1ec8f24b7SThomas Gleixner# SPDX-License-Identifier: GPL-2.0-only 21da177e4SLinus Torvalds# 31da177e4SLinus Torvalds# Bridge netfilter configuration 41da177e4SLinus Torvalds# 596518518SPatrick McHardy# 6f5efc696STomasz Bursztykamenuconfig NF_TABLES_BRIDGE 71708803eSPablo Neira depends on BRIDGE && NETFILTER && NF_TABLES 82a95183aSFlorian Westphal select NETFILTER_FAMILY_BRIDGE 902c7b25eSPablo Neira Ayuso bool "Ethernet Bridge nf_tables support" 101da177e4SLinus Torvalds 11f5efc696STomasz Bursztykaif NF_TABLES_BRIDGE 1230e103feSwenxu 1330e103feSwenxuconfig NFT_BRIDGE_META 1430e103feSwenxu tristate "Netfilter nf_table bridge meta support" 1530e103feSwenxu help 1630e103feSwenxu Add support for bridge dedicated meta key. 1730e103feSwenxu 1885f5b308SPablo Neira Ayusoconfig NFT_BRIDGE_REJECT 1985f5b308SPablo Neira Ayuso tristate "Netfilter nf_tables bridge reject support" 2085f5b308SPablo Neira Ayuso depends on NFT_REJECT && NFT_REJECT_IPV4 && NFT_REJECT_IPV6 2185f5b308SPablo Neira Ayuso help 2285f5b308SPablo Neira Ayuso Add support to reject packets. 2385f5b308SPablo Neira Ayuso 24960649d1SPablo Neira Ayusoconfig NF_LOG_BRIDGE 25960649d1SPablo Neira Ayuso tristate "Bridge packet logging" 261fddf4baSPablo Neira Ayuso select NF_LOG_COMMON 27960649d1SPablo Neira Ayuso 283c171f49SPablo Neira Ayusoconfig NF_CONNTRACK_BRIDGE 293c171f49SPablo Neira Ayuso tristate "IPv4/IPV6 bridge connection tracking support" 303c171f49SPablo Neira Ayuso depends on NF_CONNTRACK 313c171f49SPablo Neira Ayuso default n 323c171f49SPablo Neira Ayuso help 333c171f49SPablo Neira Ayuso Connection tracking keeps a record of what packets have passed 343c171f49SPablo Neira Ayuso through your machine, in order to figure out how they are related 353c171f49SPablo Neira Ayuso into connections. This is used to enhance packet filtering via 363c171f49SPablo Neira Ayuso stateful policies. Enable this if you want native tracking from 373c171f49SPablo Neira Ayuso the bridge. This provides a replacement for the `br_netfilter' 383c171f49SPablo Neira Ayuso infrastructure. 393c171f49SPablo Neira Ayuso 403c171f49SPablo Neira Ayuso To compile it as a module, choose M here. If unsure, say N. 413c171f49SPablo Neira Ayuso 42f5efc696STomasz Bursztykaendif # NF_TABLES_BRIDGE 43f5efc696STomasz Bursztyka 4420f3c56fSJan Engelhardtmenuconfig BRIDGE_NF_EBTABLES 451da177e4SLinus Torvalds tristate "Ethernet Bridge tables (ebtables) support" 461708803eSPablo Neira depends on BRIDGE && NETFILTER && NETFILTER_XTABLES 472a95183aSFlorian Westphal select NETFILTER_FAMILY_BRIDGE 481da177e4SLinus Torvalds help 491da177e4SLinus Torvalds ebtables is a general, extensible frame/packet identification 501da177e4SLinus Torvalds framework. Say 'Y' or 'M' here if you want to do Ethernet 511da177e4SLinus Torvalds filtering/NAT/brouting on the Ethernet bridge. 5220f3c56fSJan Engelhardt 5320f3c56fSJan Engelhardtif BRIDGE_NF_EBTABLES 5420f3c56fSJan Engelhardt 551da177e4SLinus Torvalds# 561da177e4SLinus Torvalds# tables 571da177e4SLinus Torvalds# 581da177e4SLinus Torvaldsconfig BRIDGE_EBT_BROUTE 591da177e4SLinus Torvalds tristate "ebt: broute table support" 601da177e4SLinus Torvalds help 611da177e4SLinus Torvalds The ebtables broute table is used to define rules that decide between 621da177e4SLinus Torvalds bridging and routing frames, giving Linux the functionality of a 631da177e4SLinus Torvalds brouter. See the man page for ebtables(8) and examples on the ebtables 641da177e4SLinus Torvalds website. 651da177e4SLinus Torvalds 661da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 671da177e4SLinus Torvalds 681da177e4SLinus Torvaldsconfig BRIDGE_EBT_T_FILTER 691da177e4SLinus Torvalds tristate "ebt: filter table support" 701da177e4SLinus Torvalds help 711da177e4SLinus Torvalds The ebtables filter table is used to define frame filtering rules at 721da177e4SLinus Torvalds local input, forwarding and local output. See the man page for 731da177e4SLinus Torvalds ebtables(8). 741da177e4SLinus Torvalds 751da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 761da177e4SLinus Torvalds 771da177e4SLinus Torvaldsconfig BRIDGE_EBT_T_NAT 781da177e4SLinus Torvalds tristate "ebt: nat table support" 791da177e4SLinus Torvalds help 801da177e4SLinus Torvalds The ebtables nat table is used to define rules that alter the MAC 811da177e4SLinus Torvalds source address (MAC SNAT) or the MAC destination address (MAC DNAT). 821da177e4SLinus Torvalds See the man page for ebtables(8). 831da177e4SLinus Torvalds 841da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 851da177e4SLinus Torvalds# 861da177e4SLinus Torvalds# matches 871da177e4SLinus Torvalds# 881da177e4SLinus Torvaldsconfig BRIDGE_EBT_802_3 891da177e4SLinus Torvalds tristate "ebt: 802.3 filter support" 901da177e4SLinus Torvalds help 911da177e4SLinus Torvalds This option adds matching support for 802.3 Ethernet frames. 921da177e4SLinus Torvalds 931da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 941da177e4SLinus Torvalds 951da177e4SLinus Torvaldsconfig BRIDGE_EBT_AMONG 961da177e4SLinus Torvalds tristate "ebt: among filter support" 971da177e4SLinus Torvalds help 981da177e4SLinus Torvalds This option adds the among match, which allows matching the MAC source 991da177e4SLinus Torvalds and/or destination address on a list of addresses. Optionally, 1001da177e4SLinus Torvalds MAC/IP address pairs can be matched, f.e. for anti-spoofing rules. 1011da177e4SLinus Torvalds 1021da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1031da177e4SLinus Torvalds 1041da177e4SLinus Torvaldsconfig BRIDGE_EBT_ARP 1051da177e4SLinus Torvalds tristate "ebt: ARP filter support" 1061da177e4SLinus Torvalds help 1071da177e4SLinus Torvalds This option adds the ARP match, which allows ARP and RARP header field 1081da177e4SLinus Torvalds filtering. 1091da177e4SLinus Torvalds 1101da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1111da177e4SLinus Torvalds 1121da177e4SLinus Torvaldsconfig BRIDGE_EBT_IP 1131da177e4SLinus Torvalds tristate "ebt: IP filter support" 1141da177e4SLinus Torvalds help 1151da177e4SLinus Torvalds This option adds the IP match, which allows basic IP header field 1161da177e4SLinus Torvalds filtering. 1171da177e4SLinus Torvalds 1181da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1191da177e4SLinus Torvalds 12093f65158SKuo-lang Tsengconfig BRIDGE_EBT_IP6 12193f65158SKuo-lang Tseng tristate "ebt: IP6 filter support" 122f586287eSRandy Dunlap depends on BRIDGE_NF_EBTABLES && IPV6 12393f65158SKuo-lang Tseng help 12493f65158SKuo-lang Tseng This option adds the IP6 match, which allows basic IPV6 header field 12593f65158SKuo-lang Tseng filtering. 12693f65158SKuo-lang Tseng 12793f65158SKuo-lang Tseng To compile it as a module, choose M here. If unsure, say N. 12893f65158SKuo-lang Tseng 1291da177e4SLinus Torvaldsconfig BRIDGE_EBT_LIMIT 1301da177e4SLinus Torvalds tristate "ebt: limit match support" 1311da177e4SLinus Torvalds help 1321da177e4SLinus Torvalds This option adds the limit match, which allows you to control 1331da177e4SLinus Torvalds the rate at which a rule can be matched. This match is the 1341da177e4SLinus Torvalds equivalent of the iptables limit match. 1351da177e4SLinus Torvalds 1361da177e4SLinus Torvalds If you want to compile it as a module, say M here and read 1371da177e4SLinus Torvalds <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1381da177e4SLinus Torvalds 1391da177e4SLinus Torvaldsconfig BRIDGE_EBT_MARK 1401da177e4SLinus Torvalds tristate "ebt: mark filter support" 1411da177e4SLinus Torvalds help 1421da177e4SLinus Torvalds This option adds the mark match, which allows matching frames based on 1431da177e4SLinus Torvalds the 'nfmark' value in the frame. This can be set by the mark target. 1441da177e4SLinus Torvalds This value is the same as the one used in the iptables mark match and 1451da177e4SLinus Torvalds target. 1461da177e4SLinus Torvalds 1471da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1481da177e4SLinus Torvalds 1491da177e4SLinus Torvaldsconfig BRIDGE_EBT_PKTTYPE 1501da177e4SLinus Torvalds tristate "ebt: packet type filter support" 1511da177e4SLinus Torvalds help 1521da177e4SLinus Torvalds This option adds the packet type match, which allows matching on the 1531da177e4SLinus Torvalds type of packet based on its Ethernet "class" (as determined by 1541da177e4SLinus Torvalds the generic networking code): broadcast, multicast, 1551da177e4SLinus Torvalds for this host alone or for another host. 1561da177e4SLinus Torvalds 1571da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1581da177e4SLinus Torvalds 1591da177e4SLinus Torvaldsconfig BRIDGE_EBT_STP 1601da177e4SLinus Torvalds tristate "ebt: STP filter support" 1611da177e4SLinus Torvalds help 1621da177e4SLinus Torvalds This option adds the Spanning Tree Protocol match, which 1631da177e4SLinus Torvalds allows STP header field filtering. 1641da177e4SLinus Torvalds 1651da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1661da177e4SLinus Torvalds 1671da177e4SLinus Torvaldsconfig BRIDGE_EBT_VLAN 1681da177e4SLinus Torvalds tristate "ebt: 802.1Q VLAN filter support" 1691da177e4SLinus Torvalds help 1701da177e4SLinus Torvalds This option adds the 802.1Q vlan match, which allows the filtering of 1711da177e4SLinus Torvalds 802.1Q vlan fields. 1721da177e4SLinus Torvalds 1731da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1741da177e4SLinus Torvalds# 1751da177e4SLinus Torvalds# targets 1761da177e4SLinus Torvalds# 1771da177e4SLinus Torvaldsconfig BRIDGE_EBT_ARPREPLY 1781da177e4SLinus Torvalds tristate "ebt: arp reply target support" 179eb3f8f5eSAdrian Bunk depends on BRIDGE_NF_EBTABLES && INET 1801da177e4SLinus Torvalds help 1811da177e4SLinus Torvalds This option adds the arp reply target, which allows 1821da177e4SLinus Torvalds automatically sending arp replies to arp requests. 1831da177e4SLinus Torvalds 1841da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1851da177e4SLinus Torvalds 1861da177e4SLinus Torvaldsconfig BRIDGE_EBT_DNAT 1871da177e4SLinus Torvalds tristate "ebt: dnat target support" 1881da177e4SLinus Torvalds help 1891da177e4SLinus Torvalds This option adds the MAC DNAT target, which allows altering the MAC 1901da177e4SLinus Torvalds destination address of frames. 1911da177e4SLinus Torvalds 1921da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1931da177e4SLinus Torvalds 1941da177e4SLinus Torvaldsconfig BRIDGE_EBT_MARK_T 1951da177e4SLinus Torvalds tristate "ebt: mark target support" 1961da177e4SLinus Torvalds help 1971da177e4SLinus Torvalds This option adds the mark target, which allows marking frames by 1981da177e4SLinus Torvalds setting the 'nfmark' value in the frame. 1991da177e4SLinus Torvalds This value is the same as the one used in the iptables mark match and 2001da177e4SLinus Torvalds target. 2011da177e4SLinus Torvalds 2021da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 2031da177e4SLinus Torvalds 2041da177e4SLinus Torvaldsconfig BRIDGE_EBT_REDIRECT 2051da177e4SLinus Torvalds tristate "ebt: redirect target support" 2061da177e4SLinus Torvalds help 2071da177e4SLinus Torvalds This option adds the MAC redirect target, which allows altering the MAC 2081da177e4SLinus Torvalds destination address of a frame to that of the device it arrived on. 2091da177e4SLinus Torvalds 2101da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 2111da177e4SLinus Torvalds 2121da177e4SLinus Torvaldsconfig BRIDGE_EBT_SNAT 2131da177e4SLinus Torvalds tristate "ebt: snat target support" 2141da177e4SLinus Torvalds help 2151da177e4SLinus Torvalds This option adds the MAC SNAT target, which allows altering the MAC 2161da177e4SLinus Torvalds source address of frames. 2171da177e4SLinus Torvalds 2181da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 2191da177e4SLinus Torvalds# 2201da177e4SLinus Torvalds# watchers 2211da177e4SLinus Torvalds# 2221da177e4SLinus Torvaldsconfig BRIDGE_EBT_LOG 2231da177e4SLinus Torvalds tristate "ebt: log support" 2241da177e4SLinus Torvalds help 2251da177e4SLinus Torvalds This option adds the log watcher, that you can use in any rule 2261da177e4SLinus Torvalds in any ebtables table. It records info about the frame header 2271da177e4SLinus Torvalds to the syslog. 2281da177e4SLinus Torvalds 2291da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 2301da177e4SLinus Torvalds 231e7bfd0a1SPeter Warasinconfig BRIDGE_EBT_NFLOG 232e7bfd0a1SPeter Warasin tristate "ebt: nflog support" 233e7bfd0a1SPeter Warasin help 234e7bfd0a1SPeter Warasin This option enables the nflog watcher, which allows to LOG 235e7bfd0a1SPeter Warasin messages through the netfilter logging API, which can use 236e7bfd0a1SPeter Warasin either the old LOG target, the old ULOG target or nfnetlink_log 237e7bfd0a1SPeter Warasin as backend. 238e7bfd0a1SPeter Warasin 23958de7862SPatrick McHardy This option adds the nflog watcher, that you can use in any rule 240e7bfd0a1SPeter Warasin in any ebtables table. 241e7bfd0a1SPeter Warasin 242e7bfd0a1SPeter Warasin To compile it as a module, choose M here. If unsure, say N. 243e7bfd0a1SPeter Warasin 24420f3c56fSJan Engelhardtendif # BRIDGE_NF_EBTABLES 245