1# SPDX-License-Identifier: GPL-2.0-only 2menu "Core Netfilter Configuration" 3 depends on NET && INET && NETFILTER 4 5config NETFILTER_INGRESS 6 bool "Netfilter ingress support" 7 default y 8 select NET_INGRESS 9 help 10 This allows you to classify packets from ingress using the Netfilter 11 infrastructure. 12 13config NETFILTER_NETLINK 14 tristate 15 16config NETFILTER_FAMILY_BRIDGE 17 bool 18 19config NETFILTER_FAMILY_ARP 20 bool 21 22config NETFILTER_NETLINK_ACCT 23tristate "Netfilter NFACCT over NFNETLINK interface" 24 depends on NETFILTER_ADVANCED 25 select NETFILTER_NETLINK 26 help 27 If this option is enabled, the kernel will include support 28 for extended accounting via NFNETLINK. 29 30config NETFILTER_NETLINK_QUEUE 31 tristate "Netfilter NFQUEUE over NFNETLINK interface" 32 depends on NETFILTER_ADVANCED 33 select NETFILTER_NETLINK 34 help 35 If this option is enabled, the kernel will include support 36 for queueing packets via NFNETLINK. 37 38config NETFILTER_NETLINK_LOG 39 tristate "Netfilter LOG over NFNETLINK interface" 40 default m if NETFILTER_ADVANCED=n 41 select NETFILTER_NETLINK 42 help 43 If this option is enabled, the kernel will include support 44 for logging packets via NFNETLINK. 45 46 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 47 and is also scheduled to replace the old syslog-based ipt_LOG 48 and ip6t_LOG modules. 49 50config NETFILTER_NETLINK_OSF 51 tristate "Netfilter OSF over NFNETLINK interface" 52 depends on NETFILTER_ADVANCED 53 select NETFILTER_NETLINK 54 help 55 If this option is enabled, the kernel will include support 56 for passive OS fingerprint via NFNETLINK. 57 58config NF_CONNTRACK 59 tristate "Netfilter connection tracking support" 60 default m if NETFILTER_ADVANCED=n 61 select NF_DEFRAG_IPV4 62 select NF_DEFRAG_IPV6 if IPV6 != n 63 help 64 Connection tracking keeps a record of what packets have passed 65 through your machine, in order to figure out how they are related 66 into connections. 67 68 This is required to do Masquerading or other kinds of Network 69 Address Translation. It can also be used to enhance packet 70 filtering (see `Connection state match support' below). 71 72 To compile it as a module, choose M here. If unsure, say N. 73 74config NF_LOG_COMMON 75 tristate 76 77config NF_LOG_NETDEV 78 tristate "Netdev packet logging" 79 select NF_LOG_COMMON 80 81if NF_CONNTRACK 82config NETFILTER_CONNCOUNT 83 tristate 84 85config NF_CONNTRACK_MARK 86 bool 'Connection mark tracking support' 87 depends on NETFILTER_ADVANCED 88 help 89 This option enables support for connection marks, used by the 90 `CONNMARK' target and `connmark' match. Similar to the mark value 91 of packets, but this mark value is kept in the conntrack session 92 instead of the individual packets. 93 94config NF_CONNTRACK_SECMARK 95 bool 'Connection tracking security mark support' 96 depends on NETWORK_SECMARK 97 default m if NETFILTER_ADVANCED=n 98 help 99 This option enables security markings to be applied to 100 connections. Typically they are copied to connections from 101 packets using the CONNSECMARK target and copied back from 102 connections to packets with the same target, with the packets 103 being originally labeled via SECMARK. 104 105 If unsure, say 'N'. 106 107config NF_CONNTRACK_ZONES 108 bool 'Connection tracking zones' 109 depends on NETFILTER_ADVANCED 110 help 111 This option enables support for connection tracking zones. 112 Normally, each connection needs to have a unique system wide 113 identity. Connection tracking zones allow to have multiple 114 connections using the same identity, as long as they are 115 contained in different zones. 116 117 If unsure, say `N'. 118 119config NF_CONNTRACK_PROCFS 120 bool "Supply CT list in procfs (OBSOLETE)" 121 default y 122 depends on PROC_FS 123 ---help--- 124 This option enables for the list of known conntrack entries 125 to be shown in procfs under net/netfilter/nf_conntrack. This 126 is considered obsolete in favor of using the conntrack(8) 127 tool which uses Netlink. 128 129config NF_CONNTRACK_EVENTS 130 bool "Connection tracking events" 131 depends on NETFILTER_ADVANCED 132 help 133 If this option is enabled, the connection tracking code will 134 provide a notifier chain that can be used by other kernel code 135 to get notified about changes in the connection tracking state. 136 137 If unsure, say `N'. 138 139config NF_CONNTRACK_TIMEOUT 140 bool 'Connection tracking timeout' 141 depends on NETFILTER_ADVANCED 142 help 143 This option enables support for connection tracking timeout 144 extension. This allows you to attach timeout policies to flow 145 via the CT target. 146 147 If unsure, say `N'. 148 149config NF_CONNTRACK_TIMESTAMP 150 bool 'Connection tracking timestamping' 151 depends on NETFILTER_ADVANCED 152 help 153 This option enables support for connection tracking timestamping. 154 This allows you to store the flow start-time and to obtain 155 the flow-stop time (once it has been destroyed) via Connection 156 tracking events. 157 158 If unsure, say `N'. 159 160config NF_CONNTRACK_LABELS 161 bool "Connection tracking labels" 162 help 163 This option enables support for assigning user-defined flag bits 164 to connection tracking entries. It can be used with xtables connlabel 165 match and the nftables ct expression. 166 167config NF_CT_PROTO_DCCP 168 bool 'DCCP protocol connection tracking support' 169 depends on NETFILTER_ADVANCED 170 default y 171 help 172 With this option enabled, the layer 3 independent connection 173 tracking code will be able to do state tracking on DCCP connections. 174 175 If unsure, say Y. 176 177config NF_CT_PROTO_GRE 178 bool 179 180config NF_CT_PROTO_SCTP 181 bool 'SCTP protocol connection tracking support' 182 depends on NETFILTER_ADVANCED 183 default y 184 select LIBCRC32C 185 help 186 With this option enabled, the layer 3 independent connection 187 tracking code will be able to do state tracking on SCTP connections. 188 189 If unsure, say Y. 190 191config NF_CT_PROTO_UDPLITE 192 bool 'UDP-Lite protocol connection tracking support' 193 depends on NETFILTER_ADVANCED 194 default y 195 help 196 With this option enabled, the layer 3 independent connection 197 tracking code will be able to do state tracking on UDP-Lite 198 connections. 199 200 If unsure, say Y. 201 202config NF_CONNTRACK_AMANDA 203 tristate "Amanda backup protocol support" 204 depends on NETFILTER_ADVANCED 205 select TEXTSEARCH 206 select TEXTSEARCH_KMP 207 help 208 If you are running the Amanda backup package <http://www.amanda.org/> 209 on this machine or machines that will be MASQUERADED through this 210 machine, then you may want to enable this feature. This allows the 211 connection tracking and natting code to allow the sub-channels that 212 Amanda requires for communication of the backup data, messages and 213 index. 214 215 To compile it as a module, choose M here. If unsure, say N. 216 217config NF_CONNTRACK_FTP 218 tristate "FTP protocol support" 219 default m if NETFILTER_ADVANCED=n 220 help 221 Tracking FTP connections is problematic: special helpers are 222 required for tracking them, and doing masquerading and other forms 223 of Network Address Translation on them. 224 225 This is FTP support on Layer 3 independent connection tracking. 226 Layer 3 independent connection tracking is experimental scheme 227 which generalize ip_conntrack to support other layer 3 protocols. 228 229 To compile it as a module, choose M here. If unsure, say N. 230 231config NF_CONNTRACK_H323 232 tristate "H.323 protocol support" 233 depends on IPV6 || IPV6=n 234 depends on NETFILTER_ADVANCED 235 help 236 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 237 important VoIP protocols, it is widely used by voice hardware and 238 software including voice gateways, IP phones, Netmeeting, OpenPhone, 239 Gnomemeeting, etc. 240 241 With this module you can support H.323 on a connection tracking/NAT 242 firewall. 243 244 This module supports RAS, Fast Start, H.245 Tunnelling, Call 245 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 246 whiteboard, file transfer, etc. For more information, please 247 visit http://nath323.sourceforge.net/. 248 249 To compile it as a module, choose M here. If unsure, say N. 250 251config NF_CONNTRACK_IRC 252 tristate "IRC protocol support" 253 default m if NETFILTER_ADVANCED=n 254 help 255 There is a commonly-used extension to IRC called 256 Direct Client-to-Client Protocol (DCC). This enables users to send 257 files to each other, and also chat to each other without the need 258 of a server. DCC Sending is used anywhere you send files over IRC, 259 and DCC Chat is most commonly used by Eggdrop bots. If you are 260 using NAT, this extension will enable you to send files and initiate 261 chats. Note that you do NOT need this extension to get files or 262 have others initiate chats, or everything else in IRC. 263 264 To compile it as a module, choose M here. If unsure, say N. 265 266config NF_CONNTRACK_BROADCAST 267 tristate 268 269config NF_CONNTRACK_NETBIOS_NS 270 tristate "NetBIOS name service protocol support" 271 select NF_CONNTRACK_BROADCAST 272 help 273 NetBIOS name service requests are sent as broadcast messages from an 274 unprivileged port and responded to with unicast messages to the 275 same port. This make them hard to firewall properly because connection 276 tracking doesn't deal with broadcasts. This helper tracks locally 277 originating NetBIOS name service requests and the corresponding 278 responses. It relies on correct IP address configuration, specifically 279 netmask and broadcast address. When properly configured, the output 280 of "ip address show" should look similar to this: 281 282 $ ip -4 address show eth0 283 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 284 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 285 286 To compile it as a module, choose M here. If unsure, say N. 287 288config NF_CONNTRACK_SNMP 289 tristate "SNMP service protocol support" 290 depends on NETFILTER_ADVANCED 291 select NF_CONNTRACK_BROADCAST 292 help 293 SNMP service requests are sent as broadcast messages from an 294 unprivileged port and responded to with unicast messages to the 295 same port. This make them hard to firewall properly because connection 296 tracking doesn't deal with broadcasts. This helper tracks locally 297 originating SNMP service requests and the corresponding 298 responses. It relies on correct IP address configuration, specifically 299 netmask and broadcast address. 300 301 To compile it as a module, choose M here. If unsure, say N. 302 303config NF_CONNTRACK_PPTP 304 tristate "PPtP protocol support" 305 depends on NETFILTER_ADVANCED 306 select NF_CT_PROTO_GRE 307 help 308 This module adds support for PPTP (Point to Point Tunnelling 309 Protocol, RFC2637) connection tracking and NAT. 310 311 If you are running PPTP sessions over a stateful firewall or NAT 312 box, you may want to enable this feature. 313 314 Please note that not all PPTP modes of operation are supported yet. 315 Specifically these limitations exist: 316 - Blindly assumes that control connections are always established 317 in PNS->PAC direction. This is a violation of RFC2637. 318 - Only supports a single call within each session 319 320 To compile it as a module, choose M here. If unsure, say N. 321 322config NF_CONNTRACK_SANE 323 tristate "SANE protocol support" 324 depends on NETFILTER_ADVANCED 325 help 326 SANE is a protocol for remote access to scanners as implemented 327 by the 'saned' daemon. Like FTP, it uses separate control and 328 data connections. 329 330 With this module you can support SANE on a connection tracking 331 firewall. 332 333 To compile it as a module, choose M here. If unsure, say N. 334 335config NF_CONNTRACK_SIP 336 tristate "SIP protocol support" 337 default m if NETFILTER_ADVANCED=n 338 help 339 SIP is an application-layer control protocol that can establish, 340 modify, and terminate multimedia sessions (conferences) such as 341 Internet telephony calls. With the ip_conntrack_sip and 342 the nf_nat_sip modules you can support the protocol on a connection 343 tracking/NATing firewall. 344 345 To compile it as a module, choose M here. If unsure, say N. 346 347config NF_CONNTRACK_TFTP 348 tristate "TFTP protocol support" 349 depends on NETFILTER_ADVANCED 350 help 351 TFTP connection tracking helper, this is required depending 352 on how restrictive your ruleset is. 353 If you are using a tftp client behind -j SNAT or -j MASQUERADING 354 you will need this. 355 356 To compile it as a module, choose M here. If unsure, say N. 357 358config NF_CT_NETLINK 359 tristate 'Connection tracking netlink interface' 360 select NETFILTER_NETLINK 361 default m if NETFILTER_ADVANCED=n 362 help 363 This option enables support for a netlink-based userspace interface 364 365config NF_CT_NETLINK_TIMEOUT 366 tristate 'Connection tracking timeout tuning via Netlink' 367 select NETFILTER_NETLINK 368 depends on NETFILTER_ADVANCED 369 depends on NF_CONNTRACK_TIMEOUT 370 help 371 This option enables support for connection tracking timeout 372 fine-grain tuning. This allows you to attach specific timeout 373 policies to flows, instead of using the global timeout policy. 374 375 If unsure, say `N'. 376 377config NF_CT_NETLINK_HELPER 378 tristate 'Connection tracking helpers in user-space via Netlink' 379 select NETFILTER_NETLINK 380 depends on NF_CT_NETLINK 381 depends on NETFILTER_NETLINK_QUEUE 382 depends on NETFILTER_NETLINK_GLUE_CT 383 depends on NETFILTER_ADVANCED 384 help 385 This option enables the user-space connection tracking helpers 386 infrastructure. 387 388 If unsure, say `N'. 389 390config NETFILTER_NETLINK_GLUE_CT 391 bool "NFQUEUE and NFLOG integration with Connection Tracking" 392 default n 393 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 394 help 395 If this option is enabled, NFQUEUE and NFLOG can include 396 Connection Tracking information together with the packet is 397 the enqueued via NFNETLINK. 398 399config NF_NAT 400 tristate "Network Address Translation support" 401 depends on NF_CONNTRACK 402 default m if NETFILTER_ADVANCED=n 403 help 404 The NAT option allows masquerading, port forwarding and other 405 forms of full Network Address Port Translation. This can be 406 controlled by iptables, ip6tables or nft. 407 408config NF_NAT_AMANDA 409 tristate 410 depends on NF_CONNTRACK && NF_NAT 411 default NF_NAT && NF_CONNTRACK_AMANDA 412 413config NF_NAT_FTP 414 tristate 415 depends on NF_CONNTRACK && NF_NAT 416 default NF_NAT && NF_CONNTRACK_FTP 417 418config NF_NAT_IRC 419 tristate 420 depends on NF_CONNTRACK && NF_NAT 421 default NF_NAT && NF_CONNTRACK_IRC 422 423config NF_NAT_SIP 424 tristate 425 depends on NF_CONNTRACK && NF_NAT 426 default NF_NAT && NF_CONNTRACK_SIP 427 428config NF_NAT_TFTP 429 tristate 430 depends on NF_CONNTRACK && NF_NAT 431 default NF_NAT && NF_CONNTRACK_TFTP 432 433config NF_NAT_REDIRECT 434 bool 435 436config NF_NAT_MASQUERADE 437 bool 438 439config NETFILTER_SYNPROXY 440 tristate 441 442endif # NF_CONNTRACK 443 444config NF_TABLES 445 select NETFILTER_NETLINK 446 tristate "Netfilter nf_tables support" 447 help 448 nftables is the new packet classification framework that intends to 449 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 450 provides a pseudo-state machine with an extensible instruction-set 451 (also known as expressions) that the userspace 'nft' utility 452 (http://www.netfilter.org/projects/nftables) uses to build the 453 rule-set. It also comes with the generic set infrastructure that 454 allows you to construct mappings between matchings and actions 455 for performance lookups. 456 457 To compile it as a module, choose M here. 458 459if NF_TABLES 460 461config NF_TABLES_SET 462 tristate "Netfilter nf_tables set infrastructure" 463 help 464 This option enables the nf_tables set infrastructure that allows to 465 look up for elements in a set and to build one-way mappings between 466 matchings and actions. 467 468config NF_TABLES_INET 469 depends on IPV6 470 select NF_TABLES_IPV4 471 select NF_TABLES_IPV6 472 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support" 473 help 474 This option enables support for a mixed IPv4/IPv6 "inet" table. 475 476config NF_TABLES_NETDEV 477 bool "Netfilter nf_tables netdev tables support" 478 help 479 This option enables support for the "netdev" table. 480 481config NFT_NUMGEN 482 tristate "Netfilter nf_tables number generator module" 483 help 484 This option adds the number generator expression used to perform 485 incremental counting and random numbers bound to a upper limit. 486 487config NFT_CT 488 depends on NF_CONNTRACK 489 tristate "Netfilter nf_tables conntrack module" 490 help 491 This option adds the "ct" expression that you can use to match 492 connection tracking information such as the flow state. 493 494config NFT_FLOW_OFFLOAD 495 depends on NF_CONNTRACK && NF_FLOW_TABLE 496 tristate "Netfilter nf_tables hardware flow offload module" 497 help 498 This option adds the "flow_offload" expression that you can use to 499 choose what flows are placed into the hardware. 500 501config NFT_COUNTER 502 tristate "Netfilter nf_tables counter module" 503 help 504 This option adds the "counter" expression that you can use to 505 include packet and byte counters in a rule. 506 507config NFT_CONNLIMIT 508 tristate "Netfilter nf_tables connlimit module" 509 depends on NF_CONNTRACK 510 depends on NETFILTER_ADVANCED 511 select NETFILTER_CONNCOUNT 512 help 513 This option adds the "connlimit" expression that you can use to 514 ratelimit rule matchings per connections. 515 516config NFT_LOG 517 tristate "Netfilter nf_tables log module" 518 help 519 This option adds the "log" expression that you can use to log 520 packets matching some criteria. 521 522config NFT_LIMIT 523 tristate "Netfilter nf_tables limit module" 524 help 525 This option adds the "limit" expression that you can use to 526 ratelimit rule matchings. 527 528config NFT_MASQ 529 depends on NF_CONNTRACK 530 depends on NF_NAT 531 select NF_NAT_MASQUERADE 532 tristate "Netfilter nf_tables masquerade support" 533 help 534 This option adds the "masquerade" expression that you can use 535 to perform NAT in the masquerade flavour. 536 537config NFT_REDIR 538 depends on NF_CONNTRACK 539 depends on NF_NAT 540 tristate "Netfilter nf_tables redirect support" 541 select NF_NAT_REDIRECT 542 help 543 This options adds the "redirect" expression that you can use 544 to perform NAT in the redirect flavour. 545 546config NFT_NAT 547 depends on NF_CONNTRACK 548 select NF_NAT 549 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6 550 tristate "Netfilter nf_tables nat module" 551 help 552 This option adds the "nat" expression that you can use to perform 553 typical Network Address Translation (NAT) packet transformations. 554 555config NFT_TUNNEL 556 tristate "Netfilter nf_tables tunnel module" 557 help 558 This option adds the "tunnel" expression that you can use to set 559 tunneling policies. 560 561config NFT_OBJREF 562 tristate "Netfilter nf_tables stateful object reference module" 563 help 564 This option adds the "objref" expression that allows you to refer to 565 stateful objects, such as counters and quotas. 566 567config NFT_QUEUE 568 depends on NETFILTER_NETLINK_QUEUE 569 tristate "Netfilter nf_tables queue module" 570 help 571 This is required if you intend to use the userspace queueing 572 infrastructure (also known as NFQUEUE) from nftables. 573 574config NFT_QUOTA 575 tristate "Netfilter nf_tables quota module" 576 help 577 This option adds the "quota" expression that you can use to match 578 enforce bytes quotas. 579 580config NFT_REJECT 581 default m if NETFILTER_ADVANCED=n 582 tristate "Netfilter nf_tables reject support" 583 depends on !NF_TABLES_INET || (IPV6!=m || m) 584 help 585 This option adds the "reject" expression that you can use to 586 explicitly deny and notify via TCP reset/ICMP informational errors 587 unallowed traffic. 588 589config NFT_REJECT_INET 590 depends on NF_TABLES_INET 591 default NFT_REJECT 592 tristate 593 594config NFT_COMPAT 595 depends on NETFILTER_XTABLES 596 tristate "Netfilter x_tables over nf_tables module" 597 help 598 This is required if you intend to use any of existing 599 x_tables match/target extensions over the nf_tables 600 framework. 601 602config NFT_HASH 603 tristate "Netfilter nf_tables hash module" 604 help 605 This option adds the "hash" expression that you can use to perform 606 a hash operation on registers. 607 608config NFT_FIB 609 tristate 610 611config NFT_FIB_INET 612 depends on NF_TABLES_INET 613 depends on NFT_FIB_IPV4 614 depends on NFT_FIB_IPV6 615 tristate "Netfilter nf_tables fib inet support" 616 help 617 This option allows using the FIB expression from the inet table. 618 The lookup will be delegated to the IPv4 or IPv6 FIB depending 619 on the protocol of the packet. 620 621config NFT_XFRM 622 tristate "Netfilter nf_tables xfrm/IPSec security association matching" 623 depends on XFRM 624 help 625 This option adds an expression that you can use to extract properties 626 of a packets security association. 627 628config NFT_SOCKET 629 tristate "Netfilter nf_tables socket match support" 630 depends on IPV6 || IPV6=n 631 select NF_SOCKET_IPV4 632 select NF_SOCKET_IPV6 if NF_TABLES_IPV6 633 help 634 This option allows matching for the presence or absence of a 635 corresponding socket and its attributes. 636 637config NFT_OSF 638 tristate "Netfilter nf_tables passive OS fingerprint support" 639 depends on NETFILTER_ADVANCED 640 select NETFILTER_NETLINK_OSF 641 help 642 This option allows matching packets from an specific OS. 643 644config NFT_TPROXY 645 tristate "Netfilter nf_tables tproxy support" 646 depends on IPV6 || IPV6=n 647 select NF_DEFRAG_IPV4 648 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6 649 select NF_TPROXY_IPV4 650 select NF_TPROXY_IPV6 if NF_TABLES_IPV6 651 help 652 This makes transparent proxy support available in nftables. 653 654config NFT_SYNPROXY 655 tristate "Netfilter nf_tables SYNPROXY expression support" 656 depends on NF_CONNTRACK && NETFILTER_ADVANCED 657 select NETFILTER_SYNPROXY 658 select SYN_COOKIES 659 help 660 The SYNPROXY expression allows you to intercept TCP connections and 661 establish them using syncookies before they are passed on to the 662 server. This allows to avoid conntrack and server resource usage 663 during SYN-flood attacks. 664 665if NF_TABLES_NETDEV 666 667config NF_DUP_NETDEV 668 tristate "Netfilter packet duplication support" 669 help 670 This option enables the generic packet duplication infrastructure 671 for Netfilter. 672 673config NFT_DUP_NETDEV 674 tristate "Netfilter nf_tables netdev packet duplication support" 675 select NF_DUP_NETDEV 676 help 677 This option enables packet duplication for the "netdev" family. 678 679config NFT_FWD_NETDEV 680 tristate "Netfilter nf_tables netdev packet forwarding support" 681 select NF_DUP_NETDEV 682 help 683 This option enables packet forwarding for the "netdev" family. 684 685config NFT_FIB_NETDEV 686 depends on NFT_FIB_IPV4 687 depends on NFT_FIB_IPV6 688 tristate "Netfilter nf_tables netdev fib lookups support" 689 help 690 This option allows using the FIB expression from the netdev table. 691 The lookup will be delegated to the IPv4 or IPv6 FIB depending 692 on the protocol of the packet. 693 694endif # NF_TABLES_NETDEV 695 696endif # NF_TABLES 697 698config NF_FLOW_TABLE_INET 699 tristate "Netfilter flow table mixed IPv4/IPv6 module" 700 depends on NF_FLOW_TABLE 701 help 702 This option adds the flow table mixed IPv4/IPv6 support. 703 704 To compile it as a module, choose M here. 705 706config NF_FLOW_TABLE 707 tristate "Netfilter flow table module" 708 depends on NETFILTER_INGRESS 709 depends on NF_CONNTRACK 710 depends on NF_TABLES 711 help 712 This option adds the flow table core infrastructure. 713 714 To compile it as a module, choose M here. 715 716config NETFILTER_XTABLES 717 tristate "Netfilter Xtables support (required for ip_tables)" 718 default m if NETFILTER_ADVANCED=n 719 help 720 This is required if you intend to use any of ip_tables, 721 ip6_tables or arp_tables. 722 723if NETFILTER_XTABLES 724 725comment "Xtables combined modules" 726 727config NETFILTER_XT_MARK 728 tristate 'nfmark target and match support' 729 default m if NETFILTER_ADVANCED=n 730 ---help--- 731 This option adds the "MARK" target and "mark" match. 732 733 Netfilter mark matching allows you to match packets based on the 734 "nfmark" value in the packet. 735 The target allows you to create rules in the "mangle" table which alter 736 the netfilter mark (nfmark) field associated with the packet. 737 738 Prior to routing, the nfmark can influence the routing method and can 739 also be used by other subsystems to change their behavior. 740 741config NETFILTER_XT_CONNMARK 742 tristate 'ctmark target and match support' 743 depends on NF_CONNTRACK 744 depends on NETFILTER_ADVANCED 745 select NF_CONNTRACK_MARK 746 ---help--- 747 This option adds the "CONNMARK" target and "connmark" match. 748 749 Netfilter allows you to store a mark value per connection (a.k.a. 750 ctmark), similarly to the packet mark (nfmark). Using this 751 target and match, you can set and match on this mark. 752 753config NETFILTER_XT_SET 754 tristate 'set target and match support' 755 depends on IP_SET 756 depends on NETFILTER_ADVANCED 757 help 758 This option adds the "SET" target and "set" match. 759 760 Using this target and match, you can add/delete and match 761 elements in the sets created by ipset(8). 762 763 To compile it as a module, choose M here. If unsure, say N. 764 765# alphabetically ordered list of targets 766 767comment "Xtables targets" 768 769config NETFILTER_XT_TARGET_AUDIT 770 tristate "AUDIT target support" 771 depends on AUDIT 772 depends on NETFILTER_ADVANCED 773 ---help--- 774 This option adds a 'AUDIT' target, which can be used to create 775 audit records for packets dropped/accepted. 776 777 To compileit as a module, choose M here. If unsure, say N. 778 779config NETFILTER_XT_TARGET_CHECKSUM 780 tristate "CHECKSUM target support" 781 depends on IP_NF_MANGLE || IP6_NF_MANGLE 782 depends on NETFILTER_ADVANCED 783 ---help--- 784 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 785 table to work around buggy DHCP clients in virtualized environments. 786 787 Some old DHCP clients drop packets because they are not aware 788 that the checksum would normally be offloaded to hardware and 789 thus should be considered valid. 790 This target can be used to fill in the checksum using iptables 791 when such packets are sent via a virtual network device. 792 793 To compile it as a module, choose M here. If unsure, say N. 794 795config NETFILTER_XT_TARGET_CLASSIFY 796 tristate '"CLASSIFY" target support' 797 depends on NETFILTER_ADVANCED 798 help 799 This option adds a `CLASSIFY' target, which enables the user to set 800 the priority of a packet. Some qdiscs can use this value for 801 classification, among these are: 802 803 atm, cbq, dsmark, pfifo_fast, htb, prio 804 805 To compile it as a module, choose M here. If unsure, say N. 806 807config NETFILTER_XT_TARGET_CONNMARK 808 tristate '"CONNMARK" target support' 809 depends on NF_CONNTRACK 810 depends on NETFILTER_ADVANCED 811 select NETFILTER_XT_CONNMARK 812 ---help--- 813 This is a backwards-compat option for the user's convenience 814 (e.g. when running oldconfig). It selects 815 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 816 817config NETFILTER_XT_TARGET_CONNSECMARK 818 tristate '"CONNSECMARK" target support' 819 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 820 default m if NETFILTER_ADVANCED=n 821 help 822 The CONNSECMARK target copies security markings from packets 823 to connections, and restores security markings from connections 824 to packets (if the packets are not already marked). This would 825 normally be used in conjunction with the SECMARK target. 826 827 To compile it as a module, choose M here. If unsure, say N. 828 829config NETFILTER_XT_TARGET_CT 830 tristate '"CT" target support' 831 depends on NF_CONNTRACK 832 depends on IP_NF_RAW || IP6_NF_RAW 833 depends on NETFILTER_ADVANCED 834 help 835 This options adds a `CT' target, which allows to specify initial 836 connection tracking parameters like events to be delivered and 837 the helper to be used. 838 839 To compile it as a module, choose M here. If unsure, say N. 840 841config NETFILTER_XT_TARGET_DSCP 842 tristate '"DSCP" and "TOS" target support' 843 depends on IP_NF_MANGLE || IP6_NF_MANGLE 844 depends on NETFILTER_ADVANCED 845 help 846 This option adds a `DSCP' target, which allows you to manipulate 847 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 848 849 The DSCP field can have any value between 0x0 and 0x3f inclusive. 850 851 It also adds the "TOS" target, which allows you to create rules in 852 the "mangle" table which alter the Type Of Service field of an IPv4 853 or the Priority field of an IPv6 packet, prior to routing. 854 855 To compile it as a module, choose M here. If unsure, say N. 856 857config NETFILTER_XT_TARGET_HL 858 tristate '"HL" hoplimit target support' 859 depends on IP_NF_MANGLE || IP6_NF_MANGLE 860 depends on NETFILTER_ADVANCED 861 ---help--- 862 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 863 targets, which enable the user to change the 864 hoplimit/time-to-live value of the IP header. 865 866 While it is safe to decrement the hoplimit/TTL value, the 867 modules also allow to increment and set the hoplimit value of 868 the header to arbitrary values. This is EXTREMELY DANGEROUS 869 since you can easily create immortal packets that loop 870 forever on the network. 871 872config NETFILTER_XT_TARGET_HMARK 873 tristate '"HMARK" target support' 874 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 875 depends on NETFILTER_ADVANCED 876 ---help--- 877 This option adds the "HMARK" target. 878 879 The target allows you to create rules in the "raw" and "mangle" tables 880 which set the skbuff mark by means of hash calculation within a given 881 range. The nfmark can influence the routing method and can also be used 882 by other subsystems to change their behaviour. 883 884 To compile it as a module, choose M here. If unsure, say N. 885 886config NETFILTER_XT_TARGET_IDLETIMER 887 tristate "IDLETIMER target support" 888 depends on NETFILTER_ADVANCED 889 help 890 891 This option adds the `IDLETIMER' target. Each matching packet 892 resets the timer associated with label specified when the rule is 893 added. When the timer expires, it triggers a sysfs notification. 894 The remaining time for expiration can be read via sysfs. 895 896 To compile it as a module, choose M here. If unsure, say N. 897 898config NETFILTER_XT_TARGET_LED 899 tristate '"LED" target support' 900 depends on LEDS_CLASS && LEDS_TRIGGERS 901 depends on NETFILTER_ADVANCED 902 help 903 This option adds a `LED' target, which allows you to blink LEDs in 904 response to particular packets passing through your machine. 905 906 This can be used to turn a spare LED into a network activity LED, 907 which only flashes in response to FTP transfers, for example. Or 908 you could have an LED which lights up for a minute or two every time 909 somebody connects to your machine via SSH. 910 911 You will need support for the "led" class to make this work. 912 913 To create an LED trigger for incoming SSH traffic: 914 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 915 916 Then attach the new trigger to an LED on your system: 917 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 918 919 For more information on the LEDs available on your system, see 920 Documentation/leds/leds-class.rst 921 922config NETFILTER_XT_TARGET_LOG 923 tristate "LOG target support" 924 select NF_LOG_COMMON 925 select NF_LOG_IPV4 926 select NF_LOG_IPV6 if IP6_NF_IPTABLES 927 default m if NETFILTER_ADVANCED=n 928 help 929 This option adds a `LOG' target, which allows you to create rules in 930 any iptables table which records the packet header to the syslog. 931 932 To compile it as a module, choose M here. If unsure, say N. 933 934config NETFILTER_XT_TARGET_MARK 935 tristate '"MARK" target support' 936 depends on NETFILTER_ADVANCED 937 select NETFILTER_XT_MARK 938 ---help--- 939 This is a backwards-compat option for the user's convenience 940 (e.g. when running oldconfig). It selects 941 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 942 943config NETFILTER_XT_NAT 944 tristate '"SNAT and DNAT" targets support' 945 depends on NF_NAT 946 ---help--- 947 This option enables the SNAT and DNAT targets. 948 949 To compile it as a module, choose M here. If unsure, say N. 950 951config NETFILTER_XT_TARGET_NETMAP 952 tristate '"NETMAP" target support' 953 depends on NF_NAT 954 ---help--- 955 NETMAP is an implementation of static 1:1 NAT mapping of network 956 addresses. It maps the network address part, while keeping the host 957 address part intact. 958 959 To compile it as a module, choose M here. If unsure, say N. 960 961config NETFILTER_XT_TARGET_NFLOG 962 tristate '"NFLOG" target support' 963 default m if NETFILTER_ADVANCED=n 964 select NETFILTER_NETLINK_LOG 965 help 966 This option enables the NFLOG target, which allows to LOG 967 messages through nfnetlink_log. 968 969 To compile it as a module, choose M here. If unsure, say N. 970 971config NETFILTER_XT_TARGET_NFQUEUE 972 tristate '"NFQUEUE" target Support' 973 depends on NETFILTER_ADVANCED 974 select NETFILTER_NETLINK_QUEUE 975 help 976 This target replaced the old obsolete QUEUE target. 977 978 As opposed to QUEUE, it supports 65535 different queues, 979 not just one. 980 981 To compile it as a module, choose M here. If unsure, say N. 982 983config NETFILTER_XT_TARGET_NOTRACK 984 tristate '"NOTRACK" target support (DEPRECATED)' 985 depends on NF_CONNTRACK 986 depends on IP_NF_RAW || IP6_NF_RAW 987 depends on NETFILTER_ADVANCED 988 select NETFILTER_XT_TARGET_CT 989 990config NETFILTER_XT_TARGET_RATEEST 991 tristate '"RATEEST" target support' 992 depends on NETFILTER_ADVANCED 993 help 994 This option adds a `RATEEST' target, which allows to measure 995 rates similar to TC estimators. The `rateest' match can be 996 used to match on the measured rates. 997 998 To compile it as a module, choose M here. If unsure, say N. 999 1000config NETFILTER_XT_TARGET_REDIRECT 1001 tristate "REDIRECT target support" 1002 depends on NF_NAT 1003 select NF_NAT_REDIRECT 1004 ---help--- 1005 REDIRECT is a special case of NAT: all incoming connections are 1006 mapped onto the incoming interface's address, causing the packets to 1007 come to the local machine instead of passing through. This is 1008 useful for transparent proxies. 1009 1010 To compile it as a module, choose M here. If unsure, say N. 1011 1012config NETFILTER_XT_TARGET_MASQUERADE 1013 tristate "MASQUERADE target support" 1014 depends on NF_NAT 1015 default m if NETFILTER_ADVANCED=n 1016 select NF_NAT_MASQUERADE 1017 help 1018 Masquerading is a special case of NAT: all outgoing connections are 1019 changed to seem to come from a particular interface's address, and 1020 if the interface goes down, those connections are lost. This is 1021 only useful for dialup accounts with dynamic IP address (ie. your IP 1022 address will be different on next dialup). 1023 1024 To compile it as a module, choose M here. If unsure, say N. 1025 1026config NETFILTER_XT_TARGET_TEE 1027 tristate '"TEE" - packet cloning to alternate destination' 1028 depends on NETFILTER_ADVANCED 1029 depends on IPV6 || IPV6=n 1030 depends on !NF_CONNTRACK || NF_CONNTRACK 1031 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES 1032 select NF_DUP_IPV4 1033 select NF_DUP_IPV6 if IP6_NF_IPTABLES 1034 ---help--- 1035 This option adds a "TEE" target with which a packet can be cloned and 1036 this clone be rerouted to another nexthop. 1037 1038config NETFILTER_XT_TARGET_TPROXY 1039 tristate '"TPROXY" target transparent proxying support' 1040 depends on NETFILTER_XTABLES 1041 depends on NETFILTER_ADVANCED 1042 depends on IPV6 || IPV6=n 1043 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1044 depends on IP_NF_MANGLE 1045 select NF_DEFRAG_IPV4 1046 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1047 select NF_TPROXY_IPV4 1048 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES 1049 help 1050 This option adds a `TPROXY' target, which is somewhat similar to 1051 REDIRECT. It can only be used in the mangle table and is useful 1052 to redirect traffic to a transparent proxy. It does _not_ depend 1053 on Netfilter connection tracking and NAT, unlike REDIRECT. 1054 For it to work you will have to configure certain iptables rules 1055 and use policy routing. For more information on how to set it up 1056 see Documentation/networking/tproxy.txt. 1057 1058 To compile it as a module, choose M here. If unsure, say N. 1059 1060config NETFILTER_XT_TARGET_TRACE 1061 tristate '"TRACE" target support' 1062 depends on IP_NF_RAW || IP6_NF_RAW 1063 depends on NETFILTER_ADVANCED 1064 help 1065 The TRACE target allows you to mark packets so that the kernel 1066 will log every rule which match the packets as those traverse 1067 the tables, chains, rules. 1068 1069 If you want to compile it as a module, say M here and read 1070 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1071 1072config NETFILTER_XT_TARGET_SECMARK 1073 tristate '"SECMARK" target support' 1074 depends on NETWORK_SECMARK 1075 default m if NETFILTER_ADVANCED=n 1076 help 1077 The SECMARK target allows security marking of network 1078 packets, for use with security subsystems. 1079 1080 To compile it as a module, choose M here. If unsure, say N. 1081 1082config NETFILTER_XT_TARGET_TCPMSS 1083 tristate '"TCPMSS" target support' 1084 depends on IPV6 || IPV6=n 1085 default m if NETFILTER_ADVANCED=n 1086 ---help--- 1087 This option adds a `TCPMSS' target, which allows you to alter the 1088 MSS value of TCP SYN packets, to control the maximum size for that 1089 connection (usually limiting it to your outgoing interface's MTU 1090 minus 40). 1091 1092 This is used to overcome criminally braindead ISPs or servers which 1093 block ICMP Fragmentation Needed packets. The symptoms of this 1094 problem are that everything works fine from your Linux 1095 firewall/router, but machines behind it can never exchange large 1096 packets: 1097 1) Web browsers connect, then hang with no data received. 1098 2) Small mail works fine, but large emails hang. 1099 3) ssh works fine, but scp hangs after initial handshaking. 1100 1101 Workaround: activate this option and add a rule to your firewall 1102 configuration like: 1103 1104 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1105 -j TCPMSS --clamp-mss-to-pmtu 1106 1107 To compile it as a module, choose M here. If unsure, say N. 1108 1109config NETFILTER_XT_TARGET_TCPOPTSTRIP 1110 tristate '"TCPOPTSTRIP" target support' 1111 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1112 depends on NETFILTER_ADVANCED 1113 help 1114 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1115 TCP options from TCP packets. 1116 1117# alphabetically ordered list of matches 1118 1119comment "Xtables matches" 1120 1121config NETFILTER_XT_MATCH_ADDRTYPE 1122 tristate '"addrtype" address type match support' 1123 default m if NETFILTER_ADVANCED=n 1124 ---help--- 1125 This option allows you to match what routing thinks of an address, 1126 eg. UNICAST, LOCAL, BROADCAST, ... 1127 1128 If you want to compile it as a module, say M here and read 1129 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1130 1131config NETFILTER_XT_MATCH_BPF 1132 tristate '"bpf" match support' 1133 depends on NETFILTER_ADVANCED 1134 help 1135 BPF matching applies a linux socket filter to each packet and 1136 accepts those for which the filter returns non-zero. 1137 1138 To compile it as a module, choose M here. If unsure, say N. 1139 1140config NETFILTER_XT_MATCH_CGROUP 1141 tristate '"control group" match support' 1142 depends on NETFILTER_ADVANCED 1143 depends on CGROUPS 1144 select CGROUP_NET_CLASSID 1145 ---help--- 1146 Socket/process control group matching allows you to match locally 1147 generated packets based on which net_cls control group processes 1148 belong to. 1149 1150config NETFILTER_XT_MATCH_CLUSTER 1151 tristate '"cluster" match support' 1152 depends on NF_CONNTRACK 1153 depends on NETFILTER_ADVANCED 1154 ---help--- 1155 This option allows you to build work-load-sharing clusters of 1156 network servers/stateful firewalls without having a dedicated 1157 load-balancing router/server/switch. Basically, this match returns 1158 true when the packet must be handled by this cluster node. Thus, 1159 all nodes see all packets and this match decides which node handles 1160 what packets. The work-load sharing algorithm is based on source 1161 address hashing. 1162 1163 If you say Y or M here, try `iptables -m cluster --help` for 1164 more information. 1165 1166config NETFILTER_XT_MATCH_COMMENT 1167 tristate '"comment" match support' 1168 depends on NETFILTER_ADVANCED 1169 help 1170 This option adds a `comment' dummy-match, which allows you to put 1171 comments in your iptables ruleset. 1172 1173 If you want to compile it as a module, say M here and read 1174 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1175 1176config NETFILTER_XT_MATCH_CONNBYTES 1177 tristate '"connbytes" per-connection counter match support' 1178 depends on NF_CONNTRACK 1179 depends on NETFILTER_ADVANCED 1180 help 1181 This option adds a `connbytes' match, which allows you to match the 1182 number of bytes and/or packets for each direction within a connection. 1183 1184 If you want to compile it as a module, say M here and read 1185 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1186 1187config NETFILTER_XT_MATCH_CONNLABEL 1188 tristate '"connlabel" match support' 1189 select NF_CONNTRACK_LABELS 1190 depends on NF_CONNTRACK 1191 depends on NETFILTER_ADVANCED 1192 ---help--- 1193 This match allows you to test and assign userspace-defined labels names 1194 to a connection. The kernel only stores bit values - mapping 1195 names to bits is done by userspace. 1196 1197 Unlike connmark, more than 32 flag bits may be assigned to a 1198 connection simultaneously. 1199 1200config NETFILTER_XT_MATCH_CONNLIMIT 1201 tristate '"connlimit" match support' 1202 depends on NF_CONNTRACK 1203 depends on NETFILTER_ADVANCED 1204 select NETFILTER_CONNCOUNT 1205 ---help--- 1206 This match allows you to match against the number of parallel 1207 connections to a server per client IP address (or address block). 1208 1209config NETFILTER_XT_MATCH_CONNMARK 1210 tristate '"connmark" connection mark match support' 1211 depends on NF_CONNTRACK 1212 depends on NETFILTER_ADVANCED 1213 select NETFILTER_XT_CONNMARK 1214 ---help--- 1215 This is a backwards-compat option for the user's convenience 1216 (e.g. when running oldconfig). It selects 1217 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1218 1219config NETFILTER_XT_MATCH_CONNTRACK 1220 tristate '"conntrack" connection tracking match support' 1221 depends on NF_CONNTRACK 1222 default m if NETFILTER_ADVANCED=n 1223 help 1224 This is a general conntrack match module, a superset of the state match. 1225 1226 It allows matching on additional conntrack information, which is 1227 useful in complex configurations, such as NAT gateways with multiple 1228 internet links or tunnels. 1229 1230 To compile it as a module, choose M here. If unsure, say N. 1231 1232config NETFILTER_XT_MATCH_CPU 1233 tristate '"cpu" match support' 1234 depends on NETFILTER_ADVANCED 1235 help 1236 CPU matching allows you to match packets based on the CPU 1237 currently handling the packet. 1238 1239 To compile it as a module, choose M here. If unsure, say N. 1240 1241config NETFILTER_XT_MATCH_DCCP 1242 tristate '"dccp" protocol match support' 1243 depends on NETFILTER_ADVANCED 1244 default IP_DCCP 1245 help 1246 With this option enabled, you will be able to use the iptables 1247 `dccp' match in order to match on DCCP source/destination ports 1248 and DCCP flags. 1249 1250 If you want to compile it as a module, say M here and read 1251 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1252 1253config NETFILTER_XT_MATCH_DEVGROUP 1254 tristate '"devgroup" match support' 1255 depends on NETFILTER_ADVANCED 1256 help 1257 This options adds a `devgroup' match, which allows to match on the 1258 device group a network device is assigned to. 1259 1260 To compile it as a module, choose M here. If unsure, say N. 1261 1262config NETFILTER_XT_MATCH_DSCP 1263 tristate '"dscp" and "tos" match support' 1264 depends on NETFILTER_ADVANCED 1265 help 1266 This option adds a `DSCP' match, which allows you to match against 1267 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1268 1269 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1270 1271 It will also add a "tos" match, which allows you to match packets 1272 based on the Type Of Service fields of the IPv4 packet (which share 1273 the same bits as DSCP). 1274 1275 To compile it as a module, choose M here. If unsure, say N. 1276 1277config NETFILTER_XT_MATCH_ECN 1278 tristate '"ecn" match support' 1279 depends on NETFILTER_ADVANCED 1280 ---help--- 1281 This option adds an "ECN" match, which allows you to match against 1282 the IPv4 and TCP header ECN fields. 1283 1284 To compile it as a module, choose M here. If unsure, say N. 1285 1286config NETFILTER_XT_MATCH_ESP 1287 tristate '"esp" match support' 1288 depends on NETFILTER_ADVANCED 1289 help 1290 This match extension allows you to match a range of SPIs 1291 inside ESP header of IPSec packets. 1292 1293 To compile it as a module, choose M here. If unsure, say N. 1294 1295config NETFILTER_XT_MATCH_HASHLIMIT 1296 tristate '"hashlimit" match support' 1297 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1298 depends on NETFILTER_ADVANCED 1299 help 1300 This option adds a `hashlimit' match. 1301 1302 As opposed to `limit', this match dynamically creates a hash table 1303 of limit buckets, based on your selection of source/destination 1304 addresses and/or ports. 1305 1306 It enables you to express policies like `10kpps for any given 1307 destination address' or `500pps from any given source address' 1308 with a single rule. 1309 1310config NETFILTER_XT_MATCH_HELPER 1311 tristate '"helper" match support' 1312 depends on NF_CONNTRACK 1313 depends on NETFILTER_ADVANCED 1314 help 1315 Helper matching allows you to match packets in dynamic connections 1316 tracked by a conntrack-helper, ie. ip_conntrack_ftp 1317 1318 To compile it as a module, choose M here. If unsure, say Y. 1319 1320config NETFILTER_XT_MATCH_HL 1321 tristate '"hl" hoplimit/TTL match support' 1322 depends on NETFILTER_ADVANCED 1323 ---help--- 1324 HL matching allows you to match packets based on the hoplimit 1325 in the IPv6 header, or the time-to-live field in the IPv4 1326 header of the packet. 1327 1328config NETFILTER_XT_MATCH_IPCOMP 1329 tristate '"ipcomp" match support' 1330 depends on NETFILTER_ADVANCED 1331 help 1332 This match extension allows you to match a range of CPIs(16 bits) 1333 inside IPComp header of IPSec packets. 1334 1335 To compile it as a module, choose M here. If unsure, say N. 1336 1337config NETFILTER_XT_MATCH_IPRANGE 1338 tristate '"iprange" address range match support' 1339 depends on NETFILTER_ADVANCED 1340 ---help--- 1341 This option adds a "iprange" match, which allows you to match based on 1342 an IP address range. (Normal iptables only matches on single addresses 1343 with an optional mask.) 1344 1345 If unsure, say M. 1346 1347config NETFILTER_XT_MATCH_IPVS 1348 tristate '"ipvs" match support' 1349 depends on IP_VS 1350 depends on NETFILTER_ADVANCED 1351 depends on NF_CONNTRACK 1352 help 1353 This option allows you to match against IPVS properties of a packet. 1354 1355 If unsure, say N. 1356 1357config NETFILTER_XT_MATCH_L2TP 1358 tristate '"l2tp" match support' 1359 depends on NETFILTER_ADVANCED 1360 default L2TP 1361 ---help--- 1362 This option adds an "L2TP" match, which allows you to match against 1363 L2TP protocol header fields. 1364 1365 To compile it as a module, choose M here. If unsure, say N. 1366 1367config NETFILTER_XT_MATCH_LENGTH 1368 tristate '"length" match support' 1369 depends on NETFILTER_ADVANCED 1370 help 1371 This option allows you to match the length of a packet against a 1372 specific value or range of values. 1373 1374 To compile it as a module, choose M here. If unsure, say N. 1375 1376config NETFILTER_XT_MATCH_LIMIT 1377 tristate '"limit" match support' 1378 depends on NETFILTER_ADVANCED 1379 help 1380 limit matching allows you to control the rate at which a rule can be 1381 matched: mainly useful in combination with the LOG target ("LOG 1382 target support", below) and to avoid some Denial of Service attacks. 1383 1384 To compile it as a module, choose M here. If unsure, say N. 1385 1386config NETFILTER_XT_MATCH_MAC 1387 tristate '"mac" address match support' 1388 depends on NETFILTER_ADVANCED 1389 help 1390 MAC matching allows you to match packets based on the source 1391 Ethernet address of the packet. 1392 1393 To compile it as a module, choose M here. If unsure, say N. 1394 1395config NETFILTER_XT_MATCH_MARK 1396 tristate '"mark" match support' 1397 depends on NETFILTER_ADVANCED 1398 select NETFILTER_XT_MARK 1399 ---help--- 1400 This is a backwards-compat option for the user's convenience 1401 (e.g. when running oldconfig). It selects 1402 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1403 1404config NETFILTER_XT_MATCH_MULTIPORT 1405 tristate '"multiport" Multiple port match support' 1406 depends on NETFILTER_ADVANCED 1407 help 1408 Multiport matching allows you to match TCP or UDP packets based on 1409 a series of source or destination ports: normally a rule can only 1410 match a single range of ports. 1411 1412 To compile it as a module, choose M here. If unsure, say N. 1413 1414config NETFILTER_XT_MATCH_NFACCT 1415 tristate '"nfacct" match support' 1416 depends on NETFILTER_ADVANCED 1417 select NETFILTER_NETLINK_ACCT 1418 help 1419 This option allows you to use the extended accounting through 1420 nfnetlink_acct. 1421 1422 To compile it as a module, choose M here. If unsure, say N. 1423 1424config NETFILTER_XT_MATCH_OSF 1425 tristate '"osf" Passive OS fingerprint match' 1426 depends on NETFILTER_ADVANCED 1427 select NETFILTER_NETLINK_OSF 1428 help 1429 This option selects the Passive OS Fingerprinting match module 1430 that allows to passively match the remote operating system by 1431 analyzing incoming TCP SYN packets. 1432 1433 Rules and loading software can be downloaded from 1434 http://www.ioremap.net/projects/osf 1435 1436 To compile it as a module, choose M here. If unsure, say N. 1437 1438config NETFILTER_XT_MATCH_OWNER 1439 tristate '"owner" match support' 1440 depends on NETFILTER_ADVANCED 1441 ---help--- 1442 Socket owner matching allows you to match locally-generated packets 1443 based on who created the socket: the user or group. It is also 1444 possible to check whether a socket actually exists. 1445 1446config NETFILTER_XT_MATCH_POLICY 1447 tristate 'IPsec "policy" match support' 1448 depends on XFRM 1449 default m if NETFILTER_ADVANCED=n 1450 help 1451 Policy matching allows you to match packets based on the 1452 IPsec policy that was used during decapsulation/will 1453 be used during encapsulation. 1454 1455 To compile it as a module, choose M here. If unsure, say N. 1456 1457config NETFILTER_XT_MATCH_PHYSDEV 1458 tristate '"physdev" match support' 1459 depends on BRIDGE && BRIDGE_NETFILTER 1460 depends on NETFILTER_ADVANCED 1461 help 1462 Physdev packet matching matches against the physical bridge ports 1463 the IP packet arrived on or will leave by. 1464 1465 To compile it as a module, choose M here. If unsure, say N. 1466 1467config NETFILTER_XT_MATCH_PKTTYPE 1468 tristate '"pkttype" packet type match support' 1469 depends on NETFILTER_ADVANCED 1470 help 1471 Packet type matching allows you to match a packet by 1472 its "class", eg. BROADCAST, MULTICAST, ... 1473 1474 Typical usage: 1475 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1476 1477 To compile it as a module, choose M here. If unsure, say N. 1478 1479config NETFILTER_XT_MATCH_QUOTA 1480 tristate '"quota" match support' 1481 depends on NETFILTER_ADVANCED 1482 help 1483 This option adds a `quota' match, which allows to match on a 1484 byte counter. 1485 1486 If you want to compile it as a module, say M here and read 1487 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1488 1489config NETFILTER_XT_MATCH_RATEEST 1490 tristate '"rateest" match support' 1491 depends on NETFILTER_ADVANCED 1492 select NETFILTER_XT_TARGET_RATEEST 1493 help 1494 This option adds a `rateest' match, which allows to match on the 1495 rate estimated by the RATEEST target. 1496 1497 To compile it as a module, choose M here. If unsure, say N. 1498 1499config NETFILTER_XT_MATCH_REALM 1500 tristate '"realm" match support' 1501 depends on NETFILTER_ADVANCED 1502 select IP_ROUTE_CLASSID 1503 help 1504 This option adds a `realm' match, which allows you to use the realm 1505 key from the routing subsystem inside iptables. 1506 1507 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1508 in tc world. 1509 1510 If you want to compile it as a module, say M here and read 1511 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1512 1513config NETFILTER_XT_MATCH_RECENT 1514 tristate '"recent" match support' 1515 depends on NETFILTER_ADVANCED 1516 ---help--- 1517 This match is used for creating one or many lists of recently 1518 used addresses and then matching against that/those list(s). 1519 1520 Short options are available by using 'iptables -m recent -h' 1521 Official Website: <http://snowman.net/projects/ipt_recent/> 1522 1523config NETFILTER_XT_MATCH_SCTP 1524 tristate '"sctp" protocol match support' 1525 depends on NETFILTER_ADVANCED 1526 default IP_SCTP 1527 help 1528 With this option enabled, you will be able to use the 1529 `sctp' match in order to match on SCTP source/destination ports 1530 and SCTP chunk types. 1531 1532 If you want to compile it as a module, say M here and read 1533 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1534 1535config NETFILTER_XT_MATCH_SOCKET 1536 tristate '"socket" match support' 1537 depends on NETFILTER_XTABLES 1538 depends on NETFILTER_ADVANCED 1539 depends on IPV6 || IPV6=n 1540 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1541 select NF_SOCKET_IPV4 1542 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES 1543 select NF_DEFRAG_IPV4 1544 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1545 help 1546 This option adds a `socket' match, which can be used to match 1547 packets for which a TCP or UDP socket lookup finds a valid socket. 1548 It can be used in combination with the MARK target and policy 1549 routing to implement full featured non-locally bound sockets. 1550 1551 To compile it as a module, choose M here. If unsure, say N. 1552 1553config NETFILTER_XT_MATCH_STATE 1554 tristate '"state" match support' 1555 depends on NF_CONNTRACK 1556 default m if NETFILTER_ADVANCED=n 1557 help 1558 Connection state matching allows you to match packets based on their 1559 relationship to a tracked connection (ie. previous packets). This 1560 is a powerful tool for packet classification. 1561 1562 To compile it as a module, choose M here. If unsure, say N. 1563 1564config NETFILTER_XT_MATCH_STATISTIC 1565 tristate '"statistic" match support' 1566 depends on NETFILTER_ADVANCED 1567 help 1568 This option adds a `statistic' match, which allows you to match 1569 on packets periodically or randomly with a given percentage. 1570 1571 To compile it as a module, choose M here. If unsure, say N. 1572 1573config NETFILTER_XT_MATCH_STRING 1574 tristate '"string" match support' 1575 depends on NETFILTER_ADVANCED 1576 select TEXTSEARCH 1577 select TEXTSEARCH_KMP 1578 select TEXTSEARCH_BM 1579 select TEXTSEARCH_FSM 1580 help 1581 This option adds a `string' match, which allows you to look for 1582 pattern matchings in packets. 1583 1584 To compile it as a module, choose M here. If unsure, say N. 1585 1586config NETFILTER_XT_MATCH_TCPMSS 1587 tristate '"tcpmss" match support' 1588 depends on NETFILTER_ADVANCED 1589 help 1590 This option adds a `tcpmss' match, which allows you to examine the 1591 MSS value of TCP SYN packets, which control the maximum packet size 1592 for that connection. 1593 1594 To compile it as a module, choose M here. If unsure, say N. 1595 1596config NETFILTER_XT_MATCH_TIME 1597 tristate '"time" match support' 1598 depends on NETFILTER_ADVANCED 1599 ---help--- 1600 This option adds a "time" match, which allows you to match based on 1601 the packet arrival time (at the machine which netfilter is running) 1602 on) or departure time/date (for locally generated packets). 1603 1604 If you say Y here, try `iptables -m time --help` for 1605 more information. 1606 1607 If you want to compile it as a module, say M here. 1608 If unsure, say N. 1609 1610config NETFILTER_XT_MATCH_U32 1611 tristate '"u32" match support' 1612 depends on NETFILTER_ADVANCED 1613 ---help--- 1614 u32 allows you to extract quantities of up to 4 bytes from a packet, 1615 AND them with specified masks, shift them by specified amounts and 1616 test whether the results are in any of a set of specified ranges. 1617 The specification of what to extract is general enough to skip over 1618 headers with lengths stored in the packet, as in IP or TCP header 1619 lengths. 1620 1621 Details and examples are in the kernel module source. 1622 1623endif # NETFILTER_XTABLES 1624 1625endmenu 1626 1627source "net/netfilter/ipset/Kconfig" 1628 1629source "net/netfilter/ipvs/Kconfig" 1630