1menu "Core Netfilter Configuration" 2 depends on NET && INET && NETFILTER 3 4config NETFILTER_INGRESS 5 bool "Netfilter ingress support" 6 default y 7 select NET_INGRESS 8 help 9 This allows you to classify packets from ingress using the Netfilter 10 infrastructure. 11 12config NETFILTER_NETLINK 13 tristate 14 15config NETFILTER_NETLINK_ACCT 16tristate "Netfilter NFACCT over NFNETLINK interface" 17 depends on NETFILTER_ADVANCED 18 select NETFILTER_NETLINK 19 help 20 If this option is enabled, the kernel will include support 21 for extended accounting via NFNETLINK. 22 23config NETFILTER_NETLINK_QUEUE 24 tristate "Netfilter NFQUEUE over NFNETLINK interface" 25 depends on NETFILTER_ADVANCED 26 select NETFILTER_NETLINK 27 help 28 If this option is enabled, the kernel will include support 29 for queueing packets via NFNETLINK. 30 31config NETFILTER_NETLINK_LOG 32 tristate "Netfilter LOG over NFNETLINK interface" 33 default m if NETFILTER_ADVANCED=n 34 select NETFILTER_NETLINK 35 help 36 If this option is enabled, the kernel will include support 37 for logging packets via NFNETLINK. 38 39 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 40 and is also scheduled to replace the old syslog-based ipt_LOG 41 and ip6t_LOG modules. 42 43config NF_CONNTRACK 44 tristate "Netfilter connection tracking support" 45 default m if NETFILTER_ADVANCED=n 46 help 47 Connection tracking keeps a record of what packets have passed 48 through your machine, in order to figure out how they are related 49 into connections. 50 51 This is required to do Masquerading or other kinds of Network 52 Address Translation. It can also be used to enhance packet 53 filtering (see `Connection state match support' below). 54 55 To compile it as a module, choose M here. If unsure, say N. 56 57config NF_LOG_COMMON 58 tristate 59 60config NF_LOG_NETDEV 61 tristate "Netdev packet logging" 62 select NF_LOG_COMMON 63 64if NF_CONNTRACK 65 66config NF_CONNTRACK_MARK 67 bool 'Connection mark tracking support' 68 depends on NETFILTER_ADVANCED 69 help 70 This option enables support for connection marks, used by the 71 `CONNMARK' target and `connmark' match. Similar to the mark value 72 of packets, but this mark value is kept in the conntrack session 73 instead of the individual packets. 74 75config NF_CONNTRACK_SECMARK 76 bool 'Connection tracking security mark support' 77 depends on NETWORK_SECMARK 78 default m if NETFILTER_ADVANCED=n 79 help 80 This option enables security markings to be applied to 81 connections. Typically they are copied to connections from 82 packets using the CONNSECMARK target and copied back from 83 connections to packets with the same target, with the packets 84 being originally labeled via SECMARK. 85 86 If unsure, say 'N'. 87 88config NF_CONNTRACK_ZONES 89 bool 'Connection tracking zones' 90 depends on NETFILTER_ADVANCED 91 depends on NETFILTER_XT_TARGET_CT 92 help 93 This option enables support for connection tracking zones. 94 Normally, each connection needs to have a unique system wide 95 identity. Connection tracking zones allow to have multiple 96 connections using the same identity, as long as they are 97 contained in different zones. 98 99 If unsure, say `N'. 100 101config NF_CONNTRACK_PROCFS 102 bool "Supply CT list in procfs (OBSOLETE)" 103 default y 104 depends on PROC_FS 105 ---help--- 106 This option enables for the list of known conntrack entries 107 to be shown in procfs under net/netfilter/nf_conntrack. This 108 is considered obsolete in favor of using the conntrack(8) 109 tool which uses Netlink. 110 111config NF_CONNTRACK_EVENTS 112 bool "Connection tracking events" 113 depends on NETFILTER_ADVANCED 114 help 115 If this option is enabled, the connection tracking code will 116 provide a notifier chain that can be used by other kernel code 117 to get notified about changes in the connection tracking state. 118 119 If unsure, say `N'. 120 121config NF_CONNTRACK_TIMEOUT 122 bool 'Connection tracking timeout' 123 depends on NETFILTER_ADVANCED 124 help 125 This option enables support for connection tracking timeout 126 extension. This allows you to attach timeout policies to flow 127 via the CT target. 128 129 If unsure, say `N'. 130 131config NF_CONNTRACK_TIMESTAMP 132 bool 'Connection tracking timestamping' 133 depends on NETFILTER_ADVANCED 134 help 135 This option enables support for connection tracking timestamping. 136 This allows you to store the flow start-time and to obtain 137 the flow-stop time (once it has been destroyed) via Connection 138 tracking events. 139 140 If unsure, say `N'. 141 142config NF_CONNTRACK_LABELS 143 bool 144 help 145 This option enables support for assigning user-defined flag bits 146 to connection tracking entries. It selected by the connlabel match. 147 148config NF_CT_PROTO_DCCP 149 bool 'DCCP protocol connection tracking support' 150 depends on NETFILTER_ADVANCED 151 default y 152 help 153 With this option enabled, the layer 3 independent connection 154 tracking code will be able to do state tracking on DCCP connections. 155 156 If unsure, say Y. 157 158config NF_CT_PROTO_GRE 159 tristate 160 161config NF_CT_PROTO_SCTP 162 bool 'SCTP protocol connection tracking support' 163 depends on NETFILTER_ADVANCED 164 default y 165 help 166 With this option enabled, the layer 3 independent connection 167 tracking code will be able to do state tracking on SCTP connections. 168 169 If unsure, say Y. 170 171config NF_CT_PROTO_UDPLITE 172 bool 'UDP-Lite protocol connection tracking support' 173 depends on NETFILTER_ADVANCED 174 default y 175 help 176 With this option enabled, the layer 3 independent connection 177 tracking code will be able to do state tracking on UDP-Lite 178 connections. 179 180 If unsure, say Y. 181 182config NF_CONNTRACK_AMANDA 183 tristate "Amanda backup protocol support" 184 depends on NETFILTER_ADVANCED 185 select TEXTSEARCH 186 select TEXTSEARCH_KMP 187 help 188 If you are running the Amanda backup package <http://www.amanda.org/> 189 on this machine or machines that will be MASQUERADED through this 190 machine, then you may want to enable this feature. This allows the 191 connection tracking and natting code to allow the sub-channels that 192 Amanda requires for communication of the backup data, messages and 193 index. 194 195 To compile it as a module, choose M here. If unsure, say N. 196 197config NF_CONNTRACK_FTP 198 tristate "FTP protocol support" 199 default m if NETFILTER_ADVANCED=n 200 help 201 Tracking FTP connections is problematic: special helpers are 202 required for tracking them, and doing masquerading and other forms 203 of Network Address Translation on them. 204 205 This is FTP support on Layer 3 independent connection tracking. 206 Layer 3 independent connection tracking is experimental scheme 207 which generalize ip_conntrack to support other layer 3 protocols. 208 209 To compile it as a module, choose M here. If unsure, say N. 210 211config NF_CONNTRACK_H323 212 tristate "H.323 protocol support" 213 depends on IPV6 || IPV6=n 214 depends on NETFILTER_ADVANCED 215 help 216 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 217 important VoIP protocols, it is widely used by voice hardware and 218 software including voice gateways, IP phones, Netmeeting, OpenPhone, 219 Gnomemeeting, etc. 220 221 With this module you can support H.323 on a connection tracking/NAT 222 firewall. 223 224 This module supports RAS, Fast Start, H.245 Tunnelling, Call 225 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 226 whiteboard, file transfer, etc. For more information, please 227 visit http://nath323.sourceforge.net/. 228 229 To compile it as a module, choose M here. If unsure, say N. 230 231config NF_CONNTRACK_IRC 232 tristate "IRC protocol support" 233 default m if NETFILTER_ADVANCED=n 234 help 235 There is a commonly-used extension to IRC called 236 Direct Client-to-Client Protocol (DCC). This enables users to send 237 files to each other, and also chat to each other without the need 238 of a server. DCC Sending is used anywhere you send files over IRC, 239 and DCC Chat is most commonly used by Eggdrop bots. If you are 240 using NAT, this extension will enable you to send files and initiate 241 chats. Note that you do NOT need this extension to get files or 242 have others initiate chats, or everything else in IRC. 243 244 To compile it as a module, choose M here. If unsure, say N. 245 246config NF_CONNTRACK_BROADCAST 247 tristate 248 249config NF_CONNTRACK_NETBIOS_NS 250 tristate "NetBIOS name service protocol support" 251 select NF_CONNTRACK_BROADCAST 252 help 253 NetBIOS name service requests are sent as broadcast messages from an 254 unprivileged port and responded to with unicast messages to the 255 same port. This make them hard to firewall properly because connection 256 tracking doesn't deal with broadcasts. This helper tracks locally 257 originating NetBIOS name service requests and the corresponding 258 responses. It relies on correct IP address configuration, specifically 259 netmask and broadcast address. When properly configured, the output 260 of "ip address show" should look similar to this: 261 262 $ ip -4 address show eth0 263 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 264 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 265 266 To compile it as a module, choose M here. If unsure, say N. 267 268config NF_CONNTRACK_SNMP 269 tristate "SNMP service protocol support" 270 depends on NETFILTER_ADVANCED 271 select NF_CONNTRACK_BROADCAST 272 help 273 SNMP service requests are sent as broadcast messages from an 274 unprivileged port and responded to with unicast messages to the 275 same port. This make them hard to firewall properly because connection 276 tracking doesn't deal with broadcasts. This helper tracks locally 277 originating SNMP service requests and the corresponding 278 responses. It relies on correct IP address configuration, specifically 279 netmask and broadcast address. 280 281 To compile it as a module, choose M here. If unsure, say N. 282 283config NF_CONNTRACK_PPTP 284 tristate "PPtP protocol support" 285 depends on NETFILTER_ADVANCED 286 select NF_CT_PROTO_GRE 287 help 288 This module adds support for PPTP (Point to Point Tunnelling 289 Protocol, RFC2637) connection tracking and NAT. 290 291 If you are running PPTP sessions over a stateful firewall or NAT 292 box, you may want to enable this feature. 293 294 Please note that not all PPTP modes of operation are supported yet. 295 Specifically these limitations exist: 296 - Blindly assumes that control connections are always established 297 in PNS->PAC direction. This is a violation of RFC2637. 298 - Only supports a single call within each session 299 300 To compile it as a module, choose M here. If unsure, say N. 301 302config NF_CONNTRACK_SANE 303 tristate "SANE protocol support" 304 depends on NETFILTER_ADVANCED 305 help 306 SANE is a protocol for remote access to scanners as implemented 307 by the 'saned' daemon. Like FTP, it uses separate control and 308 data connections. 309 310 With this module you can support SANE on a connection tracking 311 firewall. 312 313 To compile it as a module, choose M here. If unsure, say N. 314 315config NF_CONNTRACK_SIP 316 tristate "SIP protocol support" 317 default m if NETFILTER_ADVANCED=n 318 help 319 SIP is an application-layer control protocol that can establish, 320 modify, and terminate multimedia sessions (conferences) such as 321 Internet telephony calls. With the ip_conntrack_sip and 322 the nf_nat_sip modules you can support the protocol on a connection 323 tracking/NATing firewall. 324 325 To compile it as a module, choose M here. If unsure, say N. 326 327config NF_CONNTRACK_TFTP 328 tristate "TFTP protocol support" 329 depends on NETFILTER_ADVANCED 330 help 331 TFTP connection tracking helper, this is required depending 332 on how restrictive your ruleset is. 333 If you are using a tftp client behind -j SNAT or -j MASQUERADING 334 you will need this. 335 336 To compile it as a module, choose M here. If unsure, say N. 337 338config NF_CT_NETLINK 339 tristate 'Connection tracking netlink interface' 340 select NETFILTER_NETLINK 341 default m if NETFILTER_ADVANCED=n 342 help 343 This option enables support for a netlink-based userspace interface 344 345config NF_CT_NETLINK_TIMEOUT 346 tristate 'Connection tracking timeout tuning via Netlink' 347 select NETFILTER_NETLINK 348 depends on NETFILTER_ADVANCED 349 help 350 This option enables support for connection tracking timeout 351 fine-grain tuning. This allows you to attach specific timeout 352 policies to flows, instead of using the global timeout policy. 353 354 If unsure, say `N'. 355 356config NF_CT_NETLINK_HELPER 357 tristate 'Connection tracking helpers in user-space via Netlink' 358 select NETFILTER_NETLINK 359 depends on NF_CT_NETLINK 360 depends on NETFILTER_NETLINK_QUEUE 361 depends on NETFILTER_NETLINK_GLUE_CT 362 depends on NETFILTER_ADVANCED 363 help 364 This option enables the user-space connection tracking helpers 365 infrastructure. 366 367 If unsure, say `N'. 368 369config NETFILTER_NETLINK_GLUE_CT 370 bool "NFQUEUE and NFLOG integration with Connection Tracking" 371 default n 372 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 373 help 374 If this option is enabled, NFQUEUE and NFLOG can include 375 Connection Tracking information together with the packet is 376 the enqueued via NFNETLINK. 377 378config NF_NAT 379 tristate 380 381config NF_NAT_NEEDED 382 bool 383 depends on NF_NAT 384 default y 385 386config NF_NAT_PROTO_DCCP 387 bool 388 depends on NF_NAT && NF_CT_PROTO_DCCP 389 default NF_NAT && NF_CT_PROTO_DCCP 390 391config NF_NAT_PROTO_UDPLITE 392 bool 393 depends on NF_NAT && NF_CT_PROTO_UDPLITE 394 default NF_NAT && NF_CT_PROTO_UDPLITE 395 396config NF_NAT_PROTO_SCTP 397 bool 398 default NF_NAT && NF_CT_PROTO_SCTP 399 depends on NF_NAT && NF_CT_PROTO_SCTP 400 select LIBCRC32C 401 402config NF_NAT_AMANDA 403 tristate 404 depends on NF_CONNTRACK && NF_NAT 405 default NF_NAT && NF_CONNTRACK_AMANDA 406 407config NF_NAT_FTP 408 tristate 409 depends on NF_CONNTRACK && NF_NAT 410 default NF_NAT && NF_CONNTRACK_FTP 411 412config NF_NAT_IRC 413 tristate 414 depends on NF_CONNTRACK && NF_NAT 415 default NF_NAT && NF_CONNTRACK_IRC 416 417config NF_NAT_SIP 418 tristate 419 depends on NF_CONNTRACK && NF_NAT 420 default NF_NAT && NF_CONNTRACK_SIP 421 422config NF_NAT_TFTP 423 tristate 424 depends on NF_CONNTRACK && NF_NAT 425 default NF_NAT && NF_CONNTRACK_TFTP 426 427config NF_NAT_REDIRECT 428 tristate "IPv4/IPv6 redirect support" 429 depends on NF_NAT 430 help 431 This is the kernel functionality to redirect packets to local 432 machine through NAT. 433 434config NETFILTER_SYNPROXY 435 tristate 436 437endif # NF_CONNTRACK 438 439config NF_TABLES 440 select NETFILTER_NETLINK 441 tristate "Netfilter nf_tables support" 442 help 443 nftables is the new packet classification framework that intends to 444 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 445 provides a pseudo-state machine with an extensible instruction-set 446 (also known as expressions) that the userspace 'nft' utility 447 (http://www.netfilter.org/projects/nftables) uses to build the 448 rule-set. It also comes with the generic set infrastructure that 449 allows you to construct mappings between matchings and actions 450 for performance lookups. 451 452 To compile it as a module, choose M here. 453 454if NF_TABLES 455 456config NF_TABLES_INET 457 depends on IPV6 458 select NF_TABLES_IPV4 459 select NF_TABLES_IPV6 460 tristate "Netfilter nf_tables mixed IPv4/IPv6 tables support" 461 help 462 This option enables support for a mixed IPv4/IPv6 "inet" table. 463 464config NF_TABLES_NETDEV 465 tristate "Netfilter nf_tables netdev tables support" 466 help 467 This option enables support for the "netdev" table. 468 469config NFT_EXTHDR 470 tristate "Netfilter nf_tables IPv6 exthdr module" 471 help 472 This option adds the "exthdr" expression that you can use to match 473 IPv6 extension headers. 474 475config NFT_META 476 tristate "Netfilter nf_tables meta module" 477 help 478 This option adds the "meta" expression that you can use to match and 479 to set packet metainformation such as the packet mark. 480 481config NFT_RT 482 tristate "Netfilter nf_tables routing module" 483 help 484 This option adds the "rt" expression that you can use to match 485 packet routing information such as the packet nexthop. 486 487config NFT_NUMGEN 488 tristate "Netfilter nf_tables number generator module" 489 help 490 This option adds the number generator expression used to perform 491 incremental counting and random numbers bound to a upper limit. 492 493config NFT_CT 494 depends on NF_CONNTRACK 495 tristate "Netfilter nf_tables conntrack module" 496 help 497 This option adds the "meta" expression that you can use to match 498 connection tracking information such as the flow state. 499 500config NFT_SET_RBTREE 501 tristate "Netfilter nf_tables rbtree set module" 502 help 503 This option adds the "rbtree" set type (Red Black tree) that is used 504 to build interval-based sets. 505 506config NFT_SET_HASH 507 tristate "Netfilter nf_tables hash set module" 508 help 509 This option adds the "hash" set type that is used to build one-way 510 mappings between matchings and actions. 511 512config NFT_COUNTER 513 tristate "Netfilter nf_tables counter module" 514 help 515 This option adds the "counter" expression that you can use to 516 include packet and byte counters in a rule. 517 518config NFT_LOG 519 tristate "Netfilter nf_tables log module" 520 help 521 This option adds the "log" expression that you can use to log 522 packets matching some criteria. 523 524config NFT_LIMIT 525 tristate "Netfilter nf_tables limit module" 526 help 527 This option adds the "limit" expression that you can use to 528 ratelimit rule matchings. 529 530config NFT_MASQ 531 depends on NF_CONNTRACK 532 depends on NF_NAT 533 tristate "Netfilter nf_tables masquerade support" 534 help 535 This option adds the "masquerade" expression that you can use 536 to perform NAT in the masquerade flavour. 537 538config NFT_REDIR 539 depends on NF_CONNTRACK 540 depends on NF_NAT 541 tristate "Netfilter nf_tables redirect support" 542 help 543 This options adds the "redirect" expression that you can use 544 to perform NAT in the redirect flavour. 545 546config NFT_NAT 547 depends on NF_CONNTRACK 548 select NF_NAT 549 tristate "Netfilter nf_tables nat module" 550 help 551 This option adds the "nat" expression that you can use to perform 552 typical Network Address Translation (NAT) packet transformations. 553 554config NFT_QUEUE 555 depends on NETFILTER_NETLINK_QUEUE 556 tristate "Netfilter nf_tables queue module" 557 help 558 This is required if you intend to use the userspace queueing 559 infrastructure (also known as NFQUEUE) from nftables. 560 561config NFT_QUOTA 562 tristate "Netfilter nf_tables quota module" 563 help 564 This option adds the "quota" expression that you can use to match 565 enforce bytes quotas. 566 567config NFT_REJECT 568 default m if NETFILTER_ADVANCED=n 569 tristate "Netfilter nf_tables reject support" 570 help 571 This option adds the "reject" expression that you can use to 572 explicitly deny and notify via TCP reset/ICMP informational errors 573 unallowed traffic. 574 575config NFT_REJECT_INET 576 depends on NF_TABLES_INET 577 default NFT_REJECT 578 tristate 579 580config NFT_COMPAT 581 depends on NETFILTER_XTABLES 582 tristate "Netfilter x_tables over nf_tables module" 583 help 584 This is required if you intend to use any of existing 585 x_tables match/target extensions over the nf_tables 586 framework. 587 588config NFT_HASH 589 tristate "Netfilter nf_tables hash module" 590 help 591 This option adds the "hash" expression that you can use to perform 592 a hash operation on registers. 593 594config NFT_FIB 595 tristate 596 597config NFT_FIB_INET 598 depends on NF_TABLES_INET 599 depends on NFT_FIB_IPV4 600 depends on NFT_FIB_IPV6 601 tristate "Netfilter nf_tables fib inet support" 602 help 603 This option allows using the FIB expression from the inet table. 604 The lookup will be delegated to the IPv4 or IPv6 FIB depending 605 on the protocol of the packet. 606 607if NF_TABLES_NETDEV 608 609config NF_DUP_NETDEV 610 tristate "Netfilter packet duplication support" 611 help 612 This option enables the generic packet duplication infrastructure 613 for Netfilter. 614 615config NFT_DUP_NETDEV 616 tristate "Netfilter nf_tables netdev packet duplication support" 617 select NF_DUP_NETDEV 618 help 619 This option enables packet duplication for the "netdev" family. 620 621config NFT_FWD_NETDEV 622 tristate "Netfilter nf_tables netdev packet forwarding support" 623 select NF_DUP_NETDEV 624 help 625 This option enables packet forwarding for the "netdev" family. 626 627endif # NF_TABLES_NETDEV 628 629endif # NF_TABLES 630 631config NETFILTER_XTABLES 632 tristate "Netfilter Xtables support (required for ip_tables)" 633 default m if NETFILTER_ADVANCED=n 634 help 635 This is required if you intend to use any of ip_tables, 636 ip6_tables or arp_tables. 637 638if NETFILTER_XTABLES 639 640comment "Xtables combined modules" 641 642config NETFILTER_XT_MARK 643 tristate 'nfmark target and match support' 644 default m if NETFILTER_ADVANCED=n 645 ---help--- 646 This option adds the "MARK" target and "mark" match. 647 648 Netfilter mark matching allows you to match packets based on the 649 "nfmark" value in the packet. 650 The target allows you to create rules in the "mangle" table which alter 651 the netfilter mark (nfmark) field associated with the packet. 652 653 Prior to routing, the nfmark can influence the routing method and can 654 also be used by other subsystems to change their behavior. 655 656config NETFILTER_XT_CONNMARK 657 tristate 'ctmark target and match support' 658 depends on NF_CONNTRACK 659 depends on NETFILTER_ADVANCED 660 select NF_CONNTRACK_MARK 661 ---help--- 662 This option adds the "CONNMARK" target and "connmark" match. 663 664 Netfilter allows you to store a mark value per connection (a.k.a. 665 ctmark), similarly to the packet mark (nfmark). Using this 666 target and match, you can set and match on this mark. 667 668config NETFILTER_XT_SET 669 tristate 'set target and match support' 670 depends on IP_SET 671 depends on NETFILTER_ADVANCED 672 help 673 This option adds the "SET" target and "set" match. 674 675 Using this target and match, you can add/delete and match 676 elements in the sets created by ipset(8). 677 678 To compile it as a module, choose M here. If unsure, say N. 679 680# alphabetically ordered list of targets 681 682comment "Xtables targets" 683 684config NETFILTER_XT_TARGET_AUDIT 685 tristate "AUDIT target support" 686 depends on AUDIT 687 depends on NETFILTER_ADVANCED 688 ---help--- 689 This option adds a 'AUDIT' target, which can be used to create 690 audit records for packets dropped/accepted. 691 692 To compileit as a module, choose M here. If unsure, say N. 693 694config NETFILTER_XT_TARGET_CHECKSUM 695 tristate "CHECKSUM target support" 696 depends on IP_NF_MANGLE || IP6_NF_MANGLE 697 depends on NETFILTER_ADVANCED 698 ---help--- 699 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 700 table. 701 702 You can use this target to compute and fill in the checksum in 703 a packet that lacks a checksum. This is particularly useful, 704 if you need to work around old applications such as dhcp clients, 705 that do not work well with checksum offloads, but don't want to disable 706 checksum offload in your device. 707 708 To compile it as a module, choose M here. If unsure, say N. 709 710config NETFILTER_XT_TARGET_CLASSIFY 711 tristate '"CLASSIFY" target support' 712 depends on NETFILTER_ADVANCED 713 help 714 This option adds a `CLASSIFY' target, which enables the user to set 715 the priority of a packet. Some qdiscs can use this value for 716 classification, among these are: 717 718 atm, cbq, dsmark, pfifo_fast, htb, prio 719 720 To compile it as a module, choose M here. If unsure, say N. 721 722config NETFILTER_XT_TARGET_CONNMARK 723 tristate '"CONNMARK" target support' 724 depends on NF_CONNTRACK 725 depends on NETFILTER_ADVANCED 726 select NETFILTER_XT_CONNMARK 727 ---help--- 728 This is a backwards-compat option for the user's convenience 729 (e.g. when running oldconfig). It selects 730 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 731 732config NETFILTER_XT_TARGET_CONNSECMARK 733 tristate '"CONNSECMARK" target support' 734 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 735 default m if NETFILTER_ADVANCED=n 736 help 737 The CONNSECMARK target copies security markings from packets 738 to connections, and restores security markings from connections 739 to packets (if the packets are not already marked). This would 740 normally be used in conjunction with the SECMARK target. 741 742 To compile it as a module, choose M here. If unsure, say N. 743 744config NETFILTER_XT_TARGET_CT 745 tristate '"CT" target support' 746 depends on NF_CONNTRACK 747 depends on IP_NF_RAW || IP6_NF_RAW 748 depends on NETFILTER_ADVANCED 749 help 750 This options adds a `CT' target, which allows to specify initial 751 connection tracking parameters like events to be delivered and 752 the helper to be used. 753 754 To compile it as a module, choose M here. If unsure, say N. 755 756config NETFILTER_XT_TARGET_DSCP 757 tristate '"DSCP" and "TOS" target support' 758 depends on IP_NF_MANGLE || IP6_NF_MANGLE 759 depends on NETFILTER_ADVANCED 760 help 761 This option adds a `DSCP' target, which allows you to manipulate 762 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 763 764 The DSCP field can have any value between 0x0 and 0x3f inclusive. 765 766 It also adds the "TOS" target, which allows you to create rules in 767 the "mangle" table which alter the Type Of Service field of an IPv4 768 or the Priority field of an IPv6 packet, prior to routing. 769 770 To compile it as a module, choose M here. If unsure, say N. 771 772config NETFILTER_XT_TARGET_HL 773 tristate '"HL" hoplimit target support' 774 depends on IP_NF_MANGLE || IP6_NF_MANGLE 775 depends on NETFILTER_ADVANCED 776 ---help--- 777 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 778 targets, which enable the user to change the 779 hoplimit/time-to-live value of the IP header. 780 781 While it is safe to decrement the hoplimit/TTL value, the 782 modules also allow to increment and set the hoplimit value of 783 the header to arbitrary values. This is EXTREMELY DANGEROUS 784 since you can easily create immortal packets that loop 785 forever on the network. 786 787config NETFILTER_XT_TARGET_HMARK 788 tristate '"HMARK" target support' 789 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 790 depends on NETFILTER_ADVANCED 791 ---help--- 792 This option adds the "HMARK" target. 793 794 The target allows you to create rules in the "raw" and "mangle" tables 795 which set the skbuff mark by means of hash calculation within a given 796 range. The nfmark can influence the routing method and can also be used 797 by other subsystems to change their behaviour. 798 799 To compile it as a module, choose M here. If unsure, say N. 800 801config NETFILTER_XT_TARGET_IDLETIMER 802 tristate "IDLETIMER target support" 803 depends on NETFILTER_ADVANCED 804 help 805 806 This option adds the `IDLETIMER' target. Each matching packet 807 resets the timer associated with label specified when the rule is 808 added. When the timer expires, it triggers a sysfs notification. 809 The remaining time for expiration can be read via sysfs. 810 811 To compile it as a module, choose M here. If unsure, say N. 812 813config NETFILTER_XT_TARGET_LED 814 tristate '"LED" target support' 815 depends on LEDS_CLASS && LEDS_TRIGGERS 816 depends on NETFILTER_ADVANCED 817 help 818 This option adds a `LED' target, which allows you to blink LEDs in 819 response to particular packets passing through your machine. 820 821 This can be used to turn a spare LED into a network activity LED, 822 which only flashes in response to FTP transfers, for example. Or 823 you could have an LED which lights up for a minute or two every time 824 somebody connects to your machine via SSH. 825 826 You will need support for the "led" class to make this work. 827 828 To create an LED trigger for incoming SSH traffic: 829 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 830 831 Then attach the new trigger to an LED on your system: 832 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 833 834 For more information on the LEDs available on your system, see 835 Documentation/leds/leds-class.txt 836 837config NETFILTER_XT_TARGET_LOG 838 tristate "LOG target support" 839 select NF_LOG_COMMON 840 select NF_LOG_IPV4 841 select NF_LOG_IPV6 if IPV6 842 default m if NETFILTER_ADVANCED=n 843 help 844 This option adds a `LOG' target, which allows you to create rules in 845 any iptables table which records the packet header to the syslog. 846 847 To compile it as a module, choose M here. If unsure, say N. 848 849config NETFILTER_XT_TARGET_MARK 850 tristate '"MARK" target support' 851 depends on NETFILTER_ADVANCED 852 select NETFILTER_XT_MARK 853 ---help--- 854 This is a backwards-compat option for the user's convenience 855 (e.g. when running oldconfig). It selects 856 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 857 858config NETFILTER_XT_NAT 859 tristate '"SNAT and DNAT" targets support' 860 depends on NF_NAT 861 ---help--- 862 This option enables the SNAT and DNAT targets. 863 864 To compile it as a module, choose M here. If unsure, say N. 865 866config NETFILTER_XT_TARGET_NETMAP 867 tristate '"NETMAP" target support' 868 depends on NF_NAT 869 ---help--- 870 NETMAP is an implementation of static 1:1 NAT mapping of network 871 addresses. It maps the network address part, while keeping the host 872 address part intact. 873 874 To compile it as a module, choose M here. If unsure, say N. 875 876config NETFILTER_XT_TARGET_NFLOG 877 tristate '"NFLOG" target support' 878 default m if NETFILTER_ADVANCED=n 879 select NETFILTER_NETLINK_LOG 880 help 881 This option enables the NFLOG target, which allows to LOG 882 messages through nfnetlink_log. 883 884 To compile it as a module, choose M here. If unsure, say N. 885 886config NETFILTER_XT_TARGET_NFQUEUE 887 tristate '"NFQUEUE" target Support' 888 depends on NETFILTER_ADVANCED 889 select NETFILTER_NETLINK_QUEUE 890 help 891 This target replaced the old obsolete QUEUE target. 892 893 As opposed to QUEUE, it supports 65535 different queues, 894 not just one. 895 896 To compile it as a module, choose M here. If unsure, say N. 897 898config NETFILTER_XT_TARGET_NOTRACK 899 tristate '"NOTRACK" target support (DEPRECATED)' 900 depends on NF_CONNTRACK 901 depends on IP_NF_RAW || IP6_NF_RAW 902 depends on NETFILTER_ADVANCED 903 select NETFILTER_XT_TARGET_CT 904 905config NETFILTER_XT_TARGET_RATEEST 906 tristate '"RATEEST" target support' 907 depends on NETFILTER_ADVANCED 908 help 909 This option adds a `RATEEST' target, which allows to measure 910 rates similar to TC estimators. The `rateest' match can be 911 used to match on the measured rates. 912 913 To compile it as a module, choose M here. If unsure, say N. 914 915config NETFILTER_XT_TARGET_REDIRECT 916 tristate "REDIRECT target support" 917 depends on NF_NAT 918 select NF_NAT_REDIRECT 919 ---help--- 920 REDIRECT is a special case of NAT: all incoming connections are 921 mapped onto the incoming interface's address, causing the packets to 922 come to the local machine instead of passing through. This is 923 useful for transparent proxies. 924 925 To compile it as a module, choose M here. If unsure, say N. 926 927config NETFILTER_XT_TARGET_TEE 928 tristate '"TEE" - packet cloning to alternate destination' 929 depends on NETFILTER_ADVANCED 930 depends on IPV6 || IPV6=n 931 depends on !NF_CONNTRACK || NF_CONNTRACK 932 select NF_DUP_IPV4 933 select NF_DUP_IPV6 if IPV6 934 ---help--- 935 This option adds a "TEE" target with which a packet can be cloned and 936 this clone be rerouted to another nexthop. 937 938config NETFILTER_XT_TARGET_TPROXY 939 tristate '"TPROXY" target transparent proxying support' 940 depends on NETFILTER_XTABLES 941 depends on NETFILTER_ADVANCED 942 depends on IPV6 || IPV6=n 943 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 944 depends on IP_NF_MANGLE 945 select NF_DEFRAG_IPV4 946 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 947 help 948 This option adds a `TPROXY' target, which is somewhat similar to 949 REDIRECT. It can only be used in the mangle table and is useful 950 to redirect traffic to a transparent proxy. It does _not_ depend 951 on Netfilter connection tracking and NAT, unlike REDIRECT. 952 For it to work you will have to configure certain iptables rules 953 and use policy routing. For more information on how to set it up 954 see Documentation/networking/tproxy.txt. 955 956 To compile it as a module, choose M here. If unsure, say N. 957 958config NETFILTER_XT_TARGET_TRACE 959 tristate '"TRACE" target support' 960 depends on IP_NF_RAW || IP6_NF_RAW 961 depends on NETFILTER_ADVANCED 962 help 963 The TRACE target allows you to mark packets so that the kernel 964 will log every rule which match the packets as those traverse 965 the tables, chains, rules. 966 967 If you want to compile it as a module, say M here and read 968 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 969 970config NETFILTER_XT_TARGET_SECMARK 971 tristate '"SECMARK" target support' 972 depends on NETWORK_SECMARK 973 default m if NETFILTER_ADVANCED=n 974 help 975 The SECMARK target allows security marking of network 976 packets, for use with security subsystems. 977 978 To compile it as a module, choose M here. If unsure, say N. 979 980config NETFILTER_XT_TARGET_TCPMSS 981 tristate '"TCPMSS" target support' 982 depends on IPV6 || IPV6=n 983 default m if NETFILTER_ADVANCED=n 984 ---help--- 985 This option adds a `TCPMSS' target, which allows you to alter the 986 MSS value of TCP SYN packets, to control the maximum size for that 987 connection (usually limiting it to your outgoing interface's MTU 988 minus 40). 989 990 This is used to overcome criminally braindead ISPs or servers which 991 block ICMP Fragmentation Needed packets. The symptoms of this 992 problem are that everything works fine from your Linux 993 firewall/router, but machines behind it can never exchange large 994 packets: 995 1) Web browsers connect, then hang with no data received. 996 2) Small mail works fine, but large emails hang. 997 3) ssh works fine, but scp hangs after initial handshaking. 998 999 Workaround: activate this option and add a rule to your firewall 1000 configuration like: 1001 1002 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1003 -j TCPMSS --clamp-mss-to-pmtu 1004 1005 To compile it as a module, choose M here. If unsure, say N. 1006 1007config NETFILTER_XT_TARGET_TCPOPTSTRIP 1008 tristate '"TCPOPTSTRIP" target support' 1009 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1010 depends on NETFILTER_ADVANCED 1011 help 1012 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1013 TCP options from TCP packets. 1014 1015# alphabetically ordered list of matches 1016 1017comment "Xtables matches" 1018 1019config NETFILTER_XT_MATCH_ADDRTYPE 1020 tristate '"addrtype" address type match support' 1021 default m if NETFILTER_ADVANCED=n 1022 ---help--- 1023 This option allows you to match what routing thinks of an address, 1024 eg. UNICAST, LOCAL, BROADCAST, ... 1025 1026 If you want to compile it as a module, say M here and read 1027 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1028 1029config NETFILTER_XT_MATCH_BPF 1030 tristate '"bpf" match support' 1031 depends on NETFILTER_ADVANCED 1032 help 1033 BPF matching applies a linux socket filter to each packet and 1034 accepts those for which the filter returns non-zero. 1035 1036 To compile it as a module, choose M here. If unsure, say N. 1037 1038config NETFILTER_XT_MATCH_CGROUP 1039 tristate '"control group" match support' 1040 depends on NETFILTER_ADVANCED 1041 depends on CGROUPS 1042 select CGROUP_NET_CLASSID 1043 ---help--- 1044 Socket/process control group matching allows you to match locally 1045 generated packets based on which net_cls control group processes 1046 belong to. 1047 1048config NETFILTER_XT_MATCH_CLUSTER 1049 tristate '"cluster" match support' 1050 depends on NF_CONNTRACK 1051 depends on NETFILTER_ADVANCED 1052 ---help--- 1053 This option allows you to build work-load-sharing clusters of 1054 network servers/stateful firewalls without having a dedicated 1055 load-balancing router/server/switch. Basically, this match returns 1056 true when the packet must be handled by this cluster node. Thus, 1057 all nodes see all packets and this match decides which node handles 1058 what packets. The work-load sharing algorithm is based on source 1059 address hashing. 1060 1061 If you say Y or M here, try `iptables -m cluster --help` for 1062 more information. 1063 1064config NETFILTER_XT_MATCH_COMMENT 1065 tristate '"comment" match support' 1066 depends on NETFILTER_ADVANCED 1067 help 1068 This option adds a `comment' dummy-match, which allows you to put 1069 comments in your iptables ruleset. 1070 1071 If you want to compile it as a module, say M here and read 1072 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1073 1074config NETFILTER_XT_MATCH_CONNBYTES 1075 tristate '"connbytes" per-connection counter match support' 1076 depends on NF_CONNTRACK 1077 depends on NETFILTER_ADVANCED 1078 help 1079 This option adds a `connbytes' match, which allows you to match the 1080 number of bytes and/or packets for each direction within a connection. 1081 1082 If you want to compile it as a module, say M here and read 1083 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1084 1085config NETFILTER_XT_MATCH_CONNLABEL 1086 tristate '"connlabel" match support' 1087 select NF_CONNTRACK_LABELS 1088 depends on NF_CONNTRACK 1089 depends on NETFILTER_ADVANCED 1090 ---help--- 1091 This match allows you to test and assign userspace-defined labels names 1092 to a connection. The kernel only stores bit values - mapping 1093 names to bits is done by userspace. 1094 1095 Unlike connmark, more than 32 flag bits may be assigned to a 1096 connection simultaneously. 1097 1098config NETFILTER_XT_MATCH_CONNLIMIT 1099 tristate '"connlimit" match support' 1100 depends on NF_CONNTRACK 1101 depends on NETFILTER_ADVANCED 1102 ---help--- 1103 This match allows you to match against the number of parallel 1104 connections to a server per client IP address (or address block). 1105 1106config NETFILTER_XT_MATCH_CONNMARK 1107 tristate '"connmark" connection mark match support' 1108 depends on NF_CONNTRACK 1109 depends on NETFILTER_ADVANCED 1110 select NETFILTER_XT_CONNMARK 1111 ---help--- 1112 This is a backwards-compat option for the user's convenience 1113 (e.g. when running oldconfig). It selects 1114 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1115 1116config NETFILTER_XT_MATCH_CONNTRACK 1117 tristate '"conntrack" connection tracking match support' 1118 depends on NF_CONNTRACK 1119 default m if NETFILTER_ADVANCED=n 1120 help 1121 This is a general conntrack match module, a superset of the state match. 1122 1123 It allows matching on additional conntrack information, which is 1124 useful in complex configurations, such as NAT gateways with multiple 1125 internet links or tunnels. 1126 1127 To compile it as a module, choose M here. If unsure, say N. 1128 1129config NETFILTER_XT_MATCH_CPU 1130 tristate '"cpu" match support' 1131 depends on NETFILTER_ADVANCED 1132 help 1133 CPU matching allows you to match packets based on the CPU 1134 currently handling the packet. 1135 1136 To compile it as a module, choose M here. If unsure, say N. 1137 1138config NETFILTER_XT_MATCH_DCCP 1139 tristate '"dccp" protocol match support' 1140 depends on NETFILTER_ADVANCED 1141 default IP_DCCP 1142 help 1143 With this option enabled, you will be able to use the iptables 1144 `dccp' match in order to match on DCCP source/destination ports 1145 and DCCP flags. 1146 1147 If you want to compile it as a module, say M here and read 1148 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1149 1150config NETFILTER_XT_MATCH_DEVGROUP 1151 tristate '"devgroup" match support' 1152 depends on NETFILTER_ADVANCED 1153 help 1154 This options adds a `devgroup' match, which allows to match on the 1155 device group a network device is assigned to. 1156 1157 To compile it as a module, choose M here. If unsure, say N. 1158 1159config NETFILTER_XT_MATCH_DSCP 1160 tristate '"dscp" and "tos" match support' 1161 depends on NETFILTER_ADVANCED 1162 help 1163 This option adds a `DSCP' match, which allows you to match against 1164 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1165 1166 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1167 1168 It will also add a "tos" match, which allows you to match packets 1169 based on the Type Of Service fields of the IPv4 packet (which share 1170 the same bits as DSCP). 1171 1172 To compile it as a module, choose M here. If unsure, say N. 1173 1174config NETFILTER_XT_MATCH_ECN 1175 tristate '"ecn" match support' 1176 depends on NETFILTER_ADVANCED 1177 ---help--- 1178 This option adds an "ECN" match, which allows you to match against 1179 the IPv4 and TCP header ECN fields. 1180 1181 To compile it as a module, choose M here. If unsure, say N. 1182 1183config NETFILTER_XT_MATCH_ESP 1184 tristate '"esp" match support' 1185 depends on NETFILTER_ADVANCED 1186 help 1187 This match extension allows you to match a range of SPIs 1188 inside ESP header of IPSec packets. 1189 1190 To compile it as a module, choose M here. If unsure, say N. 1191 1192config NETFILTER_XT_MATCH_HASHLIMIT 1193 tristate '"hashlimit" match support' 1194 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1195 depends on NETFILTER_ADVANCED 1196 help 1197 This option adds a `hashlimit' match. 1198 1199 As opposed to `limit', this match dynamically creates a hash table 1200 of limit buckets, based on your selection of source/destination 1201 addresses and/or ports. 1202 1203 It enables you to express policies like `10kpps for any given 1204 destination address' or `500pps from any given source address' 1205 with a single rule. 1206 1207config NETFILTER_XT_MATCH_HELPER 1208 tristate '"helper" match support' 1209 depends on NF_CONNTRACK 1210 depends on NETFILTER_ADVANCED 1211 help 1212 Helper matching allows you to match packets in dynamic connections 1213 tracked by a conntrack-helper, ie. ip_conntrack_ftp 1214 1215 To compile it as a module, choose M here. If unsure, say Y. 1216 1217config NETFILTER_XT_MATCH_HL 1218 tristate '"hl" hoplimit/TTL match support' 1219 depends on NETFILTER_ADVANCED 1220 ---help--- 1221 HL matching allows you to match packets based on the hoplimit 1222 in the IPv6 header, or the time-to-live field in the IPv4 1223 header of the packet. 1224 1225config NETFILTER_XT_MATCH_IPCOMP 1226 tristate '"ipcomp" match support' 1227 depends on NETFILTER_ADVANCED 1228 help 1229 This match extension allows you to match a range of CPIs(16 bits) 1230 inside IPComp header of IPSec packets. 1231 1232 To compile it as a module, choose M here. If unsure, say N. 1233 1234config NETFILTER_XT_MATCH_IPRANGE 1235 tristate '"iprange" address range match support' 1236 depends on NETFILTER_ADVANCED 1237 ---help--- 1238 This option adds a "iprange" match, which allows you to match based on 1239 an IP address range. (Normal iptables only matches on single addresses 1240 with an optional mask.) 1241 1242 If unsure, say M. 1243 1244config NETFILTER_XT_MATCH_IPVS 1245 tristate '"ipvs" match support' 1246 depends on IP_VS 1247 depends on NETFILTER_ADVANCED 1248 depends on NF_CONNTRACK 1249 help 1250 This option allows you to match against IPVS properties of a packet. 1251 1252 If unsure, say N. 1253 1254config NETFILTER_XT_MATCH_L2TP 1255 tristate '"l2tp" match support' 1256 depends on NETFILTER_ADVANCED 1257 default L2TP 1258 ---help--- 1259 This option adds an "L2TP" match, which allows you to match against 1260 L2TP protocol header fields. 1261 1262 To compile it as a module, choose M here. If unsure, say N. 1263 1264config NETFILTER_XT_MATCH_LENGTH 1265 tristate '"length" match support' 1266 depends on NETFILTER_ADVANCED 1267 help 1268 This option allows you to match the length of a packet against a 1269 specific value or range of values. 1270 1271 To compile it as a module, choose M here. If unsure, say N. 1272 1273config NETFILTER_XT_MATCH_LIMIT 1274 tristate '"limit" match support' 1275 depends on NETFILTER_ADVANCED 1276 help 1277 limit matching allows you to control the rate at which a rule can be 1278 matched: mainly useful in combination with the LOG target ("LOG 1279 target support", below) and to avoid some Denial of Service attacks. 1280 1281 To compile it as a module, choose M here. If unsure, say N. 1282 1283config NETFILTER_XT_MATCH_MAC 1284 tristate '"mac" address match support' 1285 depends on NETFILTER_ADVANCED 1286 help 1287 MAC matching allows you to match packets based on the source 1288 Ethernet address of the packet. 1289 1290 To compile it as a module, choose M here. If unsure, say N. 1291 1292config NETFILTER_XT_MATCH_MARK 1293 tristate '"mark" match support' 1294 depends on NETFILTER_ADVANCED 1295 select NETFILTER_XT_MARK 1296 ---help--- 1297 This is a backwards-compat option for the user's convenience 1298 (e.g. when running oldconfig). It selects 1299 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1300 1301config NETFILTER_XT_MATCH_MULTIPORT 1302 tristate '"multiport" Multiple port match support' 1303 depends on NETFILTER_ADVANCED 1304 help 1305 Multiport matching allows you to match TCP or UDP packets based on 1306 a series of source or destination ports: normally a rule can only 1307 match a single range of ports. 1308 1309 To compile it as a module, choose M here. If unsure, say N. 1310 1311config NETFILTER_XT_MATCH_NFACCT 1312 tristate '"nfacct" match support' 1313 depends on NETFILTER_ADVANCED 1314 select NETFILTER_NETLINK_ACCT 1315 help 1316 This option allows you to use the extended accounting through 1317 nfnetlink_acct. 1318 1319 To compile it as a module, choose M here. If unsure, say N. 1320 1321config NETFILTER_XT_MATCH_OSF 1322 tristate '"osf" Passive OS fingerprint match' 1323 depends on NETFILTER_ADVANCED && NETFILTER_NETLINK 1324 help 1325 This option selects the Passive OS Fingerprinting match module 1326 that allows to passively match the remote operating system by 1327 analyzing incoming TCP SYN packets. 1328 1329 Rules and loading software can be downloaded from 1330 http://www.ioremap.net/projects/osf 1331 1332 To compile it as a module, choose M here. If unsure, say N. 1333 1334config NETFILTER_XT_MATCH_OWNER 1335 tristate '"owner" match support' 1336 depends on NETFILTER_ADVANCED 1337 ---help--- 1338 Socket owner matching allows you to match locally-generated packets 1339 based on who created the socket: the user or group. It is also 1340 possible to check whether a socket actually exists. 1341 1342config NETFILTER_XT_MATCH_POLICY 1343 tristate 'IPsec "policy" match support' 1344 depends on XFRM 1345 default m if NETFILTER_ADVANCED=n 1346 help 1347 Policy matching allows you to match packets based on the 1348 IPsec policy that was used during decapsulation/will 1349 be used during encapsulation. 1350 1351 To compile it as a module, choose M here. If unsure, say N. 1352 1353config NETFILTER_XT_MATCH_PHYSDEV 1354 tristate '"physdev" match support' 1355 depends on BRIDGE && BRIDGE_NETFILTER 1356 depends on NETFILTER_ADVANCED 1357 help 1358 Physdev packet matching matches against the physical bridge ports 1359 the IP packet arrived on or will leave by. 1360 1361 To compile it as a module, choose M here. If unsure, say N. 1362 1363config NETFILTER_XT_MATCH_PKTTYPE 1364 tristate '"pkttype" packet type match support' 1365 depends on NETFILTER_ADVANCED 1366 help 1367 Packet type matching allows you to match a packet by 1368 its "class", eg. BROADCAST, MULTICAST, ... 1369 1370 Typical usage: 1371 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1372 1373 To compile it as a module, choose M here. If unsure, say N. 1374 1375config NETFILTER_XT_MATCH_QUOTA 1376 tristate '"quota" match support' 1377 depends on NETFILTER_ADVANCED 1378 help 1379 This option adds a `quota' match, which allows to match on a 1380 byte counter. 1381 1382 If you want to compile it as a module, say M here and read 1383 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1384 1385config NETFILTER_XT_MATCH_RATEEST 1386 tristate '"rateest" match support' 1387 depends on NETFILTER_ADVANCED 1388 select NETFILTER_XT_TARGET_RATEEST 1389 help 1390 This option adds a `rateest' match, which allows to match on the 1391 rate estimated by the RATEEST target. 1392 1393 To compile it as a module, choose M here. If unsure, say N. 1394 1395config NETFILTER_XT_MATCH_REALM 1396 tristate '"realm" match support' 1397 depends on NETFILTER_ADVANCED 1398 select IP_ROUTE_CLASSID 1399 help 1400 This option adds a `realm' match, which allows you to use the realm 1401 key from the routing subsystem inside iptables. 1402 1403 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1404 in tc world. 1405 1406 If you want to compile it as a module, say M here and read 1407 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1408 1409config NETFILTER_XT_MATCH_RECENT 1410 tristate '"recent" match support' 1411 depends on NETFILTER_ADVANCED 1412 ---help--- 1413 This match is used for creating one or many lists of recently 1414 used addresses and then matching against that/those list(s). 1415 1416 Short options are available by using 'iptables -m recent -h' 1417 Official Website: <http://snowman.net/projects/ipt_recent/> 1418 1419config NETFILTER_XT_MATCH_SCTP 1420 tristate '"sctp" protocol match support' 1421 depends on NETFILTER_ADVANCED 1422 default IP_SCTP 1423 help 1424 With this option enabled, you will be able to use the 1425 `sctp' match in order to match on SCTP source/destination ports 1426 and SCTP chunk types. 1427 1428 If you want to compile it as a module, say M here and read 1429 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1430 1431config NETFILTER_XT_MATCH_SOCKET 1432 tristate '"socket" match support' 1433 depends on NETFILTER_XTABLES 1434 depends on NETFILTER_ADVANCED 1435 depends on IPV6 || IPV6=n 1436 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1437 depends on NF_SOCKET_IPV4 1438 depends on NF_SOCKET_IPV6 1439 select NF_DEFRAG_IPV4 1440 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1441 help 1442 This option adds a `socket' match, which can be used to match 1443 packets for which a TCP or UDP socket lookup finds a valid socket. 1444 It can be used in combination with the MARK target and policy 1445 routing to implement full featured non-locally bound sockets. 1446 1447 To compile it as a module, choose M here. If unsure, say N. 1448 1449config NETFILTER_XT_MATCH_STATE 1450 tristate '"state" match support' 1451 depends on NF_CONNTRACK 1452 default m if NETFILTER_ADVANCED=n 1453 help 1454 Connection state matching allows you to match packets based on their 1455 relationship to a tracked connection (ie. previous packets). This 1456 is a powerful tool for packet classification. 1457 1458 To compile it as a module, choose M here. If unsure, say N. 1459 1460config NETFILTER_XT_MATCH_STATISTIC 1461 tristate '"statistic" match support' 1462 depends on NETFILTER_ADVANCED 1463 help 1464 This option adds a `statistic' match, which allows you to match 1465 on packets periodically or randomly with a given percentage. 1466 1467 To compile it as a module, choose M here. If unsure, say N. 1468 1469config NETFILTER_XT_MATCH_STRING 1470 tristate '"string" match support' 1471 depends on NETFILTER_ADVANCED 1472 select TEXTSEARCH 1473 select TEXTSEARCH_KMP 1474 select TEXTSEARCH_BM 1475 select TEXTSEARCH_FSM 1476 help 1477 This option adds a `string' match, which allows you to look for 1478 pattern matchings in packets. 1479 1480 To compile it as a module, choose M here. If unsure, say N. 1481 1482config NETFILTER_XT_MATCH_TCPMSS 1483 tristate '"tcpmss" match support' 1484 depends on NETFILTER_ADVANCED 1485 help 1486 This option adds a `tcpmss' match, which allows you to examine the 1487 MSS value of TCP SYN packets, which control the maximum packet size 1488 for that connection. 1489 1490 To compile it as a module, choose M here. If unsure, say N. 1491 1492config NETFILTER_XT_MATCH_TIME 1493 tristate '"time" match support' 1494 depends on NETFILTER_ADVANCED 1495 ---help--- 1496 This option adds a "time" match, which allows you to match based on 1497 the packet arrival time (at the machine which netfilter is running) 1498 on) or departure time/date (for locally generated packets). 1499 1500 If you say Y here, try `iptables -m time --help` for 1501 more information. 1502 1503 If you want to compile it as a module, say M here. 1504 If unsure, say N. 1505 1506config NETFILTER_XT_MATCH_U32 1507 tristate '"u32" match support' 1508 depends on NETFILTER_ADVANCED 1509 ---help--- 1510 u32 allows you to extract quantities of up to 4 bytes from a packet, 1511 AND them with specified masks, shift them by specified amounts and 1512 test whether the results are in any of a set of specified ranges. 1513 The specification of what to extract is general enough to skip over 1514 headers with lengths stored in the packet, as in IP or TCP header 1515 lengths. 1516 1517 Details and examples are in the kernel module source. 1518 1519endif # NETFILTER_XTABLES 1520 1521endmenu 1522 1523source "net/netfilter/ipset/Kconfig" 1524 1525source "net/netfilter/ipvs/Kconfig" 1526