1# 2# Bridge netfilter configuration 3# 4# 5menuconfig NF_TABLES_BRIDGE 6 depends on BRIDGE && NETFILTER && NF_TABLES 7 select NETFILTER_FAMILY_BRIDGE 8 bool "Ethernet Bridge nf_tables support" 9 10if NF_TABLES_BRIDGE 11config NFT_BRIDGE_REJECT 12 tristate "Netfilter nf_tables bridge reject support" 13 depends on NFT_REJECT && NFT_REJECT_IPV4 && NFT_REJECT_IPV6 14 help 15 Add support to reject packets. 16 17config NF_LOG_BRIDGE 18 tristate "Bridge packet logging" 19 select NF_LOG_COMMON 20 21endif # NF_TABLES_BRIDGE 22 23menuconfig BRIDGE_NF_EBTABLES 24 tristate "Ethernet Bridge tables (ebtables) support" 25 depends on BRIDGE && NETFILTER && NETFILTER_XTABLES 26 select NETFILTER_FAMILY_BRIDGE 27 help 28 ebtables is a general, extensible frame/packet identification 29 framework. Say 'Y' or 'M' here if you want to do Ethernet 30 filtering/NAT/brouting on the Ethernet bridge. 31 32if BRIDGE_NF_EBTABLES 33 34# 35# tables 36# 37config BRIDGE_EBT_BROUTE 38 tristate "ebt: broute table support" 39 help 40 The ebtables broute table is used to define rules that decide between 41 bridging and routing frames, giving Linux the functionality of a 42 brouter. See the man page for ebtables(8) and examples on the ebtables 43 website. 44 45 To compile it as a module, choose M here. If unsure, say N. 46 47config BRIDGE_EBT_T_FILTER 48 tristate "ebt: filter table support" 49 help 50 The ebtables filter table is used to define frame filtering rules at 51 local input, forwarding and local output. See the man page for 52 ebtables(8). 53 54 To compile it as a module, choose M here. If unsure, say N. 55 56config BRIDGE_EBT_T_NAT 57 tristate "ebt: nat table support" 58 help 59 The ebtables nat table is used to define rules that alter the MAC 60 source address (MAC SNAT) or the MAC destination address (MAC DNAT). 61 See the man page for ebtables(8). 62 63 To compile it as a module, choose M here. If unsure, say N. 64# 65# matches 66# 67config BRIDGE_EBT_802_3 68 tristate "ebt: 802.3 filter support" 69 help 70 This option adds matching support for 802.3 Ethernet frames. 71 72 To compile it as a module, choose M here. If unsure, say N. 73 74config BRIDGE_EBT_AMONG 75 tristate "ebt: among filter support" 76 help 77 This option adds the among match, which allows matching the MAC source 78 and/or destination address on a list of addresses. Optionally, 79 MAC/IP address pairs can be matched, f.e. for anti-spoofing rules. 80 81 To compile it as a module, choose M here. If unsure, say N. 82 83config BRIDGE_EBT_ARP 84 tristate "ebt: ARP filter support" 85 help 86 This option adds the ARP match, which allows ARP and RARP header field 87 filtering. 88 89 To compile it as a module, choose M here. If unsure, say N. 90 91config BRIDGE_EBT_IP 92 tristate "ebt: IP filter support" 93 help 94 This option adds the IP match, which allows basic IP header field 95 filtering. 96 97 To compile it as a module, choose M here. If unsure, say N. 98 99config BRIDGE_EBT_IP6 100 tristate "ebt: IP6 filter support" 101 depends on BRIDGE_NF_EBTABLES && IPV6 102 help 103 This option adds the IP6 match, which allows basic IPV6 header field 104 filtering. 105 106 To compile it as a module, choose M here. If unsure, say N. 107 108config BRIDGE_EBT_LIMIT 109 tristate "ebt: limit match support" 110 help 111 This option adds the limit match, which allows you to control 112 the rate at which a rule can be matched. This match is the 113 equivalent of the iptables limit match. 114 115 If you want to compile it as a module, say M here and read 116 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 117 118config BRIDGE_EBT_MARK 119 tristate "ebt: mark filter support" 120 help 121 This option adds the mark match, which allows matching frames based on 122 the 'nfmark' value in the frame. This can be set by the mark target. 123 This value is the same as the one used in the iptables mark match and 124 target. 125 126 To compile it as a module, choose M here. If unsure, say N. 127 128config BRIDGE_EBT_PKTTYPE 129 tristate "ebt: packet type filter support" 130 help 131 This option adds the packet type match, which allows matching on the 132 type of packet based on its Ethernet "class" (as determined by 133 the generic networking code): broadcast, multicast, 134 for this host alone or for another host. 135 136 To compile it as a module, choose M here. If unsure, say N. 137 138config BRIDGE_EBT_STP 139 tristate "ebt: STP filter support" 140 help 141 This option adds the Spanning Tree Protocol match, which 142 allows STP header field filtering. 143 144 To compile it as a module, choose M here. If unsure, say N. 145 146config BRIDGE_EBT_VLAN 147 tristate "ebt: 802.1Q VLAN filter support" 148 help 149 This option adds the 802.1Q vlan match, which allows the filtering of 150 802.1Q vlan fields. 151 152 To compile it as a module, choose M here. If unsure, say N. 153# 154# targets 155# 156config BRIDGE_EBT_ARPREPLY 157 tristate "ebt: arp reply target support" 158 depends on BRIDGE_NF_EBTABLES && INET 159 help 160 This option adds the arp reply target, which allows 161 automatically sending arp replies to arp requests. 162 163 To compile it as a module, choose M here. If unsure, say N. 164 165config BRIDGE_EBT_DNAT 166 tristate "ebt: dnat target support" 167 help 168 This option adds the MAC DNAT target, which allows altering the MAC 169 destination address of frames. 170 171 To compile it as a module, choose M here. If unsure, say N. 172 173config BRIDGE_EBT_MARK_T 174 tristate "ebt: mark target support" 175 help 176 This option adds the mark target, which allows marking frames by 177 setting the 'nfmark' value in the frame. 178 This value is the same as the one used in the iptables mark match and 179 target. 180 181 To compile it as a module, choose M here. If unsure, say N. 182 183config BRIDGE_EBT_REDIRECT 184 tristate "ebt: redirect target support" 185 help 186 This option adds the MAC redirect target, which allows altering the MAC 187 destination address of a frame to that of the device it arrived on. 188 189 To compile it as a module, choose M here. If unsure, say N. 190 191config BRIDGE_EBT_SNAT 192 tristate "ebt: snat target support" 193 help 194 This option adds the MAC SNAT target, which allows altering the MAC 195 source address of frames. 196 197 To compile it as a module, choose M here. If unsure, say N. 198# 199# watchers 200# 201config BRIDGE_EBT_LOG 202 tristate "ebt: log support" 203 help 204 This option adds the log watcher, that you can use in any rule 205 in any ebtables table. It records info about the frame header 206 to the syslog. 207 208 To compile it as a module, choose M here. If unsure, say N. 209 210config BRIDGE_EBT_NFLOG 211 tristate "ebt: nflog support" 212 help 213 This option enables the nflog watcher, which allows to LOG 214 messages through the netfilter logging API, which can use 215 either the old LOG target, the old ULOG target or nfnetlink_log 216 as backend. 217 218 This option adds the nflog watcher, that you can use in any rule 219 in any ebtables table. 220 221 To compile it as a module, choose M here. If unsure, say N. 222 223endif # BRIDGE_NF_EBTABLES 224