOG
990 help
991 This option enables the NFLOG target, which allows to LOG
992 messages through nfnetlink_log.
993
994 To compile it as a module, choose M here. If unsure, say N.
995
996config NETFILTER_XT_TARGET_NFQUEUE
997 tristate '"NFQUEUE" target Support'
998 depends on NETFILTER_ADVANCED
999 select NETFILTER_NETLINK_QUEUE
1000 help
1001 This target replaced the old obsolete QUEUE target.
1002
1003 As opposed to QUEUE, it supports 65535 different queues,
1004 not just one.
1005
1006 To compile it as a module, choose M here. If unsure, say N.
1007
1008config NETFILTER_XT_TARGET_NOTRACK
1009 tristate '"NOTRACK" target support (DEPRECATED)'
1010 depends on NF_CONNTRACK
1011 depends on IP_NF_RAW || IP6_NF_RAW
1012 depends on NETFILTER_ADVANCED
1013 select NETFILTER_XT_TARGET_CT
1014
1015config NETFILTER_XT_TARGET_RATEEST
1016 tristate '"RATEEST" target support'
1017 depends on NETFILTER_ADVANCED
1018 help
1019 This option adds a `RATEEST' target, which allows to measure
1020 rates similar to TC estimators. The `rateest' match can be
1021 used to match on the measured rates.
1022
1023 To compile it as a module, choose M here. If unsure, say N.
1024
1025config NETFILTER_XT_TARGET_REDIRECT
1026 tristate "REDIRECT target support"
1027 depends on NF_NAT
1028 select NF_NAT_REDIRECT
1029 help
1030 REDIRECT is a special case of NAT: all incoming connections are
1031 mapped onto the incoming interface's address, causing the packets to
1032 come to the local machine instead of passing through. This is
1033 useful for transparent proxies.
1034
1035 To compile it as a module, choose M here. If unsure, say N.
1036
1037config NETFILTER_XT_TARGET_MASQUERADE
1038 tristate "MASQUERADE target support"
1039 depends on NF_NAT
1040 default m if NETFILTER_ADVANCED=n
1041 select NF_NAT_MASQUERADE
1042 help
1043 Masquerading is a special case of NAT: all outgoing connections are
1044 changed to seem to come from a particular interface's address, and
1045 if the interface goes down, those connections are lost. This is
1046 only useful for dialup accounts with dynamic IP address (ie. your IP
1047 address will be different on next dialup).
1048
1049 To compile it as a module, choose M here. If unsure, say N.
1050
1051config NETFILTER_XT_TARGET_TEE
1052 tristate '"TEE" - packet cloning to alternate destination'
1053 depends on NETFILTER_ADVANCED
1054 depends on IPV6 || IPV6=n
1055 depends on !NF_CONNTRACK || NF_CONNTRACK
1056 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1057 select NF_DUP_IPV4
1058 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1059 help
1060 This option adds a "TEE" target with which a packet can be cloned and
1061 this clone be rerouted to another nexthop.
1062
1063config NETFILTER_XT_TARGET_TPROXY
1064 tristate '"TPROXY" target transparent proxying support'
1065 depends on NETFILTER_XTABLES
1066 depends on NETFILTER_ADVANCED
1067 depends on IPV6 || IPV6=n
1068 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1069 depends on IP_NF_MANGLE
1070 select NF_DEFRAG_IPV4
1071 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1072 select NF_TPROXY_IPV4
1073 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1074 help
1075 This option adds a `TPROXY' target, which is somewhat similar to
1076 REDIRECT. It can only be used in the mangle table and is useful
1077 to redirect traffic to a transparent proxy. It does _not_ depend
1078 on Netfilter connection tracking and NAT, unlike REDIRECT.
1079 For it to work you will have to configure certain iptables rules
1080 and use policy routing. For more information on how to set it up
1081 see Documentation/networking/tproxy.rst.
1082
1083 To compile it as a module, choose M here. If unsure, say N.
1084
1085config NETFILTER_XT_TARGET_TRACE
1086 tristate '"TRACE" target support'
1087 depends on IP_NF_RAW || IP6_NF_RAW
1088 depends on NETFILTER_ADVANCED
1089 help
1090 The TRACE target allows you to mark packets so that the kernel
1091 will log every rule which match the packets as those traverse
1092 the tables, chains, rules.
1093
1094 If you want to compile it as a module, say M here and read
1095 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1096
1097config NETFILTER_XT_TARGET_SECMARK
1098 tristate '"SECMARK" target support'
1099 depends on NETWORK_SECMARK
1100 default m if NETFILTER_ADVANCED=n
1101 help
1102 The SECMARK target allows security marking of network
1103 packets, for use with security subsystems.
1104
1105 To compile it as a module, choose M here. If unsure, say N.
1106
1107config NETFILTER_XT_TARGET_TCPMSS
1108 tristate '"TCPMSS" target support'
1109 depends on IPV6 || IPV6=n
1110 default m if NETFILTER_ADVANCED=n
1111 help
1112 This option adds a `TCPMSS' target, which allows you to alter the
1113 MSS value of TCP SYN packets, to control the maximum size for that
1114 connection (usually limiting it to your outgoing interface's MTU
1115 minus 40).
1116
1117 This is used to overcome criminally braindead ISPs or servers which
1118 block ICMP Fragmentation Needed packets. The symptoms of this
1119 problem are that everything works fine from your Linux
1120 firewall/router, but machines behind it can never exchange large
1121 packets:
1122 1) Web browsers connect, then hang with no data received.
1123 2) Small mail works fine, but large emails hang.
1124 3) ssh works fine, but scp hangs after initial handshaking.
1125
1126 Workaround: activate this option and add a rule to your firewall
1127 configuration like:
1128
1129 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1130 -j TCPMSS --clamp-mss-to-pmtu
1131
1132 To compile it as a module, choose M here. If unsure, say N.
1133
1134config NETFILTER_XT_TARGET_TCPOPTSTRIP
1135 tristate '"TCPOPTSTRIP" target support'
1136 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1137 depends on NETFILTER_ADVANCED
1138 help
1139 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1140 TCP options from TCP packets.
1141
1142
1143
1144comment "Xtables matches"
1145
1146config NETFILTER_XT_MATCH_ADDRTYPE
1147 tristate '"addrtype" address type match support'
1148 default m if NETFILTER_ADVANCED=n
1149 help
1150 This option allows you to match what routing thinks of an address,
1151 eg. UNICAST, LOCAL, BROADCAST, ...
1152
1153 If you want to compile it as a module, say M here and read
1154 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1155
1156config NETFILTER_XT_MATCH_BPF
1157 tristate '"bpf" match support'
1158 depends on NETFILTER_ADVANCED
1159 help
1160 BPF matching applies a linux socket filter to each packet and
1161 accepts those for which the filter returns non-zero.
1162
1163 To compile it as a module, choose M here. If unsure, say N.
1164
1165config NETFILTER_XT_MATCH_CGROUP
1166 tristate '"control group" match support'
1167 depends on NETFILTER_ADVANCED
1168 depends on CGROUPS
1169 select CGROUP_NET_CLASSID
1170 help
1171 Socket/process control group matching allows you to match locally
1172 generated packets based on which net_cls control group processes
1173 belong to.
1174
1175config NETFILTER_XT_MATCH_CLUSTER
1176 tristate '"cluster" match support'
1177 depends on NF_CONNTRACK
1178 depends on NETFILTER_ADVANCED
1179 help
1180 This option allows you to build work-load-sharing clusters of
1181 network servers/stateful firewalls without having a dedicated
1182 load-balancing router/server/switch. Basically, this match returns
1183 true when the packet must be handled by this cluster node. Thus,
1184 all nodes see all packets and this match decides which node handles
1185 what packets. The work-load sharing algorithm is based on source
1186 address hashing.
1187
1188 If you say Y or M here, try `iptables -m cluster --help` for
1189 more information.
1190
1191config NETFILTER_XT_MATCH_COMMENT
1192 tristate '"comment" match support'
1193 depends on NETFILTER_ADVANCED
1194 help
1195 This option adds a `comment' dummy-match, which allows you to put
1196 comments in your iptables ruleset.
1197
1198 If you want to compile it as a module, say M here and read
1199 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1200
1201config NETFILTER_XT_MATCH_CONNBYTES
1202 tristate '"connbytes" per-connection counter match support'
1203 depends on NF_CONNTRACK
1204 depends on NETFILTER_ADVANCED
1205 help
1206 This option adds a `connbytes' match, which allows you to match the
1207 number of bytes and/or packets for each direction within a connection.
1208
1209 If you want to compile it as a module, say M here and read
1210 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1211
1212config NETFILTER_XT_MATCH_CONNLABEL
1213 tristate '"connlabel" match support'
1214 select NF_CONNTRACK_LABELS
1215 depends on NF_CONNTRACK
1216 depends on NETFILTER_ADVANCED
1217 help
1218 This match allows you to test and assign userspace-defined labels names
1219 to a connection. The kernel only stores bit values - mapping
1220 names to bits is done by userspace.
1221
1222 Unlike connmark, more than 32 flag bits may be assigned to a
1223 connection simultaneously.
1224
1225config NETFILTER_XT_MATCH_CONNLIMIT
1226 tristate '"connlimit" match support'
1227 depends on NF_CONNTRACK
1228 depends on NETFILTER_ADVANCED
1229 select NETFILTER_CONNCOUNT
1230 help
1231 This match allows you to match against the number of parallel
1232 connections to a server per client IP address (or address block).
1233
1234config NETFILTER_XT_MATCH_CONNMARK
1235 tristate '"connmark" connection mark match support'
1236 depends on NF_CONNTRACK
1237 depends on NETFILTER_ADVANCED
1238 select NETFILTER_XT_CONNMARK
1239 help
1240 This is a backwards-compat option for the user's convenience
1241 (e.g. when running oldconfig). It selects
1242 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1243
1244config NETFILTER_XT_MATCH_CONNTRACK
1245 tristate '"conntrack" connection tracking match support'
1246 depends on NF_CONNTRACK
1247 default m if NETFILTER_ADVANCED=n
1248 help
1249 This is a general conntrack match module, a superset of the state match.
1250
1251 It allows matching on additional conntrack information, which is
1252 useful in complex configurations, such as NAT gateways with multiple
1253 internet links or tunnels.
1254
1255 To compile it as a module, choose M here. If unsure, say N.
1256
1257config NETFILTER_XT_MATCH_CPU
1258 tristate '"cpu" match support'
1259 depends on NETFILTER_ADVANCED
1260 help
1261 CPU matching allows you to match packets based on the CPU
1262 currently handling the packet.
1263
1264 To compile it as a module, choose M here. If unsure, say N.
1265
1266config NETFILTER_XT_MATCH_DCCP
1267 tristate '"dccp" protocol match support'
1268 depends on NETFILTER_ADVANCED
1269 default IP_DCCP
1270 help
1271 With this option enabled, you will be able to use the iptables
1272 `dccp' match in order to match on DCCP source/destination ports
1273 and DCCP flags.
1274
1275 If you want to compile it as a module, say M here and read
1276 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1277
1278config NETFILTER_XT_MATCH_DEVGROUP
1279 tristate '"devgroup" match support'
1280 depends on NETFILTER_ADVANCED
1281 help
1282 This options adds a `devgroup' match, which allows to match on the
1283 device group a network device is assigned to.
1284
1285 To compile it as a module, choose M here. If unsure, say N.
1286
1287config NETFILTER_XT_MATCH_DSCP
1288 tristate '"dscp" and "tos" match support'
1289 depends on NETFILTER_ADVANCED
1290 help
1291 This option adds a `DSCP' match, which allows you to match against
1292 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1293
1294 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1295
1296 It will also add a "tos" match, which allows you to match packets
1297 based on the Type Of Service fields of the IPv4 packet (which share
1298 the same bits as DSCP).
1299
1300 To compile it as a module, choose M here. If unsure, say N.
1301
1302config NETFILTER_XT_MATCH_ECN
1303 tristate '"ecn" match support'
1304 depends on NETFILTER_ADVANCED
1305 help
1306 This option adds an "ECN" match, which allows you to match against
1307 the IPv4 and TCP header ECN fields.
1308
1309 To compile it as a module, choose M here. If unsure, say N.
1310
1311config NETFILTER_XT_MATCH_ESP
1312 tristate '"esp" match support'
1313 depends on NETFILTER_ADVANCED
1314 help
1315 This match extension allows you to match a range of SPIs
1316 inside ESP header of IPSec packets.
1317
1318 To compile it as a module, choose M here. If unsure, say N.
1319
1320config NETFILTER_XT_MATCH_HASHLIMIT
1321 tristate '"hashlimit" match support'
1322 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1323 depends on NETFILTER_ADVANCED
1324 help
1325 This option adds a `hashlimit' match.
1326
1327 As opposed to `limit', this match dynamically creates a hash table
1328 of limit buckets, based on your selection of source/destination
1329 addresses and/or ports.
1330
1331 It enables you to express policies like `10kpps for any given
1332 destination address' or `500pps from any given source address'
1333 with a single rule.
1334
1335config NETFILTER_XT_MATCH_HELPER
1336 tristate '"helper" match support'
1337 depends on NF_CONNTRACK
1338 depends on NETFILTER_ADVANCED
1339 help
1340 Helper matching allows you to match packets in dynamic connections
1341 tracked by a conntrack-helper, ie. nf_conntrack_ftp
1342
1343 To compile it as a module, choose M here. If unsure, say Y.
1344
1345config NETFILTER_XT_MATCH_HL
1346 tristate '"hl" hoplimit/TTL match support'
1347 depends on NETFILTER_ADVANCED
1348 help
1349 HL matching allows you to match packets based on the hoplimit
1350 in the IPv6 header, or the time-to-live field in the IPv4
1351 header of the packet.
1352
1353config NETFILTER_XT_MATCH_IPCOMP
1354 tristate '"ipcomp" match support'
1355 depends on NETFILTER_ADVANCED
1356 help
1357 This match extension allows you to match a range of CPIs(16 bits)
1358 inside IPComp header of IPSec packets.
1359
1360 To compile it as a module, choose M here. If unsure, say N.
1361
1362config NETFILTER_XT_MATCH_IPRANGE
1363 tristate '"iprange" address range match support'
1364 depends on NETFILTER_ADVANCED
1365 help
1366 This option adds a "iprange" match, which allows you to match based on
1367 an IP address range. (Normal iptables only matches on single addresses
1368 with an optional mask.)
1369
1370 If unsure, say M.
1371
1372config NETFILTER_XT_MATCH_IPVS
1373 tristate '"ipvs" match support'
1374 depends on IP_VS
1375 depends on NETFILTER_ADVANCED
1376 depends on NF_CONNTRACK
1377 help
1378 This option allows you to match against IPVS properties of a packet.
1379
1380 If unsure, say N.
1381
1382config NETFILTER_XT_MATCH_L2TP
1383 tristate '"l2tp" match support'
1384 depends on NETFILTER_ADVANCED
1385 default L2TP
1386 help
1387 This option adds an "L2TP" match, which allows you to match against
1388 L2TP protocol header fields.
1389
1390 To compile it as a module, choose M here. If unsure, say N.
1391
1392config NETFILTER_XT_MATCH_LENGTH
1393 tristate '"length" match support'
1394 depends on NETFILTER_ADVANCED
1395 help
1396 This option allows you to match the length of a packet against a
1397 specific value or range of values.
1398
1399 To compile it as a module, choose M here. If unsure, say N.
1400
1401config NETFILTER_XT_MATCH_LIMIT
1402 tristate '"limit" match support'
1403 depends on NETFILTER_ADVANCED
1404 help
1405 limit matching allows you to control the rate at which a rule can be
1406 matched: mainly useful in combination with the LOG target ("LOG
1407 target support", below) and to avoid some Denial of Service attacks.
1408
1409 To compile it as a module, choose M here. If unsure, say N.
1410
1411config NETFILTER_XT_MATCH_MAC
1412 tristate '"mac" address match support'
1413 depends on NETFILTER_ADVANCED
1414 help
1415 MAC matching allows you to match packets based on the source
1416 Ethernet address of the packet.
1417
1418 To compile it as a module, choose M here. If unsure, say N.
1419
1420config NETFILTER_XT_MATCH_MARK
1421 tristate '"mark" match support'
1422 depends on NETFILTER_ADVANCED
1423 select NETFILTER_XT_MARK
1424 help
1425 This is a backwards-compat option for the user's convenience
1426 (e.g. when running oldconfig). It selects
1427 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1428
1429config NETFILTER_XT_MATCH_MULTIPORT
1430 tristate '"multiport" Multiple port match support'
1431 depends on NETFILTER_ADVANCED
1432 help
1433 Multiport matching allows you to match TCP or UDP packets based on
1434 a series of source or destination ports: normally a rule can only
1435 match a single range of ports.
1436
1437 To compile it as a module, choose M here. If unsure, say N.
1438
1439config NETFILTER_XT_MATCH_NFACCT
1440 tristate '"nfacct" match support'
1441 depends on NETFILTER_ADVANCED
1442 select NETFILTER_NETLINK_ACCT
1443 help
1444 This option allows you to use the extended accounting through
1445 nfnetlink_acct.
1446
1447 To compile it as a module, choose M here. If unsure, say N.
1448
1449config NETFILTER_XT_MATCH_OSF
1450 tristate '"osf" Passive OS fingerprint match'
1451 depends on NETFILTER_ADVANCED
1452 select NETFILTER_NETLINK_OSF
1453 help
1454 This option selects the Passive OS Fingerprinting match module
1455 that allows to passively match the remote operating system by
1456 analyzing incoming TCP SYN packets.
1457
1458 Rules and loading software can be downloaded from
1459 http://www.ioremap.net/projects/osf
1460
1461 To compile it as a module, choose M here. If unsure, say N.
1462
1463config NETFILTER_XT_MATCH_OWNER
1464 tristate '"owner" match support'
1465 depends on NETFILTER_ADVANCED
1466 help
1467 Socket owner matching allows you to match locally-generated packets
1468 based on who created the socket: the user or group. It is also
1469 possible to check whether a socket actually exists.
1470
1471config NETFILTER_XT_MATCH_POLICY
1472 tristate 'IPsec "policy" match support'
1473 depends on XFRM
1474 default m if NETFILTER_ADVANCED=n
1475 help
1476 Policy matching allows you to match packets based on the
1477 IPsec policy that was used during decapsulation/will
1478 be used during encapsulation.
1479
1480 To compile it as a module, choose M here. If unsure, say N.
1481
1482config NETFILTER_XT_MATCH_PHYSDEV
1483 tristate '"physdev" match support'
1484 depends on BRIDGE && BRIDGE_NETFILTER
1485 depends on NETFILTER_ADVANCED
1486 help
1487 Physdev packet matching matches against the physical bridge ports
1488 the IP packet arrived on or will leave by.
1489
1490 To compile it as a module, choose M here. If unsure, say N.
1491
1492config NETFILTER_XT_MATCH_PKTTYPE
1493 tristate '"pkttype" packet type match support'
1494 depends on NETFILTER_ADVANCED
1495 help
1496 Packet type matching allows you to match a packet by
1497 its "class", eg. BROADCAST, MULTICAST, ...
1498
1499 Typical usage:
1500 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1501
1502 To compile it as a module, choose M here. If unsure, say N.
1503
1504config NETFILTER_XT_MATCH_QUOTA
1505 tristate '"quota" match support'
1506 depends on NETFILTER_ADVANCED
1507 help
1508 This option adds a `quota' match, which allows to match on a
1509 byte counter.
1510
1511 If you want to compile it as a module, say M here and read
1512 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1513
1514config NETFILTER_XT_MATCH_RATEEST
1515 tristate '"rateest" match support'
1516 depends on NETFILTER_ADVANCED
1517 select NETFILTER_XT_TARGET_RATEEST
1518 help
1519 This option adds a `rateest' match, which allows to match on the
1520 rate estimated by the RATEEST target.
1521
1522 To compile it as a module, choose M here. If unsure, say N.
1523
1524config NETFILTER_XT_MATCH_REALM
1525 tristate '"realm" match support'
1526 depends on NETFILTER_ADVANCED
1527 select IP_ROUTE_CLASSID
1528 help
1529 This option adds a `realm' match, which allows you to use the realm
1530 key from the routing subsystem inside iptables.
1531
1532 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1533 in tc world.
1534
1535 If you want to compile it as a module, say M here and read
1536 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1537
1538config NETFILTER_XT_MATCH_RECENT
1539 tristate '"recent" match support'
1540 depends on NETFILTER_ADVANCED
1541 help
1542 This match is used for creating one or many lists of recently
1543 used addresses and then matching against that/those list(s).
1544
1545 Short options are available by using 'iptables -m recent -h'
1546 Official Website: <http://snowman.net/projects/ipt_recent/>
1547
1548config NETFILTER_XT_MATCH_SCTP
1549 tristate '"sctp" protocol match support'
1550 depends on NETFILTER_ADVANCED
1551 default IP_SCTP
1552 help
1553 With this option enabled, you will be able to use the
1554 `sctp' match in order to match on SCTP source/destination ports
1555 and SCTP chunk types.
1556
1557 If you want to compile it as a module, say M here and read
1558 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1559
1560config NETFILTER_XT_MATCH_SOCKET
1561 tristate '"socket" match support'
1562 depends on NETFILTER_XTABLES
1563 depends on NETFILTER_ADVANCED
1564 depends on IPV6 || IPV6=n
1565 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1566 select NF_SOCKET_IPV4
1567 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1568 select NF_DEFRAG_IPV4
1569 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1570 help
1571 This option adds a `socket' match, which can be used to match
1572 packets for which a TCP or UDP socket lookup finds a valid socket.
1573 It can be used in combination with the MARK target and policy
1574 routing to implement full featured non-locally bound sockets.
1575
1576 To compile it as a module, choose M here. If unsure, say N.
1577
1578config NETFILTER_XT_MATCH_STATE
1579 tristate '"state" match support'
1580 depends on NF_CONNTRACK
1581 default m if NETFILTER_ADVANCED=n
1582 help
1583 Connection state matching allows you to match packets based on their
1584 relationship to a tracked connection (ie. previous packets). This
1585 is a powerful tool for packet classification.
1586
1587 To compile it as a module, choose M here. If unsure, say N.
1588
1589config NETFILTER_XT_MATCH_STATISTIC
1590 tristate '"statistic" match support'
1591 depends on NETFILTER_ADVANCED
1592 help
1593 This option adds a `statistic' match, which allows you to match
1594 on packets periodically or randomly with a given percentage.
1595
1596 To compile it as a module, choose M here. If unsure, say N.
1597
1598config NETFILTER_XT_MATCH_STRING
1599 tristate '"string" match support'
1600 depends on NETFILTER_ADVANCED
1601 select TEXTSEARCH
1602 select TEXTSEARCH_KMP
1603 select TEXTSEARCH_BM
1604 select TEXTSEARCH_FSM
1605 help
1606 This option adds a `string' match, which allows you to look for
1607 pattern matchings in packets.
1608
1609 To compile it as a module, choose M here. If unsure, say N.
1610
1611config NETFILTER_XT_MATCH_TCPMSS
1612 tristate '"tcpmss" match support'
1613 depends on NETFILTER_ADVANCED
1614 help
1615 This option adds a `tcpmss' match, which allows you to examine the
1616 MSS value of TCP SYN packets, which control the maximum packet size
1617 for that connection.
1618
1619 To compile it as a module, choose M here. If unsure, say N.
1620
1621config NETFILTER_XT_MATCH_TIME
1622 tristate '"time" match support'
1623 depends on NETFILTER_ADVANCED
1624 help
1625 This option adds a "time" match, which allows you to match based on
1626 the packet arrival time (at the machine which netfilter is running)
1627 on) or departure time/date (for locally generated packets).
1628
1629 If you say Y here, try `iptables -m time --help` for
1630 more information.
1631
1632 If you want to compile it as a module, say M here.
1633 If unsure, say N.
1634
1635config NETFILTER_XT_MATCH_U32
1636 tristate '"u32" match support'
1637 depends on NETFILTER_ADVANCED
1638 help
1639 u32 allows you to extract quantities of up to 4 bytes from a packet,
1640 AND them with specified masks, shift them by specified amounts and
1641 test whether the results are in any of a set of specified ranges.
1642 The specification of what to extract is general enough to skip over
1643 headers with lengths stored in the packet, as in IP or TCP header
1644 lengths.
1645
1646 Details and examples are in the kernel module source.
1647
1648endif
1649
1650endmenu
1651
1652source "net/netfilter/ipset/Kconfig"
1653
1654source "net/netfilter/ipvs/Kconfig"
1655
