1ec8f24b7SThomas Gleixner# SPDX-License-Identifier: GPL-2.0-only 21da177e4SLinus Torvalds# 31da177e4SLinus Torvalds# Bridge netfilter configuration 41da177e4SLinus Torvalds# 596518518SPatrick McHardy# 6f5efc696STomasz Bursztykamenuconfig NF_TABLES_BRIDGE 71708803eSPablo Neira depends on BRIDGE && NETFILTER && NF_TABLES 82a95183aSFlorian Westphal select NETFILTER_FAMILY_BRIDGE 9dfee0e99SArnd Bergmann tristate "Ethernet Bridge nf_tables support" 101da177e4SLinus Torvalds 11f5efc696STomasz Bursztykaif NF_TABLES_BRIDGE 1230e103feSwenxu 1330e103feSwenxuconfig NFT_BRIDGE_META 1430e103feSwenxu tristate "Netfilter nf_table bridge meta support" 1530e103feSwenxu help 1630e103feSwenxu Add support for bridge dedicated meta key. 1730e103feSwenxu 1885f5b308SPablo Neira Ayusoconfig NFT_BRIDGE_REJECT 1985f5b308SPablo Neira Ayuso tristate "Netfilter nf_tables bridge reject support" 20fa538f7cSJose M. Guisado Gomez depends on NFT_REJECT 21*fd2d6bc4SRandy Dunlap depends on NF_REJECT_IPV4 22*fd2d6bc4SRandy Dunlap depends on NF_REJECT_IPV6 2385f5b308SPablo Neira Ayuso help 2485f5b308SPablo Neira Ayuso Add support to reject packets. 2585f5b308SPablo Neira Ayuso 26fc2f14f8SPablo Neira Ayusoendif # NF_TABLES_BRIDGE 27fc2f14f8SPablo Neira Ayuso 283c171f49SPablo Neira Ayusoconfig NF_CONNTRACK_BRIDGE 293c171f49SPablo Neira Ayuso tristate "IPv4/IPV6 bridge connection tracking support" 303c171f49SPablo Neira Ayuso depends on NF_CONNTRACK 313c171f49SPablo Neira Ayuso default n 323c171f49SPablo Neira Ayuso help 333c171f49SPablo Neira Ayuso Connection tracking keeps a record of what packets have passed 343c171f49SPablo Neira Ayuso through your machine, in order to figure out how they are related 353c171f49SPablo Neira Ayuso into connections. This is used to enhance packet filtering via 363c171f49SPablo Neira Ayuso stateful policies. Enable this if you want native tracking from 373c171f49SPablo Neira Ayuso the bridge. This provides a replacement for the `br_netfilter' 383c171f49SPablo Neira Ayuso infrastructure. 393c171f49SPablo Neira Ayuso 403c171f49SPablo Neira Ayuso To compile it as a module, choose M here. If unsure, say N. 413c171f49SPablo Neira Ayuso 4220f3c56fSJan Engelhardtmenuconfig BRIDGE_NF_EBTABLES 431da177e4SLinus Torvalds tristate "Ethernet Bridge tables (ebtables) support" 441708803eSPablo Neira depends on BRIDGE && NETFILTER && NETFILTER_XTABLES 452a95183aSFlorian Westphal select NETFILTER_FAMILY_BRIDGE 461da177e4SLinus Torvalds help 471da177e4SLinus Torvalds ebtables is a general, extensible frame/packet identification 481da177e4SLinus Torvalds framework. Say 'Y' or 'M' here if you want to do Ethernet 491da177e4SLinus Torvalds filtering/NAT/brouting on the Ethernet bridge. 5020f3c56fSJan Engelhardt 5120f3c56fSJan Engelhardtif BRIDGE_NF_EBTABLES 5220f3c56fSJan Engelhardt 531da177e4SLinus Torvalds# 541da177e4SLinus Torvalds# tables 551da177e4SLinus Torvalds# 561da177e4SLinus Torvaldsconfig BRIDGE_EBT_BROUTE 571da177e4SLinus Torvalds tristate "ebt: broute table support" 581da177e4SLinus Torvalds help 591da177e4SLinus Torvalds The ebtables broute table is used to define rules that decide between 601da177e4SLinus Torvalds bridging and routing frames, giving Linux the functionality of a 611da177e4SLinus Torvalds brouter. See the man page for ebtables(8) and examples on the ebtables 621da177e4SLinus Torvalds website. 631da177e4SLinus Torvalds 641da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 651da177e4SLinus Torvalds 661da177e4SLinus Torvaldsconfig BRIDGE_EBT_T_FILTER 671da177e4SLinus Torvalds tristate "ebt: filter table support" 681da177e4SLinus Torvalds help 691da177e4SLinus Torvalds The ebtables filter table is used to define frame filtering rules at 701da177e4SLinus Torvalds local input, forwarding and local output. See the man page for 711da177e4SLinus Torvalds ebtables(8). 721da177e4SLinus Torvalds 731da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 741da177e4SLinus Torvalds 751da177e4SLinus Torvaldsconfig BRIDGE_EBT_T_NAT 761da177e4SLinus Torvalds tristate "ebt: nat table support" 771da177e4SLinus Torvalds help 781da177e4SLinus Torvalds The ebtables nat table is used to define rules that alter the MAC 791da177e4SLinus Torvalds source address (MAC SNAT) or the MAC destination address (MAC DNAT). 801da177e4SLinus Torvalds See the man page for ebtables(8). 811da177e4SLinus Torvalds 821da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 831da177e4SLinus Torvalds# 841da177e4SLinus Torvalds# matches 851da177e4SLinus Torvalds# 861da177e4SLinus Torvaldsconfig BRIDGE_EBT_802_3 871da177e4SLinus Torvalds tristate "ebt: 802.3 filter support" 881da177e4SLinus Torvalds help 891da177e4SLinus Torvalds This option adds matching support for 802.3 Ethernet frames. 901da177e4SLinus Torvalds 911da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 921da177e4SLinus Torvalds 931da177e4SLinus Torvaldsconfig BRIDGE_EBT_AMONG 941da177e4SLinus Torvalds tristate "ebt: among filter support" 951da177e4SLinus Torvalds help 961da177e4SLinus Torvalds This option adds the among match, which allows matching the MAC source 971da177e4SLinus Torvalds and/or destination address on a list of addresses. Optionally, 981da177e4SLinus Torvalds MAC/IP address pairs can be matched, f.e. for anti-spoofing rules. 991da177e4SLinus Torvalds 1001da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1011da177e4SLinus Torvalds 1021da177e4SLinus Torvaldsconfig BRIDGE_EBT_ARP 1031da177e4SLinus Torvalds tristate "ebt: ARP filter support" 1041da177e4SLinus Torvalds help 1051da177e4SLinus Torvalds This option adds the ARP match, which allows ARP and RARP header field 1061da177e4SLinus Torvalds filtering. 1071da177e4SLinus Torvalds 1081da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1091da177e4SLinus Torvalds 1101da177e4SLinus Torvaldsconfig BRIDGE_EBT_IP 1111da177e4SLinus Torvalds tristate "ebt: IP filter support" 1121da177e4SLinus Torvalds help 1131da177e4SLinus Torvalds This option adds the IP match, which allows basic IP header field 1141da177e4SLinus Torvalds filtering. 1151da177e4SLinus Torvalds 1161da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1171da177e4SLinus Torvalds 11893f65158SKuo-lang Tsengconfig BRIDGE_EBT_IP6 11993f65158SKuo-lang Tseng tristate "ebt: IP6 filter support" 120f586287eSRandy Dunlap depends on BRIDGE_NF_EBTABLES && IPV6 12193f65158SKuo-lang Tseng help 12293f65158SKuo-lang Tseng This option adds the IP6 match, which allows basic IPV6 header field 12393f65158SKuo-lang Tseng filtering. 12493f65158SKuo-lang Tseng 12593f65158SKuo-lang Tseng To compile it as a module, choose M here. If unsure, say N. 12693f65158SKuo-lang Tseng 1271da177e4SLinus Torvaldsconfig BRIDGE_EBT_LIMIT 1281da177e4SLinus Torvalds tristate "ebt: limit match support" 1291da177e4SLinus Torvalds help 1301da177e4SLinus Torvalds This option adds the limit match, which allows you to control 1311da177e4SLinus Torvalds the rate at which a rule can be matched. This match is the 1321da177e4SLinus Torvalds equivalent of the iptables limit match. 1331da177e4SLinus Torvalds 1341da177e4SLinus Torvalds If you want to compile it as a module, say M here and read 135cd238effSMauro Carvalho Chehab <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1361da177e4SLinus Torvalds 1371da177e4SLinus Torvaldsconfig BRIDGE_EBT_MARK 1381da177e4SLinus Torvalds tristate "ebt: mark filter support" 1391da177e4SLinus Torvalds help 1401da177e4SLinus Torvalds This option adds the mark match, which allows matching frames based on 1411da177e4SLinus Torvalds the 'nfmark' value in the frame. This can be set by the mark target. 1421da177e4SLinus Torvalds This value is the same as the one used in the iptables mark match and 1431da177e4SLinus Torvalds target. 1441da177e4SLinus Torvalds 1451da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1461da177e4SLinus Torvalds 1471da177e4SLinus Torvaldsconfig BRIDGE_EBT_PKTTYPE 1481da177e4SLinus Torvalds tristate "ebt: packet type filter support" 1491da177e4SLinus Torvalds help 1501da177e4SLinus Torvalds This option adds the packet type match, which allows matching on the 1511da177e4SLinus Torvalds type of packet based on its Ethernet "class" (as determined by 1521da177e4SLinus Torvalds the generic networking code): broadcast, multicast, 1531da177e4SLinus Torvalds for this host alone or for another host. 1541da177e4SLinus Torvalds 1551da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1561da177e4SLinus Torvalds 1571da177e4SLinus Torvaldsconfig BRIDGE_EBT_STP 1581da177e4SLinus Torvalds tristate "ebt: STP filter support" 1591da177e4SLinus Torvalds help 1601da177e4SLinus Torvalds This option adds the Spanning Tree Protocol match, which 1611da177e4SLinus Torvalds allows STP header field filtering. 1621da177e4SLinus Torvalds 1631da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1641da177e4SLinus Torvalds 1651da177e4SLinus Torvaldsconfig BRIDGE_EBT_VLAN 1661da177e4SLinus Torvalds tristate "ebt: 802.1Q VLAN filter support" 1671da177e4SLinus Torvalds help 1681da177e4SLinus Torvalds This option adds the 802.1Q vlan match, which allows the filtering of 1691da177e4SLinus Torvalds 802.1Q vlan fields. 1701da177e4SLinus Torvalds 1711da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1721da177e4SLinus Torvalds# 1731da177e4SLinus Torvalds# targets 1741da177e4SLinus Torvalds# 1751da177e4SLinus Torvaldsconfig BRIDGE_EBT_ARPREPLY 1761da177e4SLinus Torvalds tristate "ebt: arp reply target support" 177eb3f8f5eSAdrian Bunk depends on BRIDGE_NF_EBTABLES && INET 1781da177e4SLinus Torvalds help 1791da177e4SLinus Torvalds This option adds the arp reply target, which allows 1801da177e4SLinus Torvalds automatically sending arp replies to arp requests. 1811da177e4SLinus Torvalds 1821da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1831da177e4SLinus Torvalds 1841da177e4SLinus Torvaldsconfig BRIDGE_EBT_DNAT 1851da177e4SLinus Torvalds tristate "ebt: dnat target support" 1861da177e4SLinus Torvalds help 1871da177e4SLinus Torvalds This option adds the MAC DNAT target, which allows altering the MAC 1881da177e4SLinus Torvalds destination address of frames. 1891da177e4SLinus Torvalds 1901da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1911da177e4SLinus Torvalds 1921da177e4SLinus Torvaldsconfig BRIDGE_EBT_MARK_T 1931da177e4SLinus Torvalds tristate "ebt: mark target support" 1941da177e4SLinus Torvalds help 1951da177e4SLinus Torvalds This option adds the mark target, which allows marking frames by 1961da177e4SLinus Torvalds setting the 'nfmark' value in the frame. 1971da177e4SLinus Torvalds This value is the same as the one used in the iptables mark match and 1981da177e4SLinus Torvalds target. 1991da177e4SLinus Torvalds 2001da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 2011da177e4SLinus Torvalds 2021da177e4SLinus Torvaldsconfig BRIDGE_EBT_REDIRECT 2031da177e4SLinus Torvalds tristate "ebt: redirect target support" 2041da177e4SLinus Torvalds help 2051da177e4SLinus Torvalds This option adds the MAC redirect target, which allows altering the MAC 2061da177e4SLinus Torvalds destination address of a frame to that of the device it arrived on. 2071da177e4SLinus Torvalds 2081da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 2091da177e4SLinus Torvalds 2101da177e4SLinus Torvaldsconfig BRIDGE_EBT_SNAT 2111da177e4SLinus Torvalds tristate "ebt: snat target support" 2121da177e4SLinus Torvalds help 2131da177e4SLinus Torvalds This option adds the MAC SNAT target, which allows altering the MAC 2141da177e4SLinus Torvalds source address of frames. 2151da177e4SLinus Torvalds 2161da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 2171da177e4SLinus Torvalds# 2181da177e4SLinus Torvalds# watchers 2191da177e4SLinus Torvalds# 2201da177e4SLinus Torvaldsconfig BRIDGE_EBT_LOG 2211da177e4SLinus Torvalds tristate "ebt: log support" 2221da177e4SLinus Torvalds help 2231da177e4SLinus Torvalds This option adds the log watcher, that you can use in any rule 2241da177e4SLinus Torvalds in any ebtables table. It records info about the frame header 2251da177e4SLinus Torvalds to the syslog. 2261da177e4SLinus Torvalds 2271da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 2281da177e4SLinus Torvalds 229e7bfd0a1SPeter Warasinconfig BRIDGE_EBT_NFLOG 230e7bfd0a1SPeter Warasin tristate "ebt: nflog support" 231e7bfd0a1SPeter Warasin help 232e7bfd0a1SPeter Warasin This option enables the nflog watcher, which allows to LOG 233e7bfd0a1SPeter Warasin messages through the netfilter logging API, which can use 234e7bfd0a1SPeter Warasin either the old LOG target, the old ULOG target or nfnetlink_log 235e7bfd0a1SPeter Warasin as backend. 236e7bfd0a1SPeter Warasin 23758de7862SPatrick McHardy This option adds the nflog watcher, that you can use in any rule 238e7bfd0a1SPeter Warasin in any ebtables table. 239e7bfd0a1SPeter Warasin 240e7bfd0a1SPeter Warasin To compile it as a module, choose M here. If unsure, say N. 241e7bfd0a1SPeter Warasin 24220f3c56fSJan Engelhardtendif # BRIDGE_NF_EBTABLES 243