11da177e4SLinus Torvalds# 21da177e4SLinus Torvalds# Bridge netfilter configuration 31da177e4SLinus Torvalds# 496518518SPatrick McHardy# 5f5efc696STomasz Bursztykamenuconfig NF_TABLES_BRIDGE 66e078bc2SPablo Neira Ayuso depends on NF_TABLES 7f5efc696STomasz Bursztyka select BRIDGE_NETFILTER 896518518SPatrick McHardy tristate "Ethernet Bridge nf_tables support" 91da177e4SLinus Torvalds 10f5efc696STomasz Bursztykaif NF_TABLES_BRIDGE 11f5efc696STomasz Bursztyka 12f5efc696STomasz Bursztykaconfig NFT_BRIDGE_META 13f5efc696STomasz Bursztyka tristate "Netfilter nf_table bridge meta support" 14f5efc696STomasz Bursztyka depends on NFT_META 15f5efc696STomasz Bursztyka help 16f5efc696STomasz Bursztyka Add support for bridge dedicated meta key. 17f5efc696STomasz Bursztyka 18f5efc696STomasz Bursztykaendif # NF_TABLES_BRIDGE 19f5efc696STomasz Bursztyka 2020f3c56fSJan Engelhardtmenuconfig BRIDGE_NF_EBTABLES 211da177e4SLinus Torvalds tristate "Ethernet Bridge tables (ebtables) support" 229823d9ffSBart De Schuymer depends on BRIDGE && NETFILTER 23f5efc696STomasz Bursztyka select BRIDGE_NETFILTER 24043ef46cSJan Engelhardt select NETFILTER_XTABLES 251da177e4SLinus Torvalds help 261da177e4SLinus Torvalds ebtables is a general, extensible frame/packet identification 271da177e4SLinus Torvalds framework. Say 'Y' or 'M' here if you want to do Ethernet 281da177e4SLinus Torvalds filtering/NAT/brouting on the Ethernet bridge. 2920f3c56fSJan Engelhardt 3020f3c56fSJan Engelhardtif BRIDGE_NF_EBTABLES 3120f3c56fSJan Engelhardt 321da177e4SLinus Torvalds# 331da177e4SLinus Torvalds# tables 341da177e4SLinus Torvalds# 351da177e4SLinus Torvaldsconfig BRIDGE_EBT_BROUTE 361da177e4SLinus Torvalds tristate "ebt: broute table support" 371da177e4SLinus Torvalds help 381da177e4SLinus Torvalds The ebtables broute table is used to define rules that decide between 391da177e4SLinus Torvalds bridging and routing frames, giving Linux the functionality of a 401da177e4SLinus Torvalds brouter. See the man page for ebtables(8) and examples on the ebtables 411da177e4SLinus Torvalds website. 421da177e4SLinus Torvalds 431da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 441da177e4SLinus Torvalds 451da177e4SLinus Torvaldsconfig BRIDGE_EBT_T_FILTER 461da177e4SLinus Torvalds tristate "ebt: filter table support" 471da177e4SLinus Torvalds help 481da177e4SLinus Torvalds The ebtables filter table is used to define frame filtering rules at 491da177e4SLinus Torvalds local input, forwarding and local output. See the man page for 501da177e4SLinus Torvalds ebtables(8). 511da177e4SLinus Torvalds 521da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 531da177e4SLinus Torvalds 541da177e4SLinus Torvaldsconfig BRIDGE_EBT_T_NAT 551da177e4SLinus Torvalds tristate "ebt: nat table support" 561da177e4SLinus Torvalds help 571da177e4SLinus Torvalds The ebtables nat table is used to define rules that alter the MAC 581da177e4SLinus Torvalds source address (MAC SNAT) or the MAC destination address (MAC DNAT). 591da177e4SLinus Torvalds See the man page for ebtables(8). 601da177e4SLinus Torvalds 611da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 621da177e4SLinus Torvalds# 631da177e4SLinus Torvalds# matches 641da177e4SLinus Torvalds# 651da177e4SLinus Torvaldsconfig BRIDGE_EBT_802_3 661da177e4SLinus Torvalds tristate "ebt: 802.3 filter support" 671da177e4SLinus Torvalds help 681da177e4SLinus Torvalds This option adds matching support for 802.3 Ethernet frames. 691da177e4SLinus Torvalds 701da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 711da177e4SLinus Torvalds 721da177e4SLinus Torvaldsconfig BRIDGE_EBT_AMONG 731da177e4SLinus Torvalds tristate "ebt: among filter support" 741da177e4SLinus Torvalds help 751da177e4SLinus Torvalds This option adds the among match, which allows matching the MAC source 761da177e4SLinus Torvalds and/or destination address on a list of addresses. Optionally, 771da177e4SLinus Torvalds MAC/IP address pairs can be matched, f.e. for anti-spoofing rules. 781da177e4SLinus Torvalds 791da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 801da177e4SLinus Torvalds 811da177e4SLinus Torvaldsconfig BRIDGE_EBT_ARP 821da177e4SLinus Torvalds tristate "ebt: ARP filter support" 831da177e4SLinus Torvalds help 841da177e4SLinus Torvalds This option adds the ARP match, which allows ARP and RARP header field 851da177e4SLinus Torvalds filtering. 861da177e4SLinus Torvalds 871da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 881da177e4SLinus Torvalds 891da177e4SLinus Torvaldsconfig BRIDGE_EBT_IP 901da177e4SLinus Torvalds tristate "ebt: IP filter support" 911da177e4SLinus Torvalds help 921da177e4SLinus Torvalds This option adds the IP match, which allows basic IP header field 931da177e4SLinus Torvalds filtering. 941da177e4SLinus Torvalds 951da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 961da177e4SLinus Torvalds 9793f65158SKuo-lang Tsengconfig BRIDGE_EBT_IP6 9893f65158SKuo-lang Tseng tristate "ebt: IP6 filter support" 99f586287eSRandy Dunlap depends on BRIDGE_NF_EBTABLES && IPV6 10093f65158SKuo-lang Tseng help 10193f65158SKuo-lang Tseng This option adds the IP6 match, which allows basic IPV6 header field 10293f65158SKuo-lang Tseng filtering. 10393f65158SKuo-lang Tseng 10493f65158SKuo-lang Tseng To compile it as a module, choose M here. If unsure, say N. 10593f65158SKuo-lang Tseng 1061da177e4SLinus Torvaldsconfig BRIDGE_EBT_LIMIT 1071da177e4SLinus Torvalds tristate "ebt: limit match support" 1081da177e4SLinus Torvalds help 1091da177e4SLinus Torvalds This option adds the limit match, which allows you to control 1101da177e4SLinus Torvalds the rate at which a rule can be matched. This match is the 1111da177e4SLinus Torvalds equivalent of the iptables limit match. 1121da177e4SLinus Torvalds 1131da177e4SLinus Torvalds If you want to compile it as a module, say M here and read 1141da177e4SLinus Torvalds <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1151da177e4SLinus Torvalds 1161da177e4SLinus Torvaldsconfig BRIDGE_EBT_MARK 1171da177e4SLinus Torvalds tristate "ebt: mark filter support" 1181da177e4SLinus Torvalds help 1191da177e4SLinus Torvalds This option adds the mark match, which allows matching frames based on 1201da177e4SLinus Torvalds the 'nfmark' value in the frame. This can be set by the mark target. 1211da177e4SLinus Torvalds This value is the same as the one used in the iptables mark match and 1221da177e4SLinus Torvalds target. 1231da177e4SLinus Torvalds 1241da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1251da177e4SLinus Torvalds 1261da177e4SLinus Torvaldsconfig BRIDGE_EBT_PKTTYPE 1271da177e4SLinus Torvalds tristate "ebt: packet type filter support" 1281da177e4SLinus Torvalds help 1291da177e4SLinus Torvalds This option adds the packet type match, which allows matching on the 1301da177e4SLinus Torvalds type of packet based on its Ethernet "class" (as determined by 1311da177e4SLinus Torvalds the generic networking code): broadcast, multicast, 1321da177e4SLinus Torvalds for this host alone or for another host. 1331da177e4SLinus Torvalds 1341da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1351da177e4SLinus Torvalds 1361da177e4SLinus Torvaldsconfig BRIDGE_EBT_STP 1371da177e4SLinus Torvalds tristate "ebt: STP filter support" 1381da177e4SLinus Torvalds help 1391da177e4SLinus Torvalds This option adds the Spanning Tree Protocol match, which 1401da177e4SLinus Torvalds allows STP header field filtering. 1411da177e4SLinus Torvalds 1421da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1431da177e4SLinus Torvalds 1441da177e4SLinus Torvaldsconfig BRIDGE_EBT_VLAN 1451da177e4SLinus Torvalds tristate "ebt: 802.1Q VLAN filter support" 1461da177e4SLinus Torvalds help 1471da177e4SLinus Torvalds This option adds the 802.1Q vlan match, which allows the filtering of 1481da177e4SLinus Torvalds 802.1Q vlan fields. 1491da177e4SLinus Torvalds 1501da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1511da177e4SLinus Torvalds# 1521da177e4SLinus Torvalds# targets 1531da177e4SLinus Torvalds# 1541da177e4SLinus Torvaldsconfig BRIDGE_EBT_ARPREPLY 1551da177e4SLinus Torvalds tristate "ebt: arp reply target support" 156eb3f8f5eSAdrian Bunk depends on BRIDGE_NF_EBTABLES && INET 1571da177e4SLinus Torvalds help 1581da177e4SLinus Torvalds This option adds the arp reply target, which allows 1591da177e4SLinus Torvalds automatically sending arp replies to arp requests. 1601da177e4SLinus Torvalds 1611da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1621da177e4SLinus Torvalds 1631da177e4SLinus Torvaldsconfig BRIDGE_EBT_DNAT 1641da177e4SLinus Torvalds tristate "ebt: dnat target support" 1651da177e4SLinus Torvalds help 1661da177e4SLinus Torvalds This option adds the MAC DNAT target, which allows altering the MAC 1671da177e4SLinus Torvalds destination address of frames. 1681da177e4SLinus Torvalds 1691da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1701da177e4SLinus Torvalds 1711da177e4SLinus Torvaldsconfig BRIDGE_EBT_MARK_T 1721da177e4SLinus Torvalds tristate "ebt: mark target support" 1731da177e4SLinus Torvalds help 1741da177e4SLinus Torvalds This option adds the mark target, which allows marking frames by 1751da177e4SLinus Torvalds setting the 'nfmark' value in the frame. 1761da177e4SLinus Torvalds This value is the same as the one used in the iptables mark match and 1771da177e4SLinus Torvalds target. 1781da177e4SLinus Torvalds 1791da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1801da177e4SLinus Torvalds 1811da177e4SLinus Torvaldsconfig BRIDGE_EBT_REDIRECT 1821da177e4SLinus Torvalds tristate "ebt: redirect target support" 1831da177e4SLinus Torvalds help 1841da177e4SLinus Torvalds This option adds the MAC redirect target, which allows altering the MAC 1851da177e4SLinus Torvalds destination address of a frame to that of the device it arrived on. 1861da177e4SLinus Torvalds 1871da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1881da177e4SLinus Torvalds 1891da177e4SLinus Torvaldsconfig BRIDGE_EBT_SNAT 1901da177e4SLinus Torvalds tristate "ebt: snat target support" 1911da177e4SLinus Torvalds help 1921da177e4SLinus Torvalds This option adds the MAC SNAT target, which allows altering the MAC 1931da177e4SLinus Torvalds source address of frames. 1941da177e4SLinus Torvalds 1951da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 1961da177e4SLinus Torvalds# 1971da177e4SLinus Torvalds# watchers 1981da177e4SLinus Torvalds# 1991da177e4SLinus Torvaldsconfig BRIDGE_EBT_LOG 2001da177e4SLinus Torvalds tristate "ebt: log support" 2011da177e4SLinus Torvalds help 2021da177e4SLinus Torvalds This option adds the log watcher, that you can use in any rule 2031da177e4SLinus Torvalds in any ebtables table. It records info about the frame header 2041da177e4SLinus Torvalds to the syslog. 2051da177e4SLinus Torvalds 2061da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 2071da177e4SLinus Torvalds 2081da177e4SLinus Torvaldsconfig BRIDGE_EBT_ULOG 209d5228a4fSBart De Schuymer tristate "ebt: ulog support (OBSOLETE)" 2101da177e4SLinus Torvalds help 211d5228a4fSBart De Schuymer This option enables the old bridge-specific "ebt_ulog" implementation 212d5228a4fSBart De Schuymer which has been obsoleted by the new "nfnetlink_log" code (see 213d5228a4fSBart De Schuymer CONFIG_NETFILTER_NETLINK_LOG). 214d5228a4fSBart De Schuymer 2151da177e4SLinus Torvalds This option adds the ulog watcher, that you can use in any rule 2161da177e4SLinus Torvalds in any ebtables table. The packet is passed to a userspace 2171da177e4SLinus Torvalds logging daemon using netlink multicast sockets. This differs 2181da177e4SLinus Torvalds from the log watcher in the sense that the complete packet is 2191da177e4SLinus Torvalds sent to userspace instead of a descriptive text and that 2201da177e4SLinus Torvalds netlink multicast sockets are used instead of the syslog. 2211da177e4SLinus Torvalds 2221da177e4SLinus Torvalds To compile it as a module, choose M here. If unsure, say N. 2231da177e4SLinus Torvalds 224e7bfd0a1SPeter Warasinconfig BRIDGE_EBT_NFLOG 225e7bfd0a1SPeter Warasin tristate "ebt: nflog support" 226e7bfd0a1SPeter Warasin help 227e7bfd0a1SPeter Warasin This option enables the nflog watcher, which allows to LOG 228e7bfd0a1SPeter Warasin messages through the netfilter logging API, which can use 229e7bfd0a1SPeter Warasin either the old LOG target, the old ULOG target or nfnetlink_log 230e7bfd0a1SPeter Warasin as backend. 231e7bfd0a1SPeter Warasin 23258de7862SPatrick McHardy This option adds the nflog watcher, that you can use in any rule 233e7bfd0a1SPeter Warasin in any ebtables table. 234e7bfd0a1SPeter Warasin 235e7bfd0a1SPeter Warasin To compile it as a module, choose M here. If unsure, say N. 236e7bfd0a1SPeter Warasin 23720f3c56fSJan Engelhardtendif # BRIDGE_NF_EBTABLES 238