1menu "Core Netfilter Configuration" 2 depends on NET && INET && NETFILTER 3 4config NETFILTER_INGRESS 5 bool "Netfilter ingress support" 6 default y 7 select NET_INGRESS 8 help 9 This allows you to classify packets from ingress using the Netfilter 10 infrastructure. 11 12config NETFILTER_NETLINK 13 tristate 14 15config NETFILTER_FAMILY_BRIDGE 16 bool 17 18config NETFILTER_FAMILY_ARP 19 bool 20 21config NETFILTER_NETLINK_ACCT 22tristate "Netfilter NFACCT over NFNETLINK interface" 23 depends on NETFILTER_ADVANCED 24 select NETFILTER_NETLINK 25 help 26 If this option is enabled, the kernel will include support 27 for extended accounting via NFNETLINK. 28 29config NETFILTER_NETLINK_QUEUE 30 tristate "Netfilter NFQUEUE over NFNETLINK interface" 31 depends on NETFILTER_ADVANCED 32 select NETFILTER_NETLINK 33 help 34 If this option is enabled, the kernel will include support 35 for queueing packets via NFNETLINK. 36 37config NETFILTER_NETLINK_LOG 38 tristate "Netfilter LOG over NFNETLINK interface" 39 default m if NETFILTER_ADVANCED=n 40 select NETFILTER_NETLINK 41 help 42 If this option is enabled, the kernel will include support 43 for logging packets via NFNETLINK. 44 45 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 46 and is also scheduled to replace the old syslog-based ipt_LOG 47 and ip6t_LOG modules. 48 49config NETFILTER_NETLINK_OSF 50 tristate "Netfilter OSF over NFNETLINK interface" 51 depends on NETFILTER_ADVANCED 52 select NETFILTER_NETLINK 53 help 54 If this option is enabled, the kernel will include support 55 for passive OS fingerprint via NFNETLINK. 56 57config NF_CONNTRACK 58 tristate "Netfilter connection tracking support" 59 default m if NETFILTER_ADVANCED=n 60 select NF_DEFRAG_IPV4 61 select NF_DEFRAG_IPV6 if IPV6 != n 62 help 63 Connection tracking keeps a record of what packets have passed 64 through your machine, in order to figure out how they are related 65 into connections. 66 67 This is required to do Masquerading or other kinds of Network 68 Address Translation. It can also be used to enhance packet 69 filtering (see `Connection state match support' below). 70 71 To compile it as a module, choose M here. If unsure, say N. 72 73config NF_LOG_COMMON 74 tristate 75 76config NF_LOG_NETDEV 77 tristate "Netdev packet logging" 78 select NF_LOG_COMMON 79 80if NF_CONNTRACK 81config NETFILTER_CONNCOUNT 82 tristate 83 84config NF_CONNTRACK_MARK 85 bool 'Connection mark tracking support' 86 depends on NETFILTER_ADVANCED 87 help 88 This option enables support for connection marks, used by the 89 `CONNMARK' target and `connmark' match. Similar to the mark value 90 of packets, but this mark value is kept in the conntrack session 91 instead of the individual packets. 92 93config NF_CONNTRACK_SECMARK 94 bool 'Connection tracking security mark support' 95 depends on NETWORK_SECMARK 96 default m if NETFILTER_ADVANCED=n 97 help 98 This option enables security markings to be applied to 99 connections. Typically they are copied to connections from 100 packets using the CONNSECMARK target and copied back from 101 connections to packets with the same target, with the packets 102 being originally labeled via SECMARK. 103 104 If unsure, say 'N'. 105 106config NF_CONNTRACK_ZONES 107 bool 'Connection tracking zones' 108 depends on NETFILTER_ADVANCED 109 help 110 This option enables support for connection tracking zones. 111 Normally, each connection needs to have a unique system wide 112 identity. Connection tracking zones allow to have multiple 113 connections using the same identity, as long as they are 114 contained in different zones. 115 116 If unsure, say `N'. 117 118config NF_CONNTRACK_PROCFS 119 bool "Supply CT list in procfs (OBSOLETE)" 120 default y 121 depends on PROC_FS 122 ---help--- 123 This option enables for the list of known conntrack entries 124 to be shown in procfs under net/netfilter/nf_conntrack. This 125 is considered obsolete in favor of using the conntrack(8) 126 tool which uses Netlink. 127 128config NF_CONNTRACK_EVENTS 129 bool "Connection tracking events" 130 depends on NETFILTER_ADVANCED 131 help 132 If this option is enabled, the connection tracking code will 133 provide a notifier chain that can be used by other kernel code 134 to get notified about changes in the connection tracking state. 135 136 If unsure, say `N'. 137 138config NF_CONNTRACK_TIMEOUT 139 bool 'Connection tracking timeout' 140 depends on NETFILTER_ADVANCED 141 help 142 This option enables support for connection tracking timeout 143 extension. This allows you to attach timeout policies to flow 144 via the CT target. 145 146 If unsure, say `N'. 147 148config NF_CONNTRACK_TIMESTAMP 149 bool 'Connection tracking timestamping' 150 depends on NETFILTER_ADVANCED 151 help 152 This option enables support for connection tracking timestamping. 153 This allows you to store the flow start-time and to obtain 154 the flow-stop time (once it has been destroyed) via Connection 155 tracking events. 156 157 If unsure, say `N'. 158 159config NF_CONNTRACK_LABELS 160 bool "Connection tracking labels" 161 help 162 This option enables support for assigning user-defined flag bits 163 to connection tracking entries. It can be used with xtables connlabel 164 match and the nftables ct expression. 165 166config NF_CT_PROTO_DCCP 167 bool 'DCCP protocol connection tracking support' 168 depends on NETFILTER_ADVANCED 169 default y 170 help 171 With this option enabled, the layer 3 independent connection 172 tracking code will be able to do state tracking on DCCP connections. 173 174 If unsure, say Y. 175 176config NF_CT_PROTO_GRE 177 tristate 178 179config NF_CT_PROTO_SCTP 180 bool 'SCTP protocol connection tracking support' 181 depends on NETFILTER_ADVANCED 182 default y 183 select LIBCRC32C 184 help 185 With this option enabled, the layer 3 independent connection 186 tracking code will be able to do state tracking on SCTP connections. 187 188 If unsure, say Y. 189 190config NF_CT_PROTO_UDPLITE 191 bool 'UDP-Lite protocol connection tracking support' 192 depends on NETFILTER_ADVANCED 193 default y 194 help 195 With this option enabled, the layer 3 independent connection 196 tracking code will be able to do state tracking on UDP-Lite 197 connections. 198 199 If unsure, say Y. 200 201config NF_CONNTRACK_AMANDA 202 tristate "Amanda backup protocol support" 203 depends on NETFILTER_ADVANCED 204 select TEXTSEARCH 205 select TEXTSEARCH_KMP 206 help 207 If you are running the Amanda backup package <http://www.amanda.org/> 208 on this machine or machines that will be MASQUERADED through this 209 machine, then you may want to enable this feature. This allows the 210 connection tracking and natting code to allow the sub-channels that 211 Amanda requires for communication of the backup data, messages and 212 index. 213 214 To compile it as a module, choose M here. If unsure, say N. 215 216config NF_CONNTRACK_FTP 217 tristate "FTP protocol support" 218 default m if NETFILTER_ADVANCED=n 219 help 220 Tracking FTP connections is problematic: special helpers are 221 required for tracking them, and doing masquerading and other forms 222 of Network Address Translation on them. 223 224 This is FTP support on Layer 3 independent connection tracking. 225 Layer 3 independent connection tracking is experimental scheme 226 which generalize ip_conntrack to support other layer 3 protocols. 227 228 To compile it as a module, choose M here. If unsure, say N. 229 230config NF_CONNTRACK_H323 231 tristate "H.323 protocol support" 232 depends on IPV6 || IPV6=n 233 depends on NETFILTER_ADVANCED 234 help 235 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 236 important VoIP protocols, it is widely used by voice hardware and 237 software including voice gateways, IP phones, Netmeeting, OpenPhone, 238 Gnomemeeting, etc. 239 240 With this module you can support H.323 on a connection tracking/NAT 241 firewall. 242 243 This module supports RAS, Fast Start, H.245 Tunnelling, Call 244 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 245 whiteboard, file transfer, etc. For more information, please 246 visit http://nath323.sourceforge.net/. 247 248 To compile it as a module, choose M here. If unsure, say N. 249 250config NF_CONNTRACK_IRC 251 tristate "IRC protocol support" 252 default m if NETFILTER_ADVANCED=n 253 help 254 There is a commonly-used extension to IRC called 255 Direct Client-to-Client Protocol (DCC). This enables users to send 256 files to each other, and also chat to each other without the need 257 of a server. DCC Sending is used anywhere you send files over IRC, 258 and DCC Chat is most commonly used by Eggdrop bots. If you are 259 using NAT, this extension will enable you to send files and initiate 260 chats. Note that you do NOT need this extension to get files or 261 have others initiate chats, or everything else in IRC. 262 263 To compile it as a module, choose M here. If unsure, say N. 264 265config NF_CONNTRACK_BROADCAST 266 tristate 267 268config NF_CONNTRACK_NETBIOS_NS 269 tristate "NetBIOS name service protocol support" 270 select NF_CONNTRACK_BROADCAST 271 help 272 NetBIOS name service requests are sent as broadcast messages from an 273 unprivileged port and responded to with unicast messages to the 274 same port. This make them hard to firewall properly because connection 275 tracking doesn't deal with broadcasts. This helper tracks locally 276 originating NetBIOS name service requests and the corresponding 277 responses. It relies on correct IP address configuration, specifically 278 netmask and broadcast address. When properly configured, the output 279 of "ip address show" should look similar to this: 280 281 $ ip -4 address show eth0 282 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 283 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 284 285 To compile it as a module, choose M here. If unsure, say N. 286 287config NF_CONNTRACK_SNMP 288 tristate "SNMP service protocol support" 289 depends on NETFILTER_ADVANCED 290 select NF_CONNTRACK_BROADCAST 291 help 292 SNMP service requests are sent as broadcast messages from an 293 unprivileged port and responded to with unicast messages to the 294 same port. This make them hard to firewall properly because connection 295 tracking doesn't deal with broadcasts. This helper tracks locally 296 originating SNMP service requests and the corresponding 297 responses. It relies on correct IP address configuration, specifically 298 netmask and broadcast address. 299 300 To compile it as a module, choose M here. If unsure, say N. 301 302config NF_CONNTRACK_PPTP 303 tristate "PPtP protocol support" 304 depends on NETFILTER_ADVANCED 305 select NF_CT_PROTO_GRE 306 help 307 This module adds support for PPTP (Point to Point Tunnelling 308 Protocol, RFC2637) connection tracking and NAT. 309 310 If you are running PPTP sessions over a stateful firewall or NAT 311 box, you may want to enable this feature. 312 313 Please note that not all PPTP modes of operation are supported yet. 314 Specifically these limitations exist: 315 - Blindly assumes that control connections are always established 316 in PNS->PAC direction. This is a violation of RFC2637. 317 - Only supports a single call within each session 318 319 To compile it as a module, choose M here. If unsure, say N. 320 321config NF_CONNTRACK_SANE 322 tristate "SANE protocol support" 323 depends on NETFILTER_ADVANCED 324 help 325 SANE is a protocol for remote access to scanners as implemented 326 by the 'saned' daemon. Like FTP, it uses separate control and 327 data connections. 328 329 With this module you can support SANE on a connection tracking 330 firewall. 331 332 To compile it as a module, choose M here. If unsure, say N. 333 334config NF_CONNTRACK_SIP 335 tristate "SIP protocol support" 336 default m if NETFILTER_ADVANCED=n 337 help 338 SIP is an application-layer control protocol that can establish, 339 modify, and terminate multimedia sessions (conferences) such as 340 Internet telephony calls. With the ip_conntrack_sip and 341 the nf_nat_sip modules you can support the protocol on a connection 342 tracking/NATing firewall. 343 344 To compile it as a module, choose M here. If unsure, say N. 345 346config NF_CONNTRACK_TFTP 347 tristate "TFTP protocol support" 348 depends on NETFILTER_ADVANCED 349 help 350 TFTP connection tracking helper, this is required depending 351 on how restrictive your ruleset is. 352 If you are using a tftp client behind -j SNAT or -j MASQUERADING 353 you will need this. 354 355 To compile it as a module, choose M here. If unsure, say N. 356 357config NF_CT_NETLINK 358 tristate 'Connection tracking netlink interface' 359 select NETFILTER_NETLINK 360 default m if NETFILTER_ADVANCED=n 361 help 362 This option enables support for a netlink-based userspace interface 363 364config NF_CT_NETLINK_TIMEOUT 365 tristate 'Connection tracking timeout tuning via Netlink' 366 select NETFILTER_NETLINK 367 depends on NETFILTER_ADVANCED 368 depends on NF_CONNTRACK_TIMEOUT 369 help 370 This option enables support for connection tracking timeout 371 fine-grain tuning. This allows you to attach specific timeout 372 policies to flows, instead of using the global timeout policy. 373 374 If unsure, say `N'. 375 376config NF_CT_NETLINK_HELPER 377 tristate 'Connection tracking helpers in user-space via Netlink' 378 select NETFILTER_NETLINK 379 depends on NF_CT_NETLINK 380 depends on NETFILTER_NETLINK_QUEUE 381 depends on NETFILTER_NETLINK_GLUE_CT 382 depends on NETFILTER_ADVANCED 383 help 384 This option enables the user-space connection tracking helpers 385 infrastructure. 386 387 If unsure, say `N'. 388 389config NETFILTER_NETLINK_GLUE_CT 390 bool "NFQUEUE and NFLOG integration with Connection Tracking" 391 default n 392 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 393 help 394 If this option is enabled, NFQUEUE and NFLOG can include 395 Connection Tracking information together with the packet is 396 the enqueued via NFNETLINK. 397 398config NF_NAT 399 tristate 400 401config NF_NAT_NEEDED 402 bool 403 depends on NF_NAT 404 default y 405 406config NF_NAT_AMANDA 407 tristate 408 depends on NF_CONNTRACK && NF_NAT 409 default NF_NAT && NF_CONNTRACK_AMANDA 410 411config NF_NAT_FTP 412 tristate 413 depends on NF_CONNTRACK && NF_NAT 414 default NF_NAT && NF_CONNTRACK_FTP 415 416config NF_NAT_IRC 417 tristate 418 depends on NF_CONNTRACK && NF_NAT 419 default NF_NAT && NF_CONNTRACK_IRC 420 421config NF_NAT_SIP 422 tristate 423 depends on NF_CONNTRACK && NF_NAT 424 default NF_NAT && NF_CONNTRACK_SIP 425 426config NF_NAT_TFTP 427 tristate 428 depends on NF_CONNTRACK && NF_NAT 429 default NF_NAT && NF_CONNTRACK_TFTP 430 431config NF_NAT_REDIRECT 432 bool 433 434config NETFILTER_SYNPROXY 435 tristate 436 437endif # NF_CONNTRACK 438 439config NF_TABLES 440 select NETFILTER_NETLINK 441 tristate "Netfilter nf_tables support" 442 help 443 nftables is the new packet classification framework that intends to 444 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 445 provides a pseudo-state machine with an extensible instruction-set 446 (also known as expressions) that the userspace 'nft' utility 447 (http://www.netfilter.org/projects/nftables) uses to build the 448 rule-set. It also comes with the generic set infrastructure that 449 allows you to construct mappings between matchings and actions 450 for performance lookups. 451 452 To compile it as a module, choose M here. 453 454if NF_TABLES 455 456config NF_TABLES_SET 457 tristate "Netfilter nf_tables set infrastructure" 458 help 459 This option enables the nf_tables set infrastructure that allows to 460 look up for elements in a set and to build one-way mappings between 461 matchings and actions. 462 463config NF_TABLES_INET 464 depends on IPV6 465 select NF_TABLES_IPV4 466 select NF_TABLES_IPV6 467 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support" 468 help 469 This option enables support for a mixed IPv4/IPv6 "inet" table. 470 471config NF_TABLES_NETDEV 472 bool "Netfilter nf_tables netdev tables support" 473 help 474 This option enables support for the "netdev" table. 475 476config NFT_NUMGEN 477 tristate "Netfilter nf_tables number generator module" 478 help 479 This option adds the number generator expression used to perform 480 incremental counting and random numbers bound to a upper limit. 481 482config NFT_CT 483 depends on NF_CONNTRACK 484 tristate "Netfilter nf_tables conntrack module" 485 help 486 This option adds the "ct" expression that you can use to match 487 connection tracking information such as the flow state. 488 489config NFT_FLOW_OFFLOAD 490 depends on NF_CONNTRACK && NF_FLOW_TABLE 491 tristate "Netfilter nf_tables hardware flow offload module" 492 help 493 This option adds the "flow_offload" expression that you can use to 494 choose what flows are placed into the hardware. 495 496config NFT_COUNTER 497 tristate "Netfilter nf_tables counter module" 498 help 499 This option adds the "counter" expression that you can use to 500 include packet and byte counters in a rule. 501 502config NFT_CONNLIMIT 503 tristate "Netfilter nf_tables connlimit module" 504 depends on NF_CONNTRACK 505 depends on NETFILTER_ADVANCED 506 select NETFILTER_CONNCOUNT 507 help 508 This option adds the "connlimit" expression that you can use to 509 ratelimit rule matchings per connections. 510 511config NFT_LOG 512 tristate "Netfilter nf_tables log module" 513 help 514 This option adds the "log" expression that you can use to log 515 packets matching some criteria. 516 517config NFT_LIMIT 518 tristate "Netfilter nf_tables limit module" 519 help 520 This option adds the "limit" expression that you can use to 521 ratelimit rule matchings. 522 523config NFT_MASQ 524 depends on NF_CONNTRACK 525 depends on NF_NAT 526 tristate "Netfilter nf_tables masquerade support" 527 help 528 This option adds the "masquerade" expression that you can use 529 to perform NAT in the masquerade flavour. 530 531config NFT_REDIR 532 depends on NF_CONNTRACK 533 depends on NF_NAT 534 tristate "Netfilter nf_tables redirect support" 535 help 536 This options adds the "redirect" expression that you can use 537 to perform NAT in the redirect flavour. 538 539config NFT_NAT 540 depends on NF_CONNTRACK 541 select NF_NAT 542 tristate "Netfilter nf_tables nat module" 543 help 544 This option adds the "nat" expression that you can use to perform 545 typical Network Address Translation (NAT) packet transformations. 546 547config NFT_TUNNEL 548 tristate "Netfilter nf_tables tunnel module" 549 help 550 This option adds the "tunnel" expression that you can use to set 551 tunneling policies. 552 553config NFT_OBJREF 554 tristate "Netfilter nf_tables stateful object reference module" 555 help 556 This option adds the "objref" expression that allows you to refer to 557 stateful objects, such as counters and quotas. 558 559config NFT_QUEUE 560 depends on NETFILTER_NETLINK_QUEUE 561 tristate "Netfilter nf_tables queue module" 562 help 563 This is required if you intend to use the userspace queueing 564 infrastructure (also known as NFQUEUE) from nftables. 565 566config NFT_QUOTA 567 tristate "Netfilter nf_tables quota module" 568 help 569 This option adds the "quota" expression that you can use to match 570 enforce bytes quotas. 571 572config NFT_REJECT 573 default m if NETFILTER_ADVANCED=n 574 tristate "Netfilter nf_tables reject support" 575 depends on !NF_TABLES_INET || (IPV6!=m || m) 576 help 577 This option adds the "reject" expression that you can use to 578 explicitly deny and notify via TCP reset/ICMP informational errors 579 unallowed traffic. 580 581config NFT_REJECT_INET 582 depends on NF_TABLES_INET 583 default NFT_REJECT 584 tristate 585 586config NFT_COMPAT 587 depends on NETFILTER_XTABLES 588 tristate "Netfilter x_tables over nf_tables module" 589 help 590 This is required if you intend to use any of existing 591 x_tables match/target extensions over the nf_tables 592 framework. 593 594config NFT_HASH 595 tristate "Netfilter nf_tables hash module" 596 help 597 This option adds the "hash" expression that you can use to perform 598 a hash operation on registers. 599 600config NFT_FIB 601 tristate 602 603config NFT_FIB_INET 604 depends on NF_TABLES_INET 605 depends on NFT_FIB_IPV4 606 depends on NFT_FIB_IPV6 607 tristate "Netfilter nf_tables fib inet support" 608 help 609 This option allows using the FIB expression from the inet table. 610 The lookup will be delegated to the IPv4 or IPv6 FIB depending 611 on the protocol of the packet. 612 613config NFT_XFRM 614 tristate "Netfilter nf_tables xfrm/IPSec security association matching" 615 depends on XFRM 616 help 617 This option adds an expression that you can use to extract properties 618 of a packets security association. 619 620config NFT_SOCKET 621 tristate "Netfilter nf_tables socket match support" 622 depends on IPV6 || IPV6=n 623 select NF_SOCKET_IPV4 624 select NF_SOCKET_IPV6 if NF_TABLES_IPV6 625 help 626 This option allows matching for the presence or absence of a 627 corresponding socket and its attributes. 628 629config NFT_OSF 630 tristate "Netfilter nf_tables passive OS fingerprint support" 631 depends on NETFILTER_ADVANCED 632 select NETFILTER_NETLINK_OSF 633 help 634 This option allows matching packets from an specific OS. 635 636config NFT_TPROXY 637 tristate "Netfilter nf_tables tproxy support" 638 depends on IPV6 || IPV6=n 639 select NF_DEFRAG_IPV4 640 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6 641 select NF_TPROXY_IPV4 642 select NF_TPROXY_IPV6 if NF_TABLES_IPV6 643 help 644 This makes transparent proxy support available in nftables. 645 646if NF_TABLES_NETDEV 647 648config NF_DUP_NETDEV 649 tristate "Netfilter packet duplication support" 650 help 651 This option enables the generic packet duplication infrastructure 652 for Netfilter. 653 654config NFT_DUP_NETDEV 655 tristate "Netfilter nf_tables netdev packet duplication support" 656 select NF_DUP_NETDEV 657 help 658 This option enables packet duplication for the "netdev" family. 659 660config NFT_FWD_NETDEV 661 tristate "Netfilter nf_tables netdev packet forwarding support" 662 select NF_DUP_NETDEV 663 help 664 This option enables packet forwarding for the "netdev" family. 665 666config NFT_FIB_NETDEV 667 depends on NFT_FIB_IPV4 668 depends on NFT_FIB_IPV6 669 tristate "Netfilter nf_tables netdev fib lookups support" 670 help 671 This option allows using the FIB expression from the netdev table. 672 The lookup will be delegated to the IPv4 or IPv6 FIB depending 673 on the protocol of the packet. 674 675endif # NF_TABLES_NETDEV 676 677endif # NF_TABLES 678 679config NF_FLOW_TABLE_INET 680 tristate "Netfilter flow table mixed IPv4/IPv6 module" 681 depends on NF_FLOW_TABLE 682 help 683 This option adds the flow table mixed IPv4/IPv6 support. 684 685 To compile it as a module, choose M here. 686 687config NF_FLOW_TABLE 688 tristate "Netfilter flow table module" 689 depends on NETFILTER_INGRESS 690 depends on NF_CONNTRACK 691 depends on NF_TABLES 692 help 693 This option adds the flow table core infrastructure. 694 695 To compile it as a module, choose M here. 696 697config NETFILTER_XTABLES 698 tristate "Netfilter Xtables support (required for ip_tables)" 699 default m if NETFILTER_ADVANCED=n 700 help 701 This is required if you intend to use any of ip_tables, 702 ip6_tables or arp_tables. 703 704if NETFILTER_XTABLES 705 706comment "Xtables combined modules" 707 708config NETFILTER_XT_MARK 709 tristate 'nfmark target and match support' 710 default m if NETFILTER_ADVANCED=n 711 ---help--- 712 This option adds the "MARK" target and "mark" match. 713 714 Netfilter mark matching allows you to match packets based on the 715 "nfmark" value in the packet. 716 The target allows you to create rules in the "mangle" table which alter 717 the netfilter mark (nfmark) field associated with the packet. 718 719 Prior to routing, the nfmark can influence the routing method and can 720 also be used by other subsystems to change their behavior. 721 722config NETFILTER_XT_CONNMARK 723 tristate 'ctmark target and match support' 724 depends on NF_CONNTRACK 725 depends on NETFILTER_ADVANCED 726 select NF_CONNTRACK_MARK 727 ---help--- 728 This option adds the "CONNMARK" target and "connmark" match. 729 730 Netfilter allows you to store a mark value per connection (a.k.a. 731 ctmark), similarly to the packet mark (nfmark). Using this 732 target and match, you can set and match on this mark. 733 734config NETFILTER_XT_SET 735 tristate 'set target and match support' 736 depends on IP_SET 737 depends on NETFILTER_ADVANCED 738 help 739 This option adds the "SET" target and "set" match. 740 741 Using this target and match, you can add/delete and match 742 elements in the sets created by ipset(8). 743 744 To compile it as a module, choose M here. If unsure, say N. 745 746# alphabetically ordered list of targets 747 748comment "Xtables targets" 749 750config NETFILTER_XT_TARGET_AUDIT 751 tristate "AUDIT target support" 752 depends on AUDIT 753 depends on NETFILTER_ADVANCED 754 ---help--- 755 This option adds a 'AUDIT' target, which can be used to create 756 audit records for packets dropped/accepted. 757 758 To compileit as a module, choose M here. If unsure, say N. 759 760config NETFILTER_XT_TARGET_CHECKSUM 761 tristate "CHECKSUM target support" 762 depends on IP_NF_MANGLE || IP6_NF_MANGLE 763 depends on NETFILTER_ADVANCED 764 ---help--- 765 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 766 table to work around buggy DHCP clients in virtualized environments. 767 768 Some old DHCP clients drop packets because they are not aware 769 that the checksum would normally be offloaded to hardware and 770 thus should be considered valid. 771 This target can be used to fill in the checksum using iptables 772 when such packets are sent via a virtual network device. 773 774 To compile it as a module, choose M here. If unsure, say N. 775 776config NETFILTER_XT_TARGET_CLASSIFY 777 tristate '"CLASSIFY" target support' 778 depends on NETFILTER_ADVANCED 779 help 780 This option adds a `CLASSIFY' target, which enables the user to set 781 the priority of a packet. Some qdiscs can use this value for 782 classification, among these are: 783 784 atm, cbq, dsmark, pfifo_fast, htb, prio 785 786 To compile it as a module, choose M here. If unsure, say N. 787 788config NETFILTER_XT_TARGET_CONNMARK 789 tristate '"CONNMARK" target support' 790 depends on NF_CONNTRACK 791 depends on NETFILTER_ADVANCED 792 select NETFILTER_XT_CONNMARK 793 ---help--- 794 This is a backwards-compat option for the user's convenience 795 (e.g. when running oldconfig). It selects 796 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 797 798config NETFILTER_XT_TARGET_CONNSECMARK 799 tristate '"CONNSECMARK" target support' 800 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 801 default m if NETFILTER_ADVANCED=n 802 help 803 The CONNSECMARK target copies security markings from packets 804 to connections, and restores security markings from connections 805 to packets (if the packets are not already marked). This would 806 normally be used in conjunction with the SECMARK target. 807 808 To compile it as a module, choose M here. If unsure, say N. 809 810config NETFILTER_XT_TARGET_CT 811 tristate '"CT" target support' 812 depends on NF_CONNTRACK 813 depends on IP_NF_RAW || IP6_NF_RAW 814 depends on NETFILTER_ADVANCED 815 help 816 This options adds a `CT' target, which allows to specify initial 817 connection tracking parameters like events to be delivered and 818 the helper to be used. 819 820 To compile it as a module, choose M here. If unsure, say N. 821 822config NETFILTER_XT_TARGET_DSCP 823 tristate '"DSCP" and "TOS" target support' 824 depends on IP_NF_MANGLE || IP6_NF_MANGLE 825 depends on NETFILTER_ADVANCED 826 help 827 This option adds a `DSCP' target, which allows you to manipulate 828 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 829 830 The DSCP field can have any value between 0x0 and 0x3f inclusive. 831 832 It also adds the "TOS" target, which allows you to create rules in 833 the "mangle" table which alter the Type Of Service field of an IPv4 834 or the Priority field of an IPv6 packet, prior to routing. 835 836 To compile it as a module, choose M here. If unsure, say N. 837 838config NETFILTER_XT_TARGET_HL 839 tristate '"HL" hoplimit target support' 840 depends on IP_NF_MANGLE || IP6_NF_MANGLE 841 depends on NETFILTER_ADVANCED 842 ---help--- 843 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 844 targets, which enable the user to change the 845 hoplimit/time-to-live value of the IP header. 846 847 While it is safe to decrement the hoplimit/TTL value, the 848 modules also allow to increment and set the hoplimit value of 849 the header to arbitrary values. This is EXTREMELY DANGEROUS 850 since you can easily create immortal packets that loop 851 forever on the network. 852 853config NETFILTER_XT_TARGET_HMARK 854 tristate '"HMARK" target support' 855 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 856 depends on NETFILTER_ADVANCED 857 ---help--- 858 This option adds the "HMARK" target. 859 860 The target allows you to create rules in the "raw" and "mangle" tables 861 which set the skbuff mark by means of hash calculation within a given 862 range. The nfmark can influence the routing method and can also be used 863 by other subsystems to change their behaviour. 864 865 To compile it as a module, choose M here. If unsure, say N. 866 867config NETFILTER_XT_TARGET_IDLETIMER 868 tristate "IDLETIMER target support" 869 depends on NETFILTER_ADVANCED 870 help 871 872 This option adds the `IDLETIMER' target. Each matching packet 873 resets the timer associated with label specified when the rule is 874 added. When the timer expires, it triggers a sysfs notification. 875 The remaining time for expiration can be read via sysfs. 876 877 To compile it as a module, choose M here. If unsure, say N. 878 879config NETFILTER_XT_TARGET_LED 880 tristate '"LED" target support' 881 depends on LEDS_CLASS && LEDS_TRIGGERS 882 depends on NETFILTER_ADVANCED 883 help 884 This option adds a `LED' target, which allows you to blink LEDs in 885 response to particular packets passing through your machine. 886 887 This can be used to turn a spare LED into a network activity LED, 888 which only flashes in response to FTP transfers, for example. Or 889 you could have an LED which lights up for a minute or two every time 890 somebody connects to your machine via SSH. 891 892 You will need support for the "led" class to make this work. 893 894 To create an LED trigger for incoming SSH traffic: 895 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 896 897 Then attach the new trigger to an LED on your system: 898 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 899 900 For more information on the LEDs available on your system, see 901 Documentation/leds/leds-class.txt 902 903config NETFILTER_XT_TARGET_LOG 904 tristate "LOG target support" 905 select NF_LOG_COMMON 906 select NF_LOG_IPV4 907 select NF_LOG_IPV6 if IP6_NF_IPTABLES 908 default m if NETFILTER_ADVANCED=n 909 help 910 This option adds a `LOG' target, which allows you to create rules in 911 any iptables table which records the packet header to the syslog. 912 913 To compile it as a module, choose M here. If unsure, say N. 914 915config NETFILTER_XT_TARGET_MARK 916 tristate '"MARK" target support' 917 depends on NETFILTER_ADVANCED 918 select NETFILTER_XT_MARK 919 ---help--- 920 This is a backwards-compat option for the user's convenience 921 (e.g. when running oldconfig). It selects 922 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 923 924config NETFILTER_XT_NAT 925 tristate '"SNAT and DNAT" targets support' 926 depends on NF_NAT 927 ---help--- 928 This option enables the SNAT and DNAT targets. 929 930 To compile it as a module, choose M here. If unsure, say N. 931 932config NETFILTER_XT_TARGET_NETMAP 933 tristate '"NETMAP" target support' 934 depends on NF_NAT 935 ---help--- 936 NETMAP is an implementation of static 1:1 NAT mapping of network 937 addresses. It maps the network address part, while keeping the host 938 address part intact. 939 940 To compile it as a module, choose M here. If unsure, say N. 941 942config NETFILTER_XT_TARGET_NFLOG 943 tristate '"NFLOG" target support' 944 default m if NETFILTER_ADVANCED=n 945 select NETFILTER_NETLINK_LOG 946 help 947 This option enables the NFLOG target, which allows to LOG 948 messages through nfnetlink_log. 949 950 To compile it as a module, choose M here. If unsure, say N. 951 952config NETFILTER_XT_TARGET_NFQUEUE 953 tristate '"NFQUEUE" target Support' 954 depends on NETFILTER_ADVANCED 955 select NETFILTER_NETLINK_QUEUE 956 help 957 This target replaced the old obsolete QUEUE target. 958 959 As opposed to QUEUE, it supports 65535 different queues, 960 not just one. 961 962 To compile it as a module, choose M here. If unsure, say N. 963 964config NETFILTER_XT_TARGET_NOTRACK 965 tristate '"NOTRACK" target support (DEPRECATED)' 966 depends on NF_CONNTRACK 967 depends on IP_NF_RAW || IP6_NF_RAW 968 depends on NETFILTER_ADVANCED 969 select NETFILTER_XT_TARGET_CT 970 971config NETFILTER_XT_TARGET_RATEEST 972 tristate '"RATEEST" target support' 973 depends on NETFILTER_ADVANCED 974 help 975 This option adds a `RATEEST' target, which allows to measure 976 rates similar to TC estimators. The `rateest' match can be 977 used to match on the measured rates. 978 979 To compile it as a module, choose M here. If unsure, say N. 980 981config NETFILTER_XT_TARGET_REDIRECT 982 tristate "REDIRECT target support" 983 depends on NF_NAT 984 select NF_NAT_REDIRECT 985 ---help--- 986 REDIRECT is a special case of NAT: all incoming connections are 987 mapped onto the incoming interface's address, causing the packets to 988 come to the local machine instead of passing through. This is 989 useful for transparent proxies. 990 991 To compile it as a module, choose M here. If unsure, say N. 992 993config NETFILTER_XT_TARGET_TEE 994 tristate '"TEE" - packet cloning to alternate destination' 995 depends on NETFILTER_ADVANCED 996 depends on IPV6 || IPV6=n 997 depends on !NF_CONNTRACK || NF_CONNTRACK 998 select NF_DUP_IPV4 999 select NF_DUP_IPV6 if IP6_NF_IPTABLES 1000 ---help--- 1001 This option adds a "TEE" target with which a packet can be cloned and 1002 this clone be rerouted to another nexthop. 1003 1004config NETFILTER_XT_TARGET_TPROXY 1005 tristate '"TPROXY" target transparent proxying support' 1006 depends on NETFILTER_XTABLES 1007 depends on NETFILTER_ADVANCED 1008 depends on IPV6 || IPV6=n 1009 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1010 depends on IP_NF_MANGLE 1011 select NF_DEFRAG_IPV4 1012 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1013 select NF_TPROXY_IPV4 1014 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES 1015 help 1016 This option adds a `TPROXY' target, which is somewhat similar to 1017 REDIRECT. It can only be used in the mangle table and is useful 1018 to redirect traffic to a transparent proxy. It does _not_ depend 1019 on Netfilter connection tracking and NAT, unlike REDIRECT. 1020 For it to work you will have to configure certain iptables rules 1021 and use policy routing. For more information on how to set it up 1022 see Documentation/networking/tproxy.txt. 1023 1024 To compile it as a module, choose M here. If unsure, say N. 1025 1026config NETFILTER_XT_TARGET_TRACE 1027 tristate '"TRACE" target support' 1028 depends on IP_NF_RAW || IP6_NF_RAW 1029 depends on NETFILTER_ADVANCED 1030 help 1031 The TRACE target allows you to mark packets so that the kernel 1032 will log every rule which match the packets as those traverse 1033 the tables, chains, rules. 1034 1035 If you want to compile it as a module, say M here and read 1036 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1037 1038config NETFILTER_XT_TARGET_SECMARK 1039 tristate '"SECMARK" target support' 1040 depends on NETWORK_SECMARK 1041 default m if NETFILTER_ADVANCED=n 1042 help 1043 The SECMARK target allows security marking of network 1044 packets, for use with security subsystems. 1045 1046 To compile it as a module, choose M here. If unsure, say N. 1047 1048config NETFILTER_XT_TARGET_TCPMSS 1049 tristate '"TCPMSS" target support' 1050 depends on IPV6 || IPV6=n 1051 default m if NETFILTER_ADVANCED=n 1052 ---help--- 1053 This option adds a `TCPMSS' target, which allows you to alter the 1054 MSS value of TCP SYN packets, to control the maximum size for that 1055 connection (usually limiting it to your outgoing interface's MTU 1056 minus 40). 1057 1058 This is used to overcome criminally braindead ISPs or servers which 1059 block ICMP Fragmentation Needed packets. The symptoms of this 1060 problem are that everything works fine from your Linux 1061 firewall/router, but machines behind it can never exchange large 1062 packets: 1063 1) Web browsers connect, then hang with no data received. 1064 2) Small mail works fine, but large emails hang. 1065 3) ssh works fine, but scp hangs after initial handshaking. 1066 1067 Workaround: activate this option and add a rule to your firewall 1068 configuration like: 1069 1070 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1071 -j TCPMSS --clamp-mss-to-pmtu 1072 1073 To compile it as a module, choose M here. If unsure, say N. 1074 1075config NETFILTER_XT_TARGET_TCPOPTSTRIP 1076 tristate '"TCPOPTSTRIP" target support' 1077 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1078 depends on NETFILTER_ADVANCED 1079 help 1080 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1081 TCP options from TCP packets. 1082 1083# alphabetically ordered list of matches 1084 1085comment "Xtables matches" 1086 1087config NETFILTER_XT_MATCH_ADDRTYPE 1088 tristate '"addrtype" address type match support' 1089 default m if NETFILTER_ADVANCED=n 1090 ---help--- 1091 This option allows you to match what routing thinks of an address, 1092 eg. UNICAST, LOCAL, BROADCAST, ... 1093 1094 If you want to compile it as a module, say M here and read 1095 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1096 1097config NETFILTER_XT_MATCH_BPF 1098 tristate '"bpf" match support' 1099 depends on NETFILTER_ADVANCED 1100 help 1101 BPF matching applies a linux socket filter to each packet and 1102 accepts those for which the filter returns non-zero. 1103 1104 To compile it as a module, choose M here. If unsure, say N. 1105 1106config NETFILTER_XT_MATCH_CGROUP 1107 tristate '"control group" match support' 1108 depends on NETFILTER_ADVANCED 1109 depends on CGROUPS 1110 select CGROUP_NET_CLASSID 1111 ---help--- 1112 Socket/process control group matching allows you to match locally 1113 generated packets based on which net_cls control group processes 1114 belong to. 1115 1116config NETFILTER_XT_MATCH_CLUSTER 1117 tristate '"cluster" match support' 1118 depends on NF_CONNTRACK 1119 depends on NETFILTER_ADVANCED 1120 ---help--- 1121 This option allows you to build work-load-sharing clusters of 1122 network servers/stateful firewalls without having a dedicated 1123 load-balancing router/server/switch. Basically, this match returns 1124 true when the packet must be handled by this cluster node. Thus, 1125 all nodes see all packets and this match decides which node handles 1126 what packets. The work-load sharing algorithm is based on source 1127 address hashing. 1128 1129 If you say Y or M here, try `iptables -m cluster --help` for 1130 more information. 1131 1132config NETFILTER_XT_MATCH_COMMENT 1133 tristate '"comment" match support' 1134 depends on NETFILTER_ADVANCED 1135 help 1136 This option adds a `comment' dummy-match, which allows you to put 1137 comments in your iptables ruleset. 1138 1139 If you want to compile it as a module, say M here and read 1140 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1141 1142config NETFILTER_XT_MATCH_CONNBYTES 1143 tristate '"connbytes" per-connection counter match support' 1144 depends on NF_CONNTRACK 1145 depends on NETFILTER_ADVANCED 1146 help 1147 This option adds a `connbytes' match, which allows you to match the 1148 number of bytes and/or packets for each direction within a connection. 1149 1150 If you want to compile it as a module, say M here and read 1151 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1152 1153config NETFILTER_XT_MATCH_CONNLABEL 1154 tristate '"connlabel" match support' 1155 select NF_CONNTRACK_LABELS 1156 depends on NF_CONNTRACK 1157 depends on NETFILTER_ADVANCED 1158 ---help--- 1159 This match allows you to test and assign userspace-defined labels names 1160 to a connection. The kernel only stores bit values - mapping 1161 names to bits is done by userspace. 1162 1163 Unlike connmark, more than 32 flag bits may be assigned to a 1164 connection simultaneously. 1165 1166config NETFILTER_XT_MATCH_CONNLIMIT 1167 tristate '"connlimit" match support' 1168 depends on NF_CONNTRACK 1169 depends on NETFILTER_ADVANCED 1170 select NETFILTER_CONNCOUNT 1171 ---help--- 1172 This match allows you to match against the number of parallel 1173 connections to a server per client IP address (or address block). 1174 1175config NETFILTER_XT_MATCH_CONNMARK 1176 tristate '"connmark" connection mark match support' 1177 depends on NF_CONNTRACK 1178 depends on NETFILTER_ADVANCED 1179 select NETFILTER_XT_CONNMARK 1180 ---help--- 1181 This is a backwards-compat option for the user's convenience 1182 (e.g. when running oldconfig). It selects 1183 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1184 1185config NETFILTER_XT_MATCH_CONNTRACK 1186 tristate '"conntrack" connection tracking match support' 1187 depends on NF_CONNTRACK 1188 default m if NETFILTER_ADVANCED=n 1189 help 1190 This is a general conntrack match module, a superset of the state match. 1191 1192 It allows matching on additional conntrack information, which is 1193 useful in complex configurations, such as NAT gateways with multiple 1194 internet links or tunnels. 1195 1196 To compile it as a module, choose M here. If unsure, say N. 1197 1198config NETFILTER_XT_MATCH_CPU 1199 tristate '"cpu" match support' 1200 depends on NETFILTER_ADVANCED 1201 help 1202 CPU matching allows you to match packets based on the CPU 1203 currently handling the packet. 1204 1205 To compile it as a module, choose M here. If unsure, say N. 1206 1207config NETFILTER_XT_MATCH_DCCP 1208 tristate '"dccp" protocol match support' 1209 depends on NETFILTER_ADVANCED 1210 default IP_DCCP 1211 help 1212 With this option enabled, you will be able to use the iptables 1213 `dccp' match in order to match on DCCP source/destination ports 1214 and DCCP flags. 1215 1216 If you want to compile it as a module, say M here and read 1217 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1218 1219config NETFILTER_XT_MATCH_DEVGROUP 1220 tristate '"devgroup" match support' 1221 depends on NETFILTER_ADVANCED 1222 help 1223 This options adds a `devgroup' match, which allows to match on the 1224 device group a network device is assigned to. 1225 1226 To compile it as a module, choose M here. If unsure, say N. 1227 1228config NETFILTER_XT_MATCH_DSCP 1229 tristate '"dscp" and "tos" match support' 1230 depends on NETFILTER_ADVANCED 1231 help 1232 This option adds a `DSCP' match, which allows you to match against 1233 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1234 1235 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1236 1237 It will also add a "tos" match, which allows you to match packets 1238 based on the Type Of Service fields of the IPv4 packet (which share 1239 the same bits as DSCP). 1240 1241 To compile it as a module, choose M here. If unsure, say N. 1242 1243config NETFILTER_XT_MATCH_ECN 1244 tristate '"ecn" match support' 1245 depends on NETFILTER_ADVANCED 1246 ---help--- 1247 This option adds an "ECN" match, which allows you to match against 1248 the IPv4 and TCP header ECN fields. 1249 1250 To compile it as a module, choose M here. If unsure, say N. 1251 1252config NETFILTER_XT_MATCH_ESP 1253 tristate '"esp" match support' 1254 depends on NETFILTER_ADVANCED 1255 help 1256 This match extension allows you to match a range of SPIs 1257 inside ESP header of IPSec packets. 1258 1259 To compile it as a module, choose M here. If unsure, say N. 1260 1261config NETFILTER_XT_MATCH_HASHLIMIT 1262 tristate '"hashlimit" match support' 1263 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1264 depends on NETFILTER_ADVANCED 1265 help 1266 This option adds a `hashlimit' match. 1267 1268 As opposed to `limit', this match dynamically creates a hash table 1269 of limit buckets, based on your selection of source/destination 1270 addresses and/or ports. 1271 1272 It enables you to express policies like `10kpps for any given 1273 destination address' or `500pps from any given source address' 1274 with a single rule. 1275 1276config NETFILTER_XT_MATCH_HELPER 1277 tristate '"helper" match support' 1278 depends on NF_CONNTRACK 1279 depends on NETFILTER_ADVANCED 1280 help 1281 Helper matching allows you to match packets in dynamic connections 1282 tracked by a conntrack-helper, ie. ip_conntrack_ftp 1283 1284 To compile it as a module, choose M here. If unsure, say Y. 1285 1286config NETFILTER_XT_MATCH_HL 1287 tristate '"hl" hoplimit/TTL match support' 1288 depends on NETFILTER_ADVANCED 1289 ---help--- 1290 HL matching allows you to match packets based on the hoplimit 1291 in the IPv6 header, or the time-to-live field in the IPv4 1292 header of the packet. 1293 1294config NETFILTER_XT_MATCH_IPCOMP 1295 tristate '"ipcomp" match support' 1296 depends on NETFILTER_ADVANCED 1297 help 1298 This match extension allows you to match a range of CPIs(16 bits) 1299 inside IPComp header of IPSec packets. 1300 1301 To compile it as a module, choose M here. If unsure, say N. 1302 1303config NETFILTER_XT_MATCH_IPRANGE 1304 tristate '"iprange" address range match support' 1305 depends on NETFILTER_ADVANCED 1306 ---help--- 1307 This option adds a "iprange" match, which allows you to match based on 1308 an IP address range. (Normal iptables only matches on single addresses 1309 with an optional mask.) 1310 1311 If unsure, say M. 1312 1313config NETFILTER_XT_MATCH_IPVS 1314 tristate '"ipvs" match support' 1315 depends on IP_VS 1316 depends on NETFILTER_ADVANCED 1317 depends on NF_CONNTRACK 1318 help 1319 This option allows you to match against IPVS properties of a packet. 1320 1321 If unsure, say N. 1322 1323config NETFILTER_XT_MATCH_L2TP 1324 tristate '"l2tp" match support' 1325 depends on NETFILTER_ADVANCED 1326 default L2TP 1327 ---help--- 1328 This option adds an "L2TP" match, which allows you to match against 1329 L2TP protocol header fields. 1330 1331 To compile it as a module, choose M here. If unsure, say N. 1332 1333config NETFILTER_XT_MATCH_LENGTH 1334 tristate '"length" match support' 1335 depends on NETFILTER_ADVANCED 1336 help 1337 This option allows you to match the length of a packet against a 1338 specific value or range of values. 1339 1340 To compile it as a module, choose M here. If unsure, say N. 1341 1342config NETFILTER_XT_MATCH_LIMIT 1343 tristate '"limit" match support' 1344 depends on NETFILTER_ADVANCED 1345 help 1346 limit matching allows you to control the rate at which a rule can be 1347 matched: mainly useful in combination with the LOG target ("LOG 1348 target support", below) and to avoid some Denial of Service attacks. 1349 1350 To compile it as a module, choose M here. If unsure, say N. 1351 1352config NETFILTER_XT_MATCH_MAC 1353 tristate '"mac" address match support' 1354 depends on NETFILTER_ADVANCED 1355 help 1356 MAC matching allows you to match packets based on the source 1357 Ethernet address of the packet. 1358 1359 To compile it as a module, choose M here. If unsure, say N. 1360 1361config NETFILTER_XT_MATCH_MARK 1362 tristate '"mark" match support' 1363 depends on NETFILTER_ADVANCED 1364 select NETFILTER_XT_MARK 1365 ---help--- 1366 This is a backwards-compat option for the user's convenience 1367 (e.g. when running oldconfig). It selects 1368 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1369 1370config NETFILTER_XT_MATCH_MULTIPORT 1371 tristate '"multiport" Multiple port match support' 1372 depends on NETFILTER_ADVANCED 1373 help 1374 Multiport matching allows you to match TCP or UDP packets based on 1375 a series of source or destination ports: normally a rule can only 1376 match a single range of ports. 1377 1378 To compile it as a module, choose M here. If unsure, say N. 1379 1380config NETFILTER_XT_MATCH_NFACCT 1381 tristate '"nfacct" match support' 1382 depends on NETFILTER_ADVANCED 1383 select NETFILTER_NETLINK_ACCT 1384 help 1385 This option allows you to use the extended accounting through 1386 nfnetlink_acct. 1387 1388 To compile it as a module, choose M here. If unsure, say N. 1389 1390config NETFILTER_XT_MATCH_OSF 1391 tristate '"osf" Passive OS fingerprint match' 1392 depends on NETFILTER_ADVANCED 1393 select NETFILTER_NETLINK_OSF 1394 help 1395 This option selects the Passive OS Fingerprinting match module 1396 that allows to passively match the remote operating system by 1397 analyzing incoming TCP SYN packets. 1398 1399 Rules and loading software can be downloaded from 1400 http://www.ioremap.net/projects/osf 1401 1402 To compile it as a module, choose M here. If unsure, say N. 1403 1404config NETFILTER_XT_MATCH_OWNER 1405 tristate '"owner" match support' 1406 depends on NETFILTER_ADVANCED 1407 ---help--- 1408 Socket owner matching allows you to match locally-generated packets 1409 based on who created the socket: the user or group. It is also 1410 possible to check whether a socket actually exists. 1411 1412config NETFILTER_XT_MATCH_POLICY 1413 tristate 'IPsec "policy" match support' 1414 depends on XFRM 1415 default m if NETFILTER_ADVANCED=n 1416 help 1417 Policy matching allows you to match packets based on the 1418 IPsec policy that was used during decapsulation/will 1419 be used during encapsulation. 1420 1421 To compile it as a module, choose M here. If unsure, say N. 1422 1423config NETFILTER_XT_MATCH_PHYSDEV 1424 tristate '"physdev" match support' 1425 depends on BRIDGE && BRIDGE_NETFILTER 1426 depends on NETFILTER_ADVANCED 1427 help 1428 Physdev packet matching matches against the physical bridge ports 1429 the IP packet arrived on or will leave by. 1430 1431 To compile it as a module, choose M here. If unsure, say N. 1432 1433config NETFILTER_XT_MATCH_PKTTYPE 1434 tristate '"pkttype" packet type match support' 1435 depends on NETFILTER_ADVANCED 1436 help 1437 Packet type matching allows you to match a packet by 1438 its "class", eg. BROADCAST, MULTICAST, ... 1439 1440 Typical usage: 1441 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1442 1443 To compile it as a module, choose M here. If unsure, say N. 1444 1445config NETFILTER_XT_MATCH_QUOTA 1446 tristate '"quota" match support' 1447 depends on NETFILTER_ADVANCED 1448 help 1449 This option adds a `quota' match, which allows to match on a 1450 byte counter. 1451 1452 If you want to compile it as a module, say M here and read 1453 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1454 1455config NETFILTER_XT_MATCH_RATEEST 1456 tristate '"rateest" match support' 1457 depends on NETFILTER_ADVANCED 1458 select NETFILTER_XT_TARGET_RATEEST 1459 help 1460 This option adds a `rateest' match, which allows to match on the 1461 rate estimated by the RATEEST target. 1462 1463 To compile it as a module, choose M here. If unsure, say N. 1464 1465config NETFILTER_XT_MATCH_REALM 1466 tristate '"realm" match support' 1467 depends on NETFILTER_ADVANCED 1468 select IP_ROUTE_CLASSID 1469 help 1470 This option adds a `realm' match, which allows you to use the realm 1471 key from the routing subsystem inside iptables. 1472 1473 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1474 in tc world. 1475 1476 If you want to compile it as a module, say M here and read 1477 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1478 1479config NETFILTER_XT_MATCH_RECENT 1480 tristate '"recent" match support' 1481 depends on NETFILTER_ADVANCED 1482 ---help--- 1483 This match is used for creating one or many lists of recently 1484 used addresses and then matching against that/those list(s). 1485 1486 Short options are available by using 'iptables -m recent -h' 1487 Official Website: <http://snowman.net/projects/ipt_recent/> 1488 1489config NETFILTER_XT_MATCH_SCTP 1490 tristate '"sctp" protocol match support' 1491 depends on NETFILTER_ADVANCED 1492 default IP_SCTP 1493 help 1494 With this option enabled, you will be able to use the 1495 `sctp' match in order to match on SCTP source/destination ports 1496 and SCTP chunk types. 1497 1498 If you want to compile it as a module, say M here and read 1499 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1500 1501config NETFILTER_XT_MATCH_SOCKET 1502 tristate '"socket" match support' 1503 depends on NETFILTER_XTABLES 1504 depends on NETFILTER_ADVANCED 1505 depends on IPV6 || IPV6=n 1506 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1507 select NF_SOCKET_IPV4 1508 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES 1509 select NF_DEFRAG_IPV4 1510 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1511 help 1512 This option adds a `socket' match, which can be used to match 1513 packets for which a TCP or UDP socket lookup finds a valid socket. 1514 It can be used in combination with the MARK target and policy 1515 routing to implement full featured non-locally bound sockets. 1516 1517 To compile it as a module, choose M here. If unsure, say N. 1518 1519config NETFILTER_XT_MATCH_STATE 1520 tristate '"state" match support' 1521 depends on NF_CONNTRACK 1522 default m if NETFILTER_ADVANCED=n 1523 help 1524 Connection state matching allows you to match packets based on their 1525 relationship to a tracked connection (ie. previous packets). This 1526 is a powerful tool for packet classification. 1527 1528 To compile it as a module, choose M here. If unsure, say N. 1529 1530config NETFILTER_XT_MATCH_STATISTIC 1531 tristate '"statistic" match support' 1532 depends on NETFILTER_ADVANCED 1533 help 1534 This option adds a `statistic' match, which allows you to match 1535 on packets periodically or randomly with a given percentage. 1536 1537 To compile it as a module, choose M here. If unsure, say N. 1538 1539config NETFILTER_XT_MATCH_STRING 1540 tristate '"string" match support' 1541 depends on NETFILTER_ADVANCED 1542 select TEXTSEARCH 1543 select TEXTSEARCH_KMP 1544 select TEXTSEARCH_BM 1545 select TEXTSEARCH_FSM 1546 help 1547 This option adds a `string' match, which allows you to look for 1548 pattern matchings in packets. 1549 1550 To compile it as a module, choose M here. If unsure, say N. 1551 1552config NETFILTER_XT_MATCH_TCPMSS 1553 tristate '"tcpmss" match support' 1554 depends on NETFILTER_ADVANCED 1555 help 1556 This option adds a `tcpmss' match, which allows you to examine the 1557 MSS value of TCP SYN packets, which control the maximum packet size 1558 for that connection. 1559 1560 To compile it as a module, choose M here. If unsure, say N. 1561 1562config NETFILTER_XT_MATCH_TIME 1563 tristate '"time" match support' 1564 depends on NETFILTER_ADVANCED 1565 ---help--- 1566 This option adds a "time" match, which allows you to match based on 1567 the packet arrival time (at the machine which netfilter is running) 1568 on) or departure time/date (for locally generated packets). 1569 1570 If you say Y here, try `iptables -m time --help` for 1571 more information. 1572 1573 If you want to compile it as a module, say M here. 1574 If unsure, say N. 1575 1576config NETFILTER_XT_MATCH_U32 1577 tristate '"u32" match support' 1578 depends on NETFILTER_ADVANCED 1579 ---help--- 1580 u32 allows you to extract quantities of up to 4 bytes from a packet, 1581 AND them with specified masks, shift them by specified amounts and 1582 test whether the results are in any of a set of specified ranges. 1583 The specification of what to extract is general enough to skip over 1584 headers with lengths stored in the packet, as in IP or TCP header 1585 lengths. 1586 1587 Details and examples are in the kernel module source. 1588 1589endif # NETFILTER_XTABLES 1590 1591endmenu 1592 1593source "net/netfilter/ipset/Kconfig" 1594 1595source "net/netfilter/ipvs/Kconfig" 1596