1# SPDX-License-Identifier: GPL-2.0-only 2menu "Core Netfilter Configuration" 3 depends on INET && NETFILTER 4 5config NETFILTER_INGRESS 6 bool "Netfilter ingress support" 7 default y 8 select NET_INGRESS 9 help 10 This allows you to classify packets from ingress using the Netfilter 11 infrastructure. 12 13config NETFILTER_NETLINK 14 tristate 15 16config NETFILTER_FAMILY_BRIDGE 17 bool 18 19config NETFILTER_FAMILY_ARP 20 bool 21 22config NETFILTER_NETLINK_HOOK 23 tristate "Netfilter base hook dump support" 24 depends on NETFILTER_ADVANCED 25 depends on NF_TABLES 26 select NETFILTER_NETLINK 27 help 28 If this option is enabled, the kernel will include support 29 to list the base netfilter hooks via NFNETLINK. 30 This is helpful for debugging. 31 32config NETFILTER_NETLINK_ACCT 33 tristate "Netfilter NFACCT over NFNETLINK interface" 34 depends on NETFILTER_ADVANCED 35 select NETFILTER_NETLINK 36 help 37 If this option is enabled, the kernel will include support 38 for extended accounting via NFNETLINK. 39 40config NETFILTER_NETLINK_QUEUE 41 tristate "Netfilter NFQUEUE over NFNETLINK interface" 42 depends on NETFILTER_ADVANCED 43 select NETFILTER_NETLINK 44 help 45 If this option is enabled, the kernel will include support 46 for queueing packets via NFNETLINK. 47 48config NETFILTER_NETLINK_LOG 49 tristate "Netfilter LOG over NFNETLINK interface" 50 default m if NETFILTER_ADVANCED=n 51 select NETFILTER_NETLINK 52 help 53 If this option is enabled, the kernel will include support 54 for logging packets via NFNETLINK. 55 56 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 57 and is also scheduled to replace the old syslog-based ipt_LOG 58 and ip6t_LOG modules. 59 60config NETFILTER_NETLINK_OSF 61 tristate "Netfilter OSF over NFNETLINK interface" 62 depends on NETFILTER_ADVANCED 63 select NETFILTER_NETLINK 64 help 65 If this option is enabled, the kernel will include support 66 for passive OS fingerprint via NFNETLINK. 67 68config NF_CONNTRACK 69 tristate "Netfilter connection tracking support" 70 default m if NETFILTER_ADVANCED=n 71 select NF_DEFRAG_IPV4 72 select NF_DEFRAG_IPV6 if IPV6 != n 73 help 74 Connection tracking keeps a record of what packets have passed 75 through your machine, in order to figure out how they are related 76 into connections. 77 78 This is required to do Masquerading or other kinds of Network 79 Address Translation. It can also be used to enhance packet 80 filtering (see `Connection state match support' below). 81 82 To compile it as a module, choose M here. If unsure, say N. 83 84config NF_LOG_SYSLOG 85 tristate "Syslog packet logging" 86 default m if NETFILTER_ADVANCED=n 87 help 88 This option enable support for packet logging via syslog. 89 It supports IPv4, IPV6, ARP and common transport protocols such 90 as TCP and UDP. 91 This is a simpler but less flexible logging method compared to 92 CONFIG_NETFILTER_NETLINK_LOG. 93 If both are enabled the backend to use can be configured at run-time 94 by means of per-address-family sysctl tunables. 95 96if NF_CONNTRACK 97config NETFILTER_CONNCOUNT 98 tristate 99 100config NF_CONNTRACK_MARK 101 bool 'Connection mark tracking support' 102 depends on NETFILTER_ADVANCED 103 help 104 This option enables support for connection marks, used by the 105 `CONNMARK' target and `connmark' match. Similar to the mark value 106 of packets, but this mark value is kept in the conntrack session 107 instead of the individual packets. 108 109config NF_CONNTRACK_SECMARK 110 bool 'Connection tracking security mark support' 111 depends on NETWORK_SECMARK 112 default m if NETFILTER_ADVANCED=n 113 help 114 This option enables security markings to be applied to 115 connections. Typically they are copied to connections from 116 packets using the CONNSECMARK target and copied back from 117 connections to packets with the same target, with the packets 118 being originally labeled via SECMARK. 119 120 If unsure, say 'N'. 121 122config NF_CONNTRACK_ZONES 123 bool 'Connection tracking zones' 124 depends on NETFILTER_ADVANCED 125 help 126 This option enables support for connection tracking zones. 127 Normally, each connection needs to have a unique system wide 128 identity. Connection tracking zones allow to have multiple 129 connections using the same identity, as long as they are 130 contained in different zones. 131 132 If unsure, say `N'. 133 134config NF_CONNTRACK_PROCFS 135 bool "Supply CT list in procfs (OBSOLETE)" 136 default y 137 depends on PROC_FS 138 help 139 This option enables for the list of known conntrack entries 140 to be shown in procfs under net/netfilter/nf_conntrack. This 141 is considered obsolete in favor of using the conntrack(8) 142 tool which uses Netlink. 143 144config NF_CONNTRACK_EVENTS 145 bool "Connection tracking events" 146 depends on NETFILTER_ADVANCED 147 help 148 If this option is enabled, the connection tracking code will 149 provide a notifier chain that can be used by other kernel code 150 to get notified about changes in the connection tracking state. 151 152 If unsure, say `N'. 153 154config NF_CONNTRACK_TIMEOUT 155 bool 'Connection tracking timeout' 156 depends on NETFILTER_ADVANCED 157 help 158 This option enables support for connection tracking timeout 159 extension. This allows you to attach timeout policies to flow 160 via the CT target. 161 162 If unsure, say `N'. 163 164config NF_CONNTRACK_TIMESTAMP 165 bool 'Connection tracking timestamping' 166 depends on NETFILTER_ADVANCED 167 help 168 This option enables support for connection tracking timestamping. 169 This allows you to store the flow start-time and to obtain 170 the flow-stop time (once it has been destroyed) via Connection 171 tracking events. 172 173 If unsure, say `N'. 174 175config NF_CONNTRACK_LABELS 176 bool "Connection tracking labels" 177 help 178 This option enables support for assigning user-defined flag bits 179 to connection tracking entries. It can be used with xtables connlabel 180 match and the nftables ct expression. 181 182config NF_CT_PROTO_DCCP 183 bool 'DCCP protocol connection tracking support' 184 depends on NETFILTER_ADVANCED 185 default y 186 help 187 With this option enabled, the layer 3 independent connection 188 tracking code will be able to do state tracking on DCCP connections. 189 190 If unsure, say Y. 191 192config NF_CT_PROTO_GRE 193 bool 194 195config NF_CT_PROTO_SCTP 196 bool 'SCTP protocol connection tracking support' 197 depends on NETFILTER_ADVANCED 198 default y 199 select LIBCRC32C 200 help 201 With this option enabled, the layer 3 independent connection 202 tracking code will be able to do state tracking on SCTP connections. 203 204 If unsure, say Y. 205 206config NF_CT_PROTO_UDPLITE 207 bool 'UDP-Lite protocol connection tracking support' 208 depends on NETFILTER_ADVANCED 209 default y 210 help 211 With this option enabled, the layer 3 independent connection 212 tracking code will be able to do state tracking on UDP-Lite 213 connections. 214 215 If unsure, say Y. 216 217config NF_CONNTRACK_AMANDA 218 tristate "Amanda backup protocol support" 219 depends on NETFILTER_ADVANCED 220 select TEXTSEARCH 221 select TEXTSEARCH_KMP 222 help 223 If you are running the Amanda backup package <http://www.amanda.org/> 224 on this machine or machines that will be MASQUERADED through this 225 machine, then you may want to enable this feature. This allows the 226 connection tracking and natting code to allow the sub-channels that 227 Amanda requires for communication of the backup data, messages and 228 index. 229 230 To compile it as a module, choose M here. If unsure, say N. 231 232config NF_CONNTRACK_FTP 233 tristate "FTP protocol support" 234 default m if NETFILTER_ADVANCED=n 235 help 236 Tracking FTP connections is problematic: special helpers are 237 required for tracking them, and doing masquerading and other forms 238 of Network Address Translation on them. 239 240 This is FTP support on Layer 3 independent connection tracking. 241 242 To compile it as a module, choose M here. If unsure, say N. 243 244config NF_CONNTRACK_H323 245 tristate "H.323 protocol support" 246 depends on IPV6 || IPV6=n 247 depends on NETFILTER_ADVANCED 248 help 249 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 250 important VoIP protocols, it is widely used by voice hardware and 251 software including voice gateways, IP phones, Netmeeting, OpenPhone, 252 Gnomemeeting, etc. 253 254 With this module you can support H.323 on a connection tracking/NAT 255 firewall. 256 257 This module supports RAS, Fast Start, H.245 Tunnelling, Call 258 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 259 whiteboard, file transfer, etc. For more information, please 260 visit http://nath323.sourceforge.net/. 261 262 To compile it as a module, choose M here. If unsure, say N. 263 264config NF_CONNTRACK_IRC 265 tristate "IRC protocol support" 266 default m if NETFILTER_ADVANCED=n 267 help 268 There is a commonly-used extension to IRC called 269 Direct Client-to-Client Protocol (DCC). This enables users to send 270 files to each other, and also chat to each other without the need 271 of a server. DCC Sending is used anywhere you send files over IRC, 272 and DCC Chat is most commonly used by Eggdrop bots. If you are 273 using NAT, this extension will enable you to send files and initiate 274 chats. Note that you do NOT need this extension to get files or 275 have others initiate chats, or everything else in IRC. 276 277 To compile it as a module, choose M here. If unsure, say N. 278 279config NF_CONNTRACK_BROADCAST 280 tristate 281 282config NF_CONNTRACK_NETBIOS_NS 283 tristate "NetBIOS name service protocol support" 284 select NF_CONNTRACK_BROADCAST 285 help 286 NetBIOS name service requests are sent as broadcast messages from an 287 unprivileged port and responded to with unicast messages to the 288 same port. This make them hard to firewall properly because connection 289 tracking doesn't deal with broadcasts. This helper tracks locally 290 originating NetBIOS name service requests and the corresponding 291 responses. It relies on correct IP address configuration, specifically 292 netmask and broadcast address. When properly configured, the output 293 of "ip address show" should look similar to this: 294 295 $ ip -4 address show eth0 296 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 297 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 298 299 To compile it as a module, choose M here. If unsure, say N. 300 301config NF_CONNTRACK_SNMP 302 tristate "SNMP service protocol support" 303 depends on NETFILTER_ADVANCED 304 select NF_CONNTRACK_BROADCAST 305 help 306 SNMP service requests are sent as broadcast messages from an 307 unprivileged port and responded to with unicast messages to the 308 same port. This make them hard to firewall properly because connection 309 tracking doesn't deal with broadcasts. This helper tracks locally 310 originating SNMP service requests and the corresponding 311 responses. It relies on correct IP address configuration, specifically 312 netmask and broadcast address. 313 314 To compile it as a module, choose M here. If unsure, say N. 315 316config NF_CONNTRACK_PPTP 317 tristate "PPtP protocol support" 318 depends on NETFILTER_ADVANCED 319 select NF_CT_PROTO_GRE 320 help 321 This module adds support for PPTP (Point to Point Tunnelling 322 Protocol, RFC2637) connection tracking and NAT. 323 324 If you are running PPTP sessions over a stateful firewall or NAT 325 box, you may want to enable this feature. 326 327 Please note that not all PPTP modes of operation are supported yet. 328 Specifically these limitations exist: 329 - Blindly assumes that control connections are always established 330 in PNS->PAC direction. This is a violation of RFC2637. 331 - Only supports a single call within each session 332 333 To compile it as a module, choose M here. If unsure, say N. 334 335config NF_CONNTRACK_SANE 336 tristate "SANE protocol support" 337 depends on NETFILTER_ADVANCED 338 help 339 SANE is a protocol for remote access to scanners as implemented 340 by the 'saned' daemon. Like FTP, it uses separate control and 341 data connections. 342 343 With this module you can support SANE on a connection tracking 344 firewall. 345 346 To compile it as a module, choose M here. If unsure, say N. 347 348config NF_CONNTRACK_SIP 349 tristate "SIP protocol support" 350 default m if NETFILTER_ADVANCED=n 351 help 352 SIP is an application-layer control protocol that can establish, 353 modify, and terminate multimedia sessions (conferences) such as 354 Internet telephony calls. With the nf_conntrack_sip and 355 the nf_nat_sip modules you can support the protocol on a connection 356 tracking/NATing firewall. 357 358 To compile it as a module, choose M here. If unsure, say N. 359 360config NF_CONNTRACK_TFTP 361 tristate "TFTP protocol support" 362 depends on NETFILTER_ADVANCED 363 help 364 TFTP connection tracking helper, this is required depending 365 on how restrictive your ruleset is. 366 If you are using a tftp client behind -j SNAT or -j MASQUERADING 367 you will need this. 368 369 To compile it as a module, choose M here. If unsure, say N. 370 371config NF_CT_NETLINK 372 tristate 'Connection tracking netlink interface' 373 select NETFILTER_NETLINK 374 default m if NETFILTER_ADVANCED=n 375 help 376 This option enables support for a netlink-based userspace interface 377 378config NF_CT_NETLINK_TIMEOUT 379 tristate 'Connection tracking timeout tuning via Netlink' 380 select NETFILTER_NETLINK 381 depends on NETFILTER_ADVANCED 382 depends on NF_CONNTRACK_TIMEOUT 383 help 384 This option enables support for connection tracking timeout 385 fine-grain tuning. This allows you to attach specific timeout 386 policies to flows, instead of using the global timeout policy. 387 388 If unsure, say `N'. 389 390config NF_CT_NETLINK_HELPER 391 tristate 'Connection tracking helpers in user-space via Netlink' 392 select NETFILTER_NETLINK 393 depends on NF_CT_NETLINK 394 depends on NETFILTER_NETLINK_QUEUE 395 depends on NETFILTER_NETLINK_GLUE_CT 396 depends on NETFILTER_ADVANCED 397 help 398 This option enables the user-space connection tracking helpers 399 infrastructure. 400 401 If unsure, say `N'. 402 403config NETFILTER_NETLINK_GLUE_CT 404 bool "NFQUEUE and NFLOG integration with Connection Tracking" 405 default n 406 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 407 help 408 If this option is enabled, NFQUEUE and NFLOG can include 409 Connection Tracking information together with the packet is 410 the enqueued via NFNETLINK. 411 412config NF_NAT 413 tristate "Network Address Translation support" 414 depends on NF_CONNTRACK 415 default m if NETFILTER_ADVANCED=n 416 help 417 The NAT option allows masquerading, port forwarding and other 418 forms of full Network Address Port Translation. This can be 419 controlled by iptables, ip6tables or nft. 420 421config NF_NAT_AMANDA 422 tristate 423 depends on NF_CONNTRACK && NF_NAT 424 default NF_NAT && NF_CONNTRACK_AMANDA 425 426config NF_NAT_FTP 427 tristate 428 depends on NF_CONNTRACK && NF_NAT 429 default NF_NAT && NF_CONNTRACK_FTP 430 431config NF_NAT_IRC 432 tristate 433 depends on NF_CONNTRACK && NF_NAT 434 default NF_NAT && NF_CONNTRACK_IRC 435 436config NF_NAT_SIP 437 tristate 438 depends on NF_CONNTRACK && NF_NAT 439 default NF_NAT && NF_CONNTRACK_SIP 440 441config NF_NAT_TFTP 442 tristate 443 depends on NF_CONNTRACK && NF_NAT 444 default NF_NAT && NF_CONNTRACK_TFTP 445 446config NF_NAT_REDIRECT 447 bool 448 449config NF_NAT_MASQUERADE 450 bool 451 452config NETFILTER_SYNPROXY 453 tristate 454 455endif # NF_CONNTRACK 456 457config NF_TABLES 458 select NETFILTER_NETLINK 459 select LIBCRC32C 460 tristate "Netfilter nf_tables support" 461 help 462 nftables is the new packet classification framework that intends to 463 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 464 provides a pseudo-state machine with an extensible instruction-set 465 (also known as expressions) that the userspace 'nft' utility 466 (https://www.netfilter.org/projects/nftables) uses to build the 467 rule-set. It also comes with the generic set infrastructure that 468 allows you to construct mappings between matchings and actions 469 for performance lookups. 470 471 To compile it as a module, choose M here. 472 473if NF_TABLES 474config NF_TABLES_INET 475 depends on IPV6 476 select NF_TABLES_IPV4 477 select NF_TABLES_IPV6 478 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support" 479 help 480 This option enables support for a mixed IPv4/IPv6 "inet" table. 481 482config NF_TABLES_NETDEV 483 bool "Netfilter nf_tables netdev tables support" 484 help 485 This option enables support for the "netdev" table. 486 487config NFT_NUMGEN 488 tristate "Netfilter nf_tables number generator module" 489 help 490 This option adds the number generator expression used to perform 491 incremental counting and random numbers bound to a upper limit. 492 493config NFT_CT 494 depends on NF_CONNTRACK 495 tristate "Netfilter nf_tables conntrack module" 496 help 497 This option adds the "ct" expression that you can use to match 498 connection tracking information such as the flow state. 499 500config NFT_FLOW_OFFLOAD 501 depends on NF_CONNTRACK && NF_FLOW_TABLE 502 tristate "Netfilter nf_tables hardware flow offload module" 503 help 504 This option adds the "flow_offload" expression that you can use to 505 choose what flows are placed into the hardware. 506 507config NFT_COUNTER 508 tristate "Netfilter nf_tables counter module" 509 help 510 This option adds the "counter" expression that you can use to 511 include packet and byte counters in a rule. 512 513config NFT_CONNLIMIT 514 tristate "Netfilter nf_tables connlimit module" 515 depends on NF_CONNTRACK 516 depends on NETFILTER_ADVANCED 517 select NETFILTER_CONNCOUNT 518 help 519 This option adds the "connlimit" expression that you can use to 520 ratelimit rule matchings per connections. 521 522config NFT_LOG 523 tristate "Netfilter nf_tables log module" 524 help 525 This option adds the "log" expression that you can use to log 526 packets matching some criteria. 527 528config NFT_LIMIT 529 tristate "Netfilter nf_tables limit module" 530 help 531 This option adds the "limit" expression that you can use to 532 ratelimit rule matchings. 533 534config NFT_MASQ 535 depends on NF_CONNTRACK 536 depends on NF_NAT 537 select NF_NAT_MASQUERADE 538 tristate "Netfilter nf_tables masquerade support" 539 help 540 This option adds the "masquerade" expression that you can use 541 to perform NAT in the masquerade flavour. 542 543config NFT_REDIR 544 depends on NF_CONNTRACK 545 depends on NF_NAT 546 tristate "Netfilter nf_tables redirect support" 547 select NF_NAT_REDIRECT 548 help 549 This options adds the "redirect" expression that you can use 550 to perform NAT in the redirect flavour. 551 552config NFT_NAT 553 depends on NF_CONNTRACK 554 select NF_NAT 555 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6 556 tristate "Netfilter nf_tables nat module" 557 help 558 This option adds the "nat" expression that you can use to perform 559 typical Network Address Translation (NAT) packet transformations. 560 561config NFT_TUNNEL 562 tristate "Netfilter nf_tables tunnel module" 563 help 564 This option adds the "tunnel" expression that you can use to set 565 tunneling policies. 566 567config NFT_OBJREF 568 tristate "Netfilter nf_tables stateful object reference module" 569 help 570 This option adds the "objref" expression that allows you to refer to 571 stateful objects, such as counters and quotas. 572 573config NFT_QUEUE 574 depends on NETFILTER_NETLINK_QUEUE 575 tristate "Netfilter nf_tables queue module" 576 help 577 This is required if you intend to use the userspace queueing 578 infrastructure (also known as NFQUEUE) from nftables. 579 580config NFT_QUOTA 581 tristate "Netfilter nf_tables quota module" 582 help 583 This option adds the "quota" expression that you can use to match 584 enforce bytes quotas. 585 586config NFT_REJECT 587 default m if NETFILTER_ADVANCED=n 588 tristate "Netfilter nf_tables reject support" 589 depends on !NF_TABLES_INET || (IPV6!=m || m) 590 help 591 This option adds the "reject" expression that you can use to 592 explicitly deny and notify via TCP reset/ICMP informational errors 593 unallowed traffic. 594 595config NFT_REJECT_INET 596 depends on NF_TABLES_INET 597 default NFT_REJECT 598 tristate 599 600config NFT_COMPAT 601 depends on NETFILTER_XTABLES 602 tristate "Netfilter x_tables over nf_tables module" 603 help 604 This is required if you intend to use any of existing 605 x_tables match/target extensions over the nf_tables 606 framework. 607 608config NFT_HASH 609 tristate "Netfilter nf_tables hash module" 610 help 611 This option adds the "hash" expression that you can use to perform 612 a hash operation on registers. 613 614config NFT_FIB 615 tristate 616 617config NFT_FIB_INET 618 depends on NF_TABLES_INET 619 depends on NFT_FIB_IPV4 620 depends on NFT_FIB_IPV6 621 tristate "Netfilter nf_tables fib inet support" 622 help 623 This option allows using the FIB expression from the inet table. 624 The lookup will be delegated to the IPv4 or IPv6 FIB depending 625 on the protocol of the packet. 626 627config NFT_XFRM 628 tristate "Netfilter nf_tables xfrm/IPSec security association matching" 629 depends on XFRM 630 help 631 This option adds an expression that you can use to extract properties 632 of a packets security association. 633 634config NFT_SOCKET 635 tristate "Netfilter nf_tables socket match support" 636 depends on IPV6 || IPV6=n 637 select NF_SOCKET_IPV4 638 select NF_SOCKET_IPV6 if NF_TABLES_IPV6 639 help 640 This option allows matching for the presence or absence of a 641 corresponding socket and its attributes. 642 643config NFT_OSF 644 tristate "Netfilter nf_tables passive OS fingerprint support" 645 depends on NETFILTER_ADVANCED 646 select NETFILTER_NETLINK_OSF 647 help 648 This option allows matching packets from an specific OS. 649 650config NFT_TPROXY 651 tristate "Netfilter nf_tables tproxy support" 652 depends on IPV6 || IPV6=n 653 select NF_DEFRAG_IPV4 654 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6 655 select NF_TPROXY_IPV4 656 select NF_TPROXY_IPV6 if NF_TABLES_IPV6 657 help 658 This makes transparent proxy support available in nftables. 659 660config NFT_SYNPROXY 661 tristate "Netfilter nf_tables SYNPROXY expression support" 662 depends on NF_CONNTRACK && NETFILTER_ADVANCED 663 select NETFILTER_SYNPROXY 664 select SYN_COOKIES 665 help 666 The SYNPROXY expression allows you to intercept TCP connections and 667 establish them using syncookies before they are passed on to the 668 server. This allows to avoid conntrack and server resource usage 669 during SYN-flood attacks. 670 671if NF_TABLES_NETDEV 672 673config NF_DUP_NETDEV 674 tristate "Netfilter packet duplication support" 675 help 676 This option enables the generic packet duplication infrastructure 677 for Netfilter. 678 679config NFT_DUP_NETDEV 680 tristate "Netfilter nf_tables netdev packet duplication support" 681 select NF_DUP_NETDEV 682 help 683 This option enables packet duplication for the "netdev" family. 684 685config NFT_FWD_NETDEV 686 tristate "Netfilter nf_tables netdev packet forwarding support" 687 select NF_DUP_NETDEV 688 help 689 This option enables packet forwarding for the "netdev" family. 690 691config NFT_FIB_NETDEV 692 depends on NFT_FIB_IPV4 693 depends on NFT_FIB_IPV6 694 tristate "Netfilter nf_tables netdev fib lookups support" 695 help 696 This option allows using the FIB expression from the netdev table. 697 The lookup will be delegated to the IPv4 or IPv6 FIB depending 698 on the protocol of the packet. 699 700config NFT_REJECT_NETDEV 701 depends on NFT_REJECT_IPV4 702 depends on NFT_REJECT_IPV6 703 tristate "Netfilter nf_tables netdev REJECT support" 704 help 705 This option enables the REJECT support from the netdev table. 706 The return packet generation will be delegated to the IPv4 707 or IPv6 ICMP or TCP RST implementation depending on the 708 protocol of the packet. 709 710endif # NF_TABLES_NETDEV 711 712endif # NF_TABLES 713 714config NF_FLOW_TABLE_INET 715 tristate "Netfilter flow table mixed IPv4/IPv6 module" 716 depends on NF_FLOW_TABLE 717 help 718 This option adds the flow table mixed IPv4/IPv6 support. 719 720 To compile it as a module, choose M here. 721 722config NF_FLOW_TABLE 723 tristate "Netfilter flow table module" 724 depends on NETFILTER_INGRESS 725 depends on NF_CONNTRACK 726 depends on NF_TABLES 727 help 728 This option adds the flow table core infrastructure. 729 730 To compile it as a module, choose M here. 731 732config NETFILTER_XTABLES 733 tristate "Netfilter Xtables support (required for ip_tables)" 734 default m if NETFILTER_ADVANCED=n 735 help 736 This is required if you intend to use any of ip_tables, 737 ip6_tables or arp_tables. 738 739if NETFILTER_XTABLES 740 741config NETFILTER_XTABLES_COMPAT 742 bool "Netfilter Xtables 32bit support" 743 depends on COMPAT 744 default y 745 help 746 This option provides a translation layer to run 32bit arp,ip(6),ebtables 747 binaries on 64bit kernels. 748 749 If unsure, say N. 750 751comment "Xtables combined modules" 752 753config NETFILTER_XT_MARK 754 tristate 'nfmark target and match support' 755 default m if NETFILTER_ADVANCED=n 756 help 757 This option adds the "MARK" target and "mark" match. 758 759 Netfilter mark matching allows you to match packets based on the 760 "nfmark" value in the packet. 761 The target allows you to create rules in the "mangle" table which alter 762 the netfilter mark (nfmark) field associated with the packet. 763 764 Prior to routing, the nfmark can influence the routing method and can 765 also be used by other subsystems to change their behavior. 766 767config NETFILTER_XT_CONNMARK 768 tristate 'ctmark target and match support' 769 depends on NF_CONNTRACK 770 depends on NETFILTER_ADVANCED 771 select NF_CONNTRACK_MARK 772 help 773 This option adds the "CONNMARK" target and "connmark" match. 774 775 Netfilter allows you to store a mark value per connection (a.k.a. 776 ctmark), similarly to the packet mark (nfmark). Using this 777 target and match, you can set and match on this mark. 778 779config NETFILTER_XT_SET 780 tristate 'set target and match support' 781 depends on IP_SET 782 depends on NETFILTER_ADVANCED 783 help 784 This option adds the "SET" target and "set" match. 785 786 Using this target and match, you can add/delete and match 787 elements in the sets created by ipset(8). 788 789 To compile it as a module, choose M here. If unsure, say N. 790 791# alphabetically ordered list of targets 792 793comment "Xtables targets" 794 795config NETFILTER_XT_TARGET_AUDIT 796 tristate "AUDIT target support" 797 depends on AUDIT 798 depends on NETFILTER_ADVANCED 799 help 800 This option adds a 'AUDIT' target, which can be used to create 801 audit records for packets dropped/accepted. 802 803 To compileit as a module, choose M here. If unsure, say N. 804 805config NETFILTER_XT_TARGET_CHECKSUM 806 tristate "CHECKSUM target support" 807 depends on IP_NF_MANGLE || IP6_NF_MANGLE 808 depends on NETFILTER_ADVANCED 809 help 810 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 811 table to work around buggy DHCP clients in virtualized environments. 812 813 Some old DHCP clients drop packets because they are not aware 814 that the checksum would normally be offloaded to hardware and 815 thus should be considered valid. 816 This target can be used to fill in the checksum using iptables 817 when such packets are sent via a virtual network device. 818 819 To compile it as a module, choose M here. If unsure, say N. 820 821config NETFILTER_XT_TARGET_CLASSIFY 822 tristate '"CLASSIFY" target support' 823 depends on NETFILTER_ADVANCED 824 help 825 This option adds a `CLASSIFY' target, which enables the user to set 826 the priority of a packet. Some qdiscs can use this value for 827 classification, among these are: 828 829 atm, cbq, dsmark, pfifo_fast, htb, prio 830 831 To compile it as a module, choose M here. If unsure, say N. 832 833config NETFILTER_XT_TARGET_CONNMARK 834 tristate '"CONNMARK" target support' 835 depends on NF_CONNTRACK 836 depends on NETFILTER_ADVANCED 837 select NETFILTER_XT_CONNMARK 838 help 839 This is a backwards-compat option for the user's convenience 840 (e.g. when running oldconfig). It selects 841 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 842 843config NETFILTER_XT_TARGET_CONNSECMARK 844 tristate '"CONNSECMARK" target support' 845 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 846 default m if NETFILTER_ADVANCED=n 847 help 848 The CONNSECMARK target copies security markings from packets 849 to connections, and restores security markings from connections 850 to packets (if the packets are not already marked). This would 851 normally be used in conjunction with the SECMARK target. 852 853 To compile it as a module, choose M here. If unsure, say N. 854 855config NETFILTER_XT_TARGET_CT 856 tristate '"CT" target support' 857 depends on NF_CONNTRACK 858 depends on IP_NF_RAW || IP6_NF_RAW 859 depends on NETFILTER_ADVANCED 860 help 861 This options adds a `CT' target, which allows to specify initial 862 connection tracking parameters like events to be delivered and 863 the helper to be used. 864 865 To compile it as a module, choose M here. If unsure, say N. 866 867config NETFILTER_XT_TARGET_DSCP 868 tristate '"DSCP" and "TOS" target support' 869 depends on IP_NF_MANGLE || IP6_NF_MANGLE 870 depends on NETFILTER_ADVANCED 871 help 872 This option adds a `DSCP' target, which allows you to manipulate 873 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 874 875 The DSCP field can have any value between 0x0 and 0x3f inclusive. 876 877 It also adds the "TOS" target, which allows you to create rules in 878 the "mangle" table which alter the Type Of Service field of an IPv4 879 or the Priority field of an IPv6 packet, prior to routing. 880 881 To compile it as a module, choose M here. If unsure, say N. 882 883config NETFILTER_XT_TARGET_HL 884 tristate '"HL" hoplimit target support' 885 depends on IP_NF_MANGLE || IP6_NF_MANGLE 886 depends on NETFILTER_ADVANCED 887 help 888 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 889 targets, which enable the user to change the 890 hoplimit/time-to-live value of the IP header. 891 892 While it is safe to decrement the hoplimit/TTL value, the 893 modules also allow to increment and set the hoplimit value of 894 the header to arbitrary values. This is EXTREMELY DANGEROUS 895 since you can easily create immortal packets that loop 896 forever on the network. 897 898config NETFILTER_XT_TARGET_HMARK 899 tristate '"HMARK" target support' 900 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 901 depends on NETFILTER_ADVANCED 902 help 903 This option adds the "HMARK" target. 904 905 The target allows you to create rules in the "raw" and "mangle" tables 906 which set the skbuff mark by means of hash calculation within a given 907 range. The nfmark can influence the routing method and can also be used 908 by other subsystems to change their behaviour. 909 910 To compile it as a module, choose M here. If unsure, say N. 911 912config NETFILTER_XT_TARGET_IDLETIMER 913 tristate "IDLETIMER target support" 914 depends on NETFILTER_ADVANCED 915 help 916 917 This option adds the `IDLETIMER' target. Each matching packet 918 resets the timer associated with label specified when the rule is 919 added. When the timer expires, it triggers a sysfs notification. 920 The remaining time for expiration can be read via sysfs. 921 922 To compile it as a module, choose M here. If unsure, say N. 923 924config NETFILTER_XT_TARGET_LED 925 tristate '"LED" target support' 926 depends on LEDS_CLASS && LEDS_TRIGGERS 927 depends on NETFILTER_ADVANCED 928 help 929 This option adds a `LED' target, which allows you to blink LEDs in 930 response to particular packets passing through your machine. 931 932 This can be used to turn a spare LED into a network activity LED, 933 which only flashes in response to FTP transfers, for example. Or 934 you could have an LED which lights up for a minute or two every time 935 somebody connects to your machine via SSH. 936 937 You will need support for the "led" class to make this work. 938 939 To create an LED trigger for incoming SSH traffic: 940 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 941 942 Then attach the new trigger to an LED on your system: 943 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 944 945 For more information on the LEDs available on your system, see 946 Documentation/leds/leds-class.rst 947 948config NETFILTER_XT_TARGET_LOG 949 tristate "LOG target support" 950 select NF_LOG_SYSLOG 951 select NF_LOG_IPV6 if IP6_NF_IPTABLES 952 default m if NETFILTER_ADVANCED=n 953 help 954 This option adds a `LOG' target, which allows you to create rules in 955 any iptables table which records the packet header to the syslog. 956 957 To compile it as a module, choose M here. If unsure, say N. 958 959config NETFILTER_XT_TARGET_MARK 960 tristate '"MARK" target support' 961 depends on NETFILTER_ADVANCED 962 select NETFILTER_XT_MARK 963 help 964 This is a backwards-compat option for the user's convenience 965 (e.g. when running oldconfig). It selects 966 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 967 968config NETFILTER_XT_NAT 969 tristate '"SNAT and DNAT" targets support' 970 depends on NF_NAT 971 help 972 This option enables the SNAT and DNAT targets. 973 974 To compile it as a module, choose M here. If unsure, say N. 975 976config NETFILTER_XT_TARGET_NETMAP 977 tristate '"NETMAP" target support' 978 depends on NF_NAT 979 help 980 NETMAP is an implementation of static 1:1 NAT mapping of network 981 addresses. It maps the network address part, while keeping the host 982 address part intact. 983 984 To compile it as a module, choose M here. If unsure, say N. 985 986config NETFILTER_XT_TARGET_NFLOG 987 tristate '"NFLOG" target support' 988 default m if NETFILTER_ADVANCED=n 989 select NETFILTER_NETLINK_LOG 990 help 991 This option enables the NFLOG target, which allows to LOG 992 messages through nfnetlink_log. 993 994 To compile it as a module, choose M here. If unsure, say N. 995 996config NETFILTER_XT_TARGET_NFQUEUE 997 tristate '"NFQUEUE" target Support' 998 depends on NETFILTER_ADVANCED 999 select NETFILTER_NETLINK_QUEUE 1000 help 1001 This target replaced the old obsolete QUEUE target. 1002 1003 As opposed to QUEUE, it supports 65535 different queues, 1004 not just one. 1005 1006 To compile it as a module, choose M here. If unsure, say N. 1007 1008config NETFILTER_XT_TARGET_NOTRACK 1009 tristate '"NOTRACK" target support (DEPRECATED)' 1010 depends on NF_CONNTRACK 1011 depends on IP_NF_RAW || IP6_NF_RAW 1012 depends on NETFILTER_ADVANCED 1013 select NETFILTER_XT_TARGET_CT 1014 1015config NETFILTER_XT_TARGET_RATEEST 1016 tristate '"RATEEST" target support' 1017 depends on NETFILTER_ADVANCED 1018 help 1019 This option adds a `RATEEST' target, which allows to measure 1020 rates similar to TC estimators. The `rateest' match can be 1021 used to match on the measured rates. 1022 1023 To compile it as a module, choose M here. If unsure, say N. 1024 1025config NETFILTER_XT_TARGET_REDIRECT 1026 tristate "REDIRECT target support" 1027 depends on NF_NAT 1028 select NF_NAT_REDIRECT 1029 help 1030 REDIRECT is a special case of NAT: all incoming connections are 1031 mapped onto the incoming interface's address, causing the packets to 1032 come to the local machine instead of passing through. This is 1033 useful for transparent proxies. 1034 1035 To compile it as a module, choose M here. If unsure, say N. 1036 1037config NETFILTER_XT_TARGET_MASQUERADE 1038 tristate "MASQUERADE target support" 1039 depends on NF_NAT 1040 default m if NETFILTER_ADVANCED=n 1041 select NF_NAT_MASQUERADE 1042 help 1043 Masquerading is a special case of NAT: all outgoing connections are 1044 changed to seem to come from a particular interface's address, and 1045 if the interface goes down, those connections are lost. This is 1046 only useful for dialup accounts with dynamic IP address (ie. your IP 1047 address will be different on next dialup). 1048 1049 To compile it as a module, choose M here. If unsure, say N. 1050 1051config NETFILTER_XT_TARGET_TEE 1052 tristate '"TEE" - packet cloning to alternate destination' 1053 depends on NETFILTER_ADVANCED 1054 depends on IPV6 || IPV6=n 1055 depends on !NF_CONNTRACK || NF_CONNTRACK 1056 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES 1057 select NF_DUP_IPV4 1058 select NF_DUP_IPV6 if IP6_NF_IPTABLES 1059 help 1060 This option adds a "TEE" target with which a packet can be cloned and 1061 this clone be rerouted to another nexthop. 1062 1063config NETFILTER_XT_TARGET_TPROXY 1064 tristate '"TPROXY" target transparent proxying support' 1065 depends on NETFILTER_XTABLES 1066 depends on NETFILTER_ADVANCED 1067 depends on IPV6 || IPV6=n 1068 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1069 depends on IP_NF_MANGLE 1070 select NF_DEFRAG_IPV4 1071 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1072 select NF_TPROXY_IPV4 1073 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES 1074 help 1075 This option adds a `TPROXY' target, which is somewhat similar to 1076 REDIRECT. It can only be used in the mangle table and is useful 1077 to redirect traffic to a transparent proxy. It does _not_ depend 1078 on Netfilter connection tracking and NAT, unlike REDIRECT. 1079 For it to work you will have to configure certain iptables rules 1080 and use policy routing. For more information on how to set it up 1081 see Documentation/networking/tproxy.rst. 1082 1083 To compile it as a module, choose M here. If unsure, say N. 1084 1085config NETFILTER_XT_TARGET_TRACE 1086 tristate '"TRACE" target support' 1087 depends on IP_NF_RAW || IP6_NF_RAW 1088 depends on NETFILTER_ADVANCED 1089 help 1090 The TRACE target allows you to mark packets so that the kernel 1091 will log every rule which match the packets as those traverse 1092 the tables, chains, rules. 1093 1094 If you want to compile it as a module, say M here and read 1095 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1096 1097config NETFILTER_XT_TARGET_SECMARK 1098 tristate '"SECMARK" target support' 1099 depends on NETWORK_SECMARK 1100 default m if NETFILTER_ADVANCED=n 1101 help 1102 The SECMARK target allows security marking of network 1103 packets, for use with security subsystems. 1104 1105 To compile it as a module, choose M here. If unsure, say N. 1106 1107config NETFILTER_XT_TARGET_TCPMSS 1108 tristate '"TCPMSS" target support' 1109 depends on IPV6 || IPV6=n 1110 default m if NETFILTER_ADVANCED=n 1111 help 1112 This option adds a `TCPMSS' target, which allows you to alter the 1113 MSS value of TCP SYN packets, to control the maximum size for that 1114 connection (usually limiting it to your outgoing interface's MTU 1115 minus 40). 1116 1117 This is used to overcome criminally braindead ISPs or servers which 1118 block ICMP Fragmentation Needed packets. The symptoms of this 1119 problem are that everything works fine from your Linux 1120 firewall/router, but machines behind it can never exchange large 1121 packets: 1122 1) Web browsers connect, then hang with no data received. 1123 2) Small mail works fine, but large emails hang. 1124 3) ssh works fine, but scp hangs after initial handshaking. 1125 1126 Workaround: activate this option and add a rule to your firewall 1127 configuration like: 1128 1129 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1130 -j TCPMSS --clamp-mss-to-pmtu 1131 1132 To compile it as a module, choose M here. If unsure, say N. 1133 1134config NETFILTER_XT_TARGET_TCPOPTSTRIP 1135 tristate '"TCPOPTSTRIP" target support' 1136 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1137 depends on NETFILTER_ADVANCED 1138 help 1139 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1140 TCP options from TCP packets. 1141 1142# alphabetically ordered list of matches 1143 1144comment "Xtables matches" 1145 1146config NETFILTER_XT_MATCH_ADDRTYPE 1147 tristate '"addrtype" address type match support' 1148 default m if NETFILTER_ADVANCED=n 1149 help 1150 This option allows you to match what routing thinks of an address, 1151 eg. UNICAST, LOCAL, BROADCAST, ... 1152 1153 If you want to compile it as a module, say M here and read 1154 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1155 1156config NETFILTER_XT_MATCH_BPF 1157 tristate '"bpf" match support' 1158 depends on NETFILTER_ADVANCED 1159 help 1160 BPF matching applies a linux socket filter to each packet and 1161 accepts those for which the filter returns non-zero. 1162 1163 To compile it as a module, choose M here. If unsure, say N. 1164 1165config NETFILTER_XT_MATCH_CGROUP 1166 tristate '"control group" match support' 1167 depends on NETFILTER_ADVANCED 1168 depends on CGROUPS 1169 select CGROUP_NET_CLASSID 1170 help 1171 Socket/process control group matching allows you to match locally 1172 generated packets based on which net_cls control group processes 1173 belong to. 1174 1175config NETFILTER_XT_MATCH_CLUSTER 1176 tristate '"cluster" match support' 1177 depends on NF_CONNTRACK 1178 depends on NETFILTER_ADVANCED 1179 help 1180 This option allows you to build work-load-sharing clusters of 1181 network servers/stateful firewalls without having a dedicated 1182 load-balancing router/server/switch. Basically, this match returns 1183 true when the packet must be handled by this cluster node. Thus, 1184 all nodes see all packets and this match decides which node handles 1185 what packets. The work-load sharing algorithm is based on source 1186 address hashing. 1187 1188 If you say Y or M here, try `iptables -m cluster --help` for 1189 more information. 1190 1191config NETFILTER_XT_MATCH_COMMENT 1192 tristate '"comment" match support' 1193 depends on NETFILTER_ADVANCED 1194 help 1195 This option adds a `comment' dummy-match, which allows you to put 1196 comments in your iptables ruleset. 1197 1198 If you want to compile it as a module, say M here and read 1199 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1200 1201config NETFILTER_XT_MATCH_CONNBYTES 1202 tristate '"connbytes" per-connection counter match support' 1203 depends on NF_CONNTRACK 1204 depends on NETFILTER_ADVANCED 1205 help 1206 This option adds a `connbytes' match, which allows you to match the 1207 number of bytes and/or packets for each direction within a connection. 1208 1209 If you want to compile it as a module, say M here and read 1210 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1211 1212config NETFILTER_XT_MATCH_CONNLABEL 1213 tristate '"connlabel" match support' 1214 select NF_CONNTRACK_LABELS 1215 depends on NF_CONNTRACK 1216 depends on NETFILTER_ADVANCED 1217 help 1218 This match allows you to test and assign userspace-defined labels names 1219 to a connection. The kernel only stores bit values - mapping 1220 names to bits is done by userspace. 1221 1222 Unlike connmark, more than 32 flag bits may be assigned to a 1223 connection simultaneously. 1224 1225config NETFILTER_XT_MATCH_CONNLIMIT 1226 tristate '"connlimit" match support' 1227 depends on NF_CONNTRACK 1228 depends on NETFILTER_ADVANCED 1229 select NETFILTER_CONNCOUNT 1230 help 1231 This match allows you to match against the number of parallel 1232 connections to a server per client IP address (or address block). 1233 1234config NETFILTER_XT_MATCH_CONNMARK 1235 tristate '"connmark" connection mark match support' 1236 depends on NF_CONNTRACK 1237 depends on NETFILTER_ADVANCED 1238 select NETFILTER_XT_CONNMARK 1239 help 1240 This is a backwards-compat option for the user's convenience 1241 (e.g. when running oldconfig). It selects 1242 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1243 1244config NETFILTER_XT_MATCH_CONNTRACK 1245 tristate '"conntrack" connection tracking match support' 1246 depends on NF_CONNTRACK 1247 default m if NETFILTER_ADVANCED=n 1248 help 1249 This is a general conntrack match module, a superset of the state match. 1250 1251 It allows matching on additional conntrack information, which is 1252 useful in complex configurations, such as NAT gateways with multiple 1253 internet links or tunnels. 1254 1255 To compile it as a module, choose M here. If unsure, say N. 1256 1257config NETFILTER_XT_MATCH_CPU 1258 tristate '"cpu" match support' 1259 depends on NETFILTER_ADVANCED 1260 help 1261 CPU matching allows you to match packets based on the CPU 1262 currently handling the packet. 1263 1264 To compile it as a module, choose M here. If unsure, say N. 1265 1266config NETFILTER_XT_MATCH_DCCP 1267 tristate '"dccp" protocol match support' 1268 depends on NETFILTER_ADVANCED 1269 default IP_DCCP 1270 help 1271 With this option enabled, you will be able to use the iptables 1272 `dccp' match in order to match on DCCP source/destination ports 1273 and DCCP flags. 1274 1275 If you want to compile it as a module, say M here and read 1276 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1277 1278config NETFILTER_XT_MATCH_DEVGROUP 1279 tristate '"devgroup" match support' 1280 depends on NETFILTER_ADVANCED 1281 help 1282 This options adds a `devgroup' match, which allows to match on the 1283 device group a network device is assigned to. 1284 1285 To compile it as a module, choose M here. If unsure, say N. 1286 1287config NETFILTER_XT_MATCH_DSCP 1288 tristate '"dscp" and "tos" match support' 1289 depends on NETFILTER_ADVANCED 1290 help 1291 This option adds a `DSCP' match, which allows you to match against 1292 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1293 1294 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1295 1296 It will also add a "tos" match, which allows you to match packets 1297 based on the Type Of Service fields of the IPv4 packet (which share 1298 the same bits as DSCP). 1299 1300 To compile it as a module, choose M here. If unsure, say N. 1301 1302config NETFILTER_XT_MATCH_ECN 1303 tristate '"ecn" match support' 1304 depends on NETFILTER_ADVANCED 1305 help 1306 This option adds an "ECN" match, which allows you to match against 1307 the IPv4 and TCP header ECN fields. 1308 1309 To compile it as a module, choose M here. If unsure, say N. 1310 1311config NETFILTER_XT_MATCH_ESP 1312 tristate '"esp" match support' 1313 depends on NETFILTER_ADVANCED 1314 help 1315 This match extension allows you to match a range of SPIs 1316 inside ESP header of IPSec packets. 1317 1318 To compile it as a module, choose M here. If unsure, say N. 1319 1320config NETFILTER_XT_MATCH_HASHLIMIT 1321 tristate '"hashlimit" match support' 1322 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1323 depends on NETFILTER_ADVANCED 1324 help 1325 This option adds a `hashlimit' match. 1326 1327 As opposed to `limit', this match dynamically creates a hash table 1328 of limit buckets, based on your selection of source/destination 1329 addresses and/or ports. 1330 1331 It enables you to express policies like `10kpps for any given 1332 destination address' or `500pps from any given source address' 1333 with a single rule. 1334 1335config NETFILTER_XT_MATCH_HELPER 1336 tristate '"helper" match support' 1337 depends on NF_CONNTRACK 1338 depends on NETFILTER_ADVANCED 1339 help 1340 Helper matching allows you to match packets in dynamic connections 1341 tracked by a conntrack-helper, ie. nf_conntrack_ftp 1342 1343 To compile it as a module, choose M here. If unsure, say Y. 1344 1345config NETFILTER_XT_MATCH_HL 1346 tristate '"hl" hoplimit/TTL match support' 1347 depends on NETFILTER_ADVANCED 1348 help 1349 HL matching allows you to match packets based on the hoplimit 1350 in the IPv6 header, or the time-to-live field in the IPv4 1351 header of the packet. 1352 1353config NETFILTER_XT_MATCH_IPCOMP 1354 tristate '"ipcomp" match support' 1355 depends on NETFILTER_ADVANCED 1356 help 1357 This match extension allows you to match a range of CPIs(16 bits) 1358 inside IPComp header of IPSec packets. 1359 1360 To compile it as a module, choose M here. If unsure, say N. 1361 1362config NETFILTER_XT_MATCH_IPRANGE 1363 tristate '"iprange" address range match support' 1364 depends on NETFILTER_ADVANCED 1365 help 1366 This option adds a "iprange" match, which allows you to match based on 1367 an IP address range. (Normal iptables only matches on single addresses 1368 with an optional mask.) 1369 1370 If unsure, say M. 1371 1372config NETFILTER_XT_MATCH_IPVS 1373 tristate '"ipvs" match support' 1374 depends on IP_VS 1375 depends on NETFILTER_ADVANCED 1376 depends on NF_CONNTRACK 1377 help 1378 This option allows you to match against IPVS properties of a packet. 1379 1380 If unsure, say N. 1381 1382config NETFILTER_XT_MATCH_L2TP 1383 tristate '"l2tp" match support' 1384 depends on NETFILTER_ADVANCED 1385 default L2TP 1386 help 1387 This option adds an "L2TP" match, which allows you to match against 1388 L2TP protocol header fields. 1389 1390 To compile it as a module, choose M here. If unsure, say N. 1391 1392config NETFILTER_XT_MATCH_LENGTH 1393 tristate '"length" match support' 1394 depends on NETFILTER_ADVANCED 1395 help 1396 This option allows you to match the length of a packet against a 1397 specific value or range of values. 1398 1399 To compile it as a module, choose M here. If unsure, say N. 1400 1401config NETFILTER_XT_MATCH_LIMIT 1402 tristate '"limit" match support' 1403 depends on NETFILTER_ADVANCED 1404 help 1405 limit matching allows you to control the rate at which a rule can be 1406 matched: mainly useful in combination with the LOG target ("LOG 1407 target support", below) and to avoid some Denial of Service attacks. 1408 1409 To compile it as a module, choose M here. If unsure, say N. 1410 1411config NETFILTER_XT_MATCH_MAC 1412 tristate '"mac" address match support' 1413 depends on NETFILTER_ADVANCED 1414 help 1415 MAC matching allows you to match packets based on the source 1416 Ethernet address of the packet. 1417 1418 To compile it as a module, choose M here. If unsure, say N. 1419 1420config NETFILTER_XT_MATCH_MARK 1421 tristate '"mark" match support' 1422 depends on NETFILTER_ADVANCED 1423 select NETFILTER_XT_MARK 1424 help 1425 This is a backwards-compat option for the user's convenience 1426 (e.g. when running oldconfig). It selects 1427 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1428 1429config NETFILTER_XT_MATCH_MULTIPORT 1430 tristate '"multiport" Multiple port match support' 1431 depends on NETFILTER_ADVANCED 1432 help 1433 Multiport matching allows you to match TCP or UDP packets based on 1434 a series of source or destination ports: normally a rule can only 1435 match a single range of ports. 1436 1437 To compile it as a module, choose M here. If unsure, say N. 1438 1439config NETFILTER_XT_MATCH_NFACCT 1440 tristate '"nfacct" match support' 1441 depends on NETFILTER_ADVANCED 1442 select NETFILTER_NETLINK_ACCT 1443 help 1444 This option allows you to use the extended accounting through 1445 nfnetlink_acct. 1446 1447 To compile it as a module, choose M here. If unsure, say N. 1448 1449config NETFILTER_XT_MATCH_OSF 1450 tristate '"osf" Passive OS fingerprint match' 1451 depends on NETFILTER_ADVANCED 1452 select NETFILTER_NETLINK_OSF 1453 help 1454 This option selects the Passive OS Fingerprinting match module 1455 that allows to passively match the remote operating system by 1456 analyzing incoming TCP SYN packets. 1457 1458 Rules and loading software can be downloaded from 1459 http://www.ioremap.net/projects/osf 1460 1461 To compile it as a module, choose M here. If unsure, say N. 1462 1463config NETFILTER_XT_MATCH_OWNER 1464 tristate '"owner" match support' 1465 depends on NETFILTER_ADVANCED 1466 help 1467 Socket owner matching allows you to match locally-generated packets 1468 based on who created the socket: the user or group. It is also 1469 possible to check whether a socket actually exists. 1470 1471config NETFILTER_XT_MATCH_POLICY 1472 tristate 'IPsec "policy" match support' 1473 depends on XFRM 1474 default m if NETFILTER_ADVANCED=n 1475 help 1476 Policy matching allows you to match packets based on the 1477 IPsec policy that was used during decapsulation/will 1478 be used during encapsulation. 1479 1480 To compile it as a module, choose M here. If unsure, say N. 1481 1482config NETFILTER_XT_MATCH_PHYSDEV 1483 tristate '"physdev" match support' 1484 depends on BRIDGE && BRIDGE_NETFILTER 1485 depends on NETFILTER_ADVANCED 1486 help 1487 Physdev packet matching matches against the physical bridge ports 1488 the IP packet arrived on or will leave by. 1489 1490 To compile it as a module, choose M here. If unsure, say N. 1491 1492config NETFILTER_XT_MATCH_PKTTYPE 1493 tristate '"pkttype" packet type match support' 1494 depends on NETFILTER_ADVANCED 1495 help 1496 Packet type matching allows you to match a packet by 1497 its "class", eg. BROADCAST, MULTICAST, ... 1498 1499 Typical usage: 1500 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1501 1502 To compile it as a module, choose M here. If unsure, say N. 1503 1504config NETFILTER_XT_MATCH_QUOTA 1505 tristate '"quota" match support' 1506 depends on NETFILTER_ADVANCED 1507 help 1508 This option adds a `quota' match, which allows to match on a 1509 byte counter. 1510 1511 If you want to compile it as a module, say M here and read 1512 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1513 1514config NETFILTER_XT_MATCH_RATEEST 1515 tristate '"rateest" match support' 1516 depends on NETFILTER_ADVANCED 1517 select NETFILTER_XT_TARGET_RATEEST 1518 help 1519 This option adds a `rateest' match, which allows to match on the 1520 rate estimated by the RATEEST target. 1521 1522 To compile it as a module, choose M here. If unsure, say N. 1523 1524config NETFILTER_XT_MATCH_REALM 1525 tristate '"realm" match support' 1526 depends on NETFILTER_ADVANCED 1527 select IP_ROUTE_CLASSID 1528 help 1529 This option adds a `realm' match, which allows you to use the realm 1530 key from the routing subsystem inside iptables. 1531 1532 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1533 in tc world. 1534 1535 If you want to compile it as a module, say M here and read 1536 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1537 1538config NETFILTER_XT_MATCH_RECENT 1539 tristate '"recent" match support' 1540 depends on NETFILTER_ADVANCED 1541 help 1542 This match is used for creating one or many lists of recently 1543 used addresses and then matching against that/those list(s). 1544 1545 Short options are available by using 'iptables -m recent -h' 1546 Official Website: <http://snowman.net/projects/ipt_recent/> 1547 1548config NETFILTER_XT_MATCH_SCTP 1549 tristate '"sctp" protocol match support' 1550 depends on NETFILTER_ADVANCED 1551 default IP_SCTP 1552 help 1553 With this option enabled, you will be able to use the 1554 `sctp' match in order to match on SCTP source/destination ports 1555 and SCTP chunk types. 1556 1557 If you want to compile it as a module, say M here and read 1558 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1559 1560config NETFILTER_XT_MATCH_SOCKET 1561 tristate '"socket" match support' 1562 depends on NETFILTER_XTABLES 1563 depends on NETFILTER_ADVANCED 1564 depends on IPV6 || IPV6=n 1565 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1566 select NF_SOCKET_IPV4 1567 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES 1568 select NF_DEFRAG_IPV4 1569 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1570 help 1571 This option adds a `socket' match, which can be used to match 1572 packets for which a TCP or UDP socket lookup finds a valid socket. 1573 It can be used in combination with the MARK target and policy 1574 routing to implement full featured non-locally bound sockets. 1575 1576 To compile it as a module, choose M here. If unsure, say N. 1577 1578config NETFILTER_XT_MATCH_STATE 1579 tristate '"state" match support' 1580 depends on NF_CONNTRACK 1581 default m if NETFILTER_ADVANCED=n 1582 help 1583 Connection state matching allows you to match packets based on their 1584 relationship to a tracked connection (ie. previous packets). This 1585 is a powerful tool for packet classification. 1586 1587 To compile it as a module, choose M here. If unsure, say N. 1588 1589config NETFILTER_XT_MATCH_STATISTIC 1590 tristate '"statistic" match support' 1591 depends on NETFILTER_ADVANCED 1592 help 1593 This option adds a `statistic' match, which allows you to match 1594 on packets periodically or randomly with a given percentage. 1595 1596 To compile it as a module, choose M here. If unsure, say N. 1597 1598config NETFILTER_XT_MATCH_STRING 1599 tristate '"string" match support' 1600 depends on NETFILTER_ADVANCED 1601 select TEXTSEARCH 1602 select TEXTSEARCH_KMP 1603 select TEXTSEARCH_BM 1604 select TEXTSEARCH_FSM 1605 help 1606 This option adds a `string' match, which allows you to look for 1607 pattern matchings in packets. 1608 1609 To compile it as a module, choose M here. If unsure, say N. 1610 1611config NETFILTER_XT_MATCH_TCPMSS 1612 tristate '"tcpmss" match support' 1613 depends on NETFILTER_ADVANCED 1614 help 1615 This option adds a `tcpmss' match, which allows you to examine the 1616 MSS value of TCP SYN packets, which control the maximum packet size 1617 for that connection. 1618 1619 To compile it as a module, choose M here. If unsure, say N. 1620 1621config NETFILTER_XT_MATCH_TIME 1622 tristate '"time" match support' 1623 depends on NETFILTER_ADVANCED 1624 help 1625 This option adds a "time" match, which allows you to match based on 1626 the packet arrival time (at the machine which netfilter is running) 1627 on) or departure time/date (for locally generated packets). 1628 1629 If you say Y here, try `iptables -m time --help` for 1630 more information. 1631 1632 If you want to compile it as a module, say M here. 1633 If unsure, say N. 1634 1635config NETFILTER_XT_MATCH_U32 1636 tristate '"u32" match support' 1637 depends on NETFILTER_ADVANCED 1638 help 1639 u32 allows you to extract quantities of up to 4 bytes from a packet, 1640 AND them with specified masks, shift them by specified amounts and 1641 test whether the results are in any of a set of specified ranges. 1642 The specification of what to extract is general enough to skip over 1643 headers with lengths stored in the packet, as in IP or TCP header 1644 lengths. 1645 1646 Details and examples are in the kernel module source. 1647 1648endif # NETFILTER_XTABLES 1649 1650endmenu 1651 1652source "net/netfilter/ipset/Kconfig" 1653 1654source "net/netfilter/ipvs/Kconfig" 1655