1menu "Core Netfilter Configuration" 2 depends on NET && INET && NETFILTER 3 4config NETFILTER_INGRESS 5 bool "Netfilter ingress support" 6 default y 7 select NET_INGRESS 8 help 9 This allows you to classify packets from ingress using the Netfilter 10 infrastructure. 11 12config NETFILTER_NETLINK 13 tristate 14 15config NETFILTER_NETLINK_ACCT 16tristate "Netfilter NFACCT over NFNETLINK interface" 17 depends on NETFILTER_ADVANCED 18 select NETFILTER_NETLINK 19 help 20 If this option is enabled, the kernel will include support 21 for extended accounting via NFNETLINK. 22 23config NETFILTER_NETLINK_QUEUE 24 tristate "Netfilter NFQUEUE over NFNETLINK interface" 25 depends on NETFILTER_ADVANCED 26 select NETFILTER_NETLINK 27 help 28 If this option is enabled, the kernel will include support 29 for queueing packets via NFNETLINK. 30 31config NETFILTER_NETLINK_LOG 32 tristate "Netfilter LOG over NFNETLINK interface" 33 default m if NETFILTER_ADVANCED=n 34 select NETFILTER_NETLINK 35 help 36 If this option is enabled, the kernel will include support 37 for logging packets via NFNETLINK. 38 39 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 40 and is also scheduled to replace the old syslog-based ipt_LOG 41 and ip6t_LOG modules. 42 43config NF_CONNTRACK 44 tristate "Netfilter connection tracking support" 45 default m if NETFILTER_ADVANCED=n 46 help 47 Connection tracking keeps a record of what packets have passed 48 through your machine, in order to figure out how they are related 49 into connections. 50 51 This is required to do Masquerading or other kinds of Network 52 Address Translation. It can also be used to enhance packet 53 filtering (see `Connection state match support' below). 54 55 To compile it as a module, choose M here. If unsure, say N. 56 57config NF_LOG_COMMON 58 tristate 59 60config NF_LOG_NETDEV 61 tristate "Netdev packet logging" 62 select NF_LOG_COMMON 63 64if NF_CONNTRACK 65 66config NF_CONNTRACK_MARK 67 bool 'Connection mark tracking support' 68 depends on NETFILTER_ADVANCED 69 help 70 This option enables support for connection marks, used by the 71 `CONNMARK' target and `connmark' match. Similar to the mark value 72 of packets, but this mark value is kept in the conntrack session 73 instead of the individual packets. 74 75config NF_CONNTRACK_SECMARK 76 bool 'Connection tracking security mark support' 77 depends on NETWORK_SECMARK 78 default m if NETFILTER_ADVANCED=n 79 help 80 This option enables security markings to be applied to 81 connections. Typically they are copied to connections from 82 packets using the CONNSECMARK target and copied back from 83 connections to packets with the same target, with the packets 84 being originally labeled via SECMARK. 85 86 If unsure, say 'N'. 87 88config NF_CONNTRACK_ZONES 89 bool 'Connection tracking zones' 90 depends on NETFILTER_ADVANCED 91 depends on NETFILTER_XT_TARGET_CT 92 help 93 This option enables support for connection tracking zones. 94 Normally, each connection needs to have a unique system wide 95 identity. Connection tracking zones allow to have multiple 96 connections using the same identity, as long as they are 97 contained in different zones. 98 99 If unsure, say `N'. 100 101config NF_CONNTRACK_PROCFS 102 bool "Supply CT list in procfs (OBSOLETE)" 103 default y 104 depends on PROC_FS 105 ---help--- 106 This option enables for the list of known conntrack entries 107 to be shown in procfs under net/netfilter/nf_conntrack. This 108 is considered obsolete in favor of using the conntrack(8) 109 tool which uses Netlink. 110 111config NF_CONNTRACK_EVENTS 112 bool "Connection tracking events" 113 depends on NETFILTER_ADVANCED 114 help 115 If this option is enabled, the connection tracking code will 116 provide a notifier chain that can be used by other kernel code 117 to get notified about changes in the connection tracking state. 118 119 If unsure, say `N'. 120 121config NF_CONNTRACK_TIMEOUT 122 bool 'Connection tracking timeout' 123 depends on NETFILTER_ADVANCED 124 help 125 This option enables support for connection tracking timeout 126 extension. This allows you to attach timeout policies to flow 127 via the CT target. 128 129 If unsure, say `N'. 130 131config NF_CONNTRACK_TIMESTAMP 132 bool 'Connection tracking timestamping' 133 depends on NETFILTER_ADVANCED 134 help 135 This option enables support for connection tracking timestamping. 136 This allows you to store the flow start-time and to obtain 137 the flow-stop time (once it has been destroyed) via Connection 138 tracking events. 139 140 If unsure, say `N'. 141 142config NF_CONNTRACK_LABELS 143 bool 144 help 145 This option enables support for assigning user-defined flag bits 146 to connection tracking entries. It selected by the connlabel match. 147 148config NF_CT_PROTO_DCCP 149 bool 'DCCP protocol connection tracking support' 150 depends on NETFILTER_ADVANCED 151 default y 152 help 153 With this option enabled, the layer 3 independent connection 154 tracking code will be able to do state tracking on DCCP connections. 155 156 If unsure, say Y. 157 158config NF_CT_PROTO_GRE 159 tristate 160 161config NF_CT_PROTO_SCTP 162 bool 'SCTP protocol connection tracking support' 163 depends on NETFILTER_ADVANCED 164 default y 165 select LIBCRC32C 166 help 167 With this option enabled, the layer 3 independent connection 168 tracking code will be able to do state tracking on SCTP connections. 169 170 If unsure, say Y. 171 172config NF_CT_PROTO_UDPLITE 173 bool 'UDP-Lite protocol connection tracking support' 174 depends on NETFILTER_ADVANCED 175 default y 176 help 177 With this option enabled, the layer 3 independent connection 178 tracking code will be able to do state tracking on UDP-Lite 179 connections. 180 181 If unsure, say Y. 182 183config NF_CONNTRACK_AMANDA 184 tristate "Amanda backup protocol support" 185 depends on NETFILTER_ADVANCED 186 select TEXTSEARCH 187 select TEXTSEARCH_KMP 188 help 189 If you are running the Amanda backup package <http://www.amanda.org/> 190 on this machine or machines that will be MASQUERADED through this 191 machine, then you may want to enable this feature. This allows the 192 connection tracking and natting code to allow the sub-channels that 193 Amanda requires for communication of the backup data, messages and 194 index. 195 196 To compile it as a module, choose M here. If unsure, say N. 197 198config NF_CONNTRACK_FTP 199 tristate "FTP protocol support" 200 default m if NETFILTER_ADVANCED=n 201 help 202 Tracking FTP connections is problematic: special helpers are 203 required for tracking them, and doing masquerading and other forms 204 of Network Address Translation on them. 205 206 This is FTP support on Layer 3 independent connection tracking. 207 Layer 3 independent connection tracking is experimental scheme 208 which generalize ip_conntrack to support other layer 3 protocols. 209 210 To compile it as a module, choose M here. If unsure, say N. 211 212config NF_CONNTRACK_H323 213 tristate "H.323 protocol support" 214 depends on IPV6 || IPV6=n 215 depends on NETFILTER_ADVANCED 216 help 217 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 218 important VoIP protocols, it is widely used by voice hardware and 219 software including voice gateways, IP phones, Netmeeting, OpenPhone, 220 Gnomemeeting, etc. 221 222 With this module you can support H.323 on a connection tracking/NAT 223 firewall. 224 225 This module supports RAS, Fast Start, H.245 Tunnelling, Call 226 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 227 whiteboard, file transfer, etc. For more information, please 228 visit http://nath323.sourceforge.net/. 229 230 To compile it as a module, choose M here. If unsure, say N. 231 232config NF_CONNTRACK_IRC 233 tristate "IRC protocol support" 234 default m if NETFILTER_ADVANCED=n 235 help 236 There is a commonly-used extension to IRC called 237 Direct Client-to-Client Protocol (DCC). This enables users to send 238 files to each other, and also chat to each other without the need 239 of a server. DCC Sending is used anywhere you send files over IRC, 240 and DCC Chat is most commonly used by Eggdrop bots. If you are 241 using NAT, this extension will enable you to send files and initiate 242 chats. Note that you do NOT need this extension to get files or 243 have others initiate chats, or everything else in IRC. 244 245 To compile it as a module, choose M here. If unsure, say N. 246 247config NF_CONNTRACK_BROADCAST 248 tristate 249 250config NF_CONNTRACK_NETBIOS_NS 251 tristate "NetBIOS name service protocol support" 252 select NF_CONNTRACK_BROADCAST 253 help 254 NetBIOS name service requests are sent as broadcast messages from an 255 unprivileged port and responded to with unicast messages to the 256 same port. This make them hard to firewall properly because connection 257 tracking doesn't deal with broadcasts. This helper tracks locally 258 originating NetBIOS name service requests and the corresponding 259 responses. It relies on correct IP address configuration, specifically 260 netmask and broadcast address. When properly configured, the output 261 of "ip address show" should look similar to this: 262 263 $ ip -4 address show eth0 264 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 265 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 266 267 To compile it as a module, choose M here. If unsure, say N. 268 269config NF_CONNTRACK_SNMP 270 tristate "SNMP service protocol support" 271 depends on NETFILTER_ADVANCED 272 select NF_CONNTRACK_BROADCAST 273 help 274 SNMP service requests are sent as broadcast messages from an 275 unprivileged port and responded to with unicast messages to the 276 same port. This make them hard to firewall properly because connection 277 tracking doesn't deal with broadcasts. This helper tracks locally 278 originating SNMP service requests and the corresponding 279 responses. It relies on correct IP address configuration, specifically 280 netmask and broadcast address. 281 282 To compile it as a module, choose M here. If unsure, say N. 283 284config NF_CONNTRACK_PPTP 285 tristate "PPtP protocol support" 286 depends on NETFILTER_ADVANCED 287 select NF_CT_PROTO_GRE 288 help 289 This module adds support for PPTP (Point to Point Tunnelling 290 Protocol, RFC2637) connection tracking and NAT. 291 292 If you are running PPTP sessions over a stateful firewall or NAT 293 box, you may want to enable this feature. 294 295 Please note that not all PPTP modes of operation are supported yet. 296 Specifically these limitations exist: 297 - Blindly assumes that control connections are always established 298 in PNS->PAC direction. This is a violation of RFC2637. 299 - Only supports a single call within each session 300 301 To compile it as a module, choose M here. If unsure, say N. 302 303config NF_CONNTRACK_SANE 304 tristate "SANE protocol support" 305 depends on NETFILTER_ADVANCED 306 help 307 SANE is a protocol for remote access to scanners as implemented 308 by the 'saned' daemon. Like FTP, it uses separate control and 309 data connections. 310 311 With this module you can support SANE on a connection tracking 312 firewall. 313 314 To compile it as a module, choose M here. If unsure, say N. 315 316config NF_CONNTRACK_SIP 317 tristate "SIP protocol support" 318 default m if NETFILTER_ADVANCED=n 319 help 320 SIP is an application-layer control protocol that can establish, 321 modify, and terminate multimedia sessions (conferences) such as 322 Internet telephony calls. With the ip_conntrack_sip and 323 the nf_nat_sip modules you can support the protocol on a connection 324 tracking/NATing firewall. 325 326 To compile it as a module, choose M here. If unsure, say N. 327 328config NF_CONNTRACK_TFTP 329 tristate "TFTP protocol support" 330 depends on NETFILTER_ADVANCED 331 help 332 TFTP connection tracking helper, this is required depending 333 on how restrictive your ruleset is. 334 If you are using a tftp client behind -j SNAT or -j MASQUERADING 335 you will need this. 336 337 To compile it as a module, choose M here. If unsure, say N. 338 339config NF_CT_NETLINK 340 tristate 'Connection tracking netlink interface' 341 select NETFILTER_NETLINK 342 default m if NETFILTER_ADVANCED=n 343 help 344 This option enables support for a netlink-based userspace interface 345 346config NF_CT_NETLINK_TIMEOUT 347 tristate 'Connection tracking timeout tuning via Netlink' 348 select NETFILTER_NETLINK 349 depends on NETFILTER_ADVANCED 350 help 351 This option enables support for connection tracking timeout 352 fine-grain tuning. This allows you to attach specific timeout 353 policies to flows, instead of using the global timeout policy. 354 355 If unsure, say `N'. 356 357config NF_CT_NETLINK_HELPER 358 tristate 'Connection tracking helpers in user-space via Netlink' 359 select NETFILTER_NETLINK 360 depends on NF_CT_NETLINK 361 depends on NETFILTER_NETLINK_QUEUE 362 depends on NETFILTER_NETLINK_GLUE_CT 363 depends on NETFILTER_ADVANCED 364 help 365 This option enables the user-space connection tracking helpers 366 infrastructure. 367 368 If unsure, say `N'. 369 370config NETFILTER_NETLINK_GLUE_CT 371 bool "NFQUEUE and NFLOG integration with Connection Tracking" 372 default n 373 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 374 help 375 If this option is enabled, NFQUEUE and NFLOG can include 376 Connection Tracking information together with the packet is 377 the enqueued via NFNETLINK. 378 379config NF_NAT 380 tristate 381 382config NF_NAT_NEEDED 383 bool 384 depends on NF_NAT 385 default y 386 387config NF_NAT_PROTO_DCCP 388 bool 389 depends on NF_NAT && NF_CT_PROTO_DCCP 390 default NF_NAT && NF_CT_PROTO_DCCP 391 392config NF_NAT_PROTO_UDPLITE 393 bool 394 depends on NF_NAT && NF_CT_PROTO_UDPLITE 395 default NF_NAT && NF_CT_PROTO_UDPLITE 396 397config NF_NAT_PROTO_SCTP 398 bool 399 default NF_NAT && NF_CT_PROTO_SCTP 400 depends on NF_NAT && NF_CT_PROTO_SCTP 401 402config NF_NAT_AMANDA 403 tristate 404 depends on NF_CONNTRACK && NF_NAT 405 default NF_NAT && NF_CONNTRACK_AMANDA 406 407config NF_NAT_FTP 408 tristate 409 depends on NF_CONNTRACK && NF_NAT 410 default NF_NAT && NF_CONNTRACK_FTP 411 412config NF_NAT_IRC 413 tristate 414 depends on NF_CONNTRACK && NF_NAT 415 default NF_NAT && NF_CONNTRACK_IRC 416 417config NF_NAT_SIP 418 tristate 419 depends on NF_CONNTRACK && NF_NAT 420 default NF_NAT && NF_CONNTRACK_SIP 421 422config NF_NAT_TFTP 423 tristate 424 depends on NF_CONNTRACK && NF_NAT 425 default NF_NAT && NF_CONNTRACK_TFTP 426 427config NF_NAT_REDIRECT 428 tristate "IPv4/IPv6 redirect support" 429 depends on NF_NAT 430 help 431 This is the kernel functionality to redirect packets to local 432 machine through NAT. 433 434config NETFILTER_SYNPROXY 435 tristate 436 437endif # NF_CONNTRACK 438 439config NF_TABLES 440 select NETFILTER_NETLINK 441 tristate "Netfilter nf_tables support" 442 help 443 nftables is the new packet classification framework that intends to 444 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 445 provides a pseudo-state machine with an extensible instruction-set 446 (also known as expressions) that the userspace 'nft' utility 447 (http://www.netfilter.org/projects/nftables) uses to build the 448 rule-set. It also comes with the generic set infrastructure that 449 allows you to construct mappings between matchings and actions 450 for performance lookups. 451 452 To compile it as a module, choose M here. 453 454if NF_TABLES 455 456config NF_TABLES_INET 457 depends on IPV6 458 select NF_TABLES_IPV4 459 select NF_TABLES_IPV6 460 tristate "Netfilter nf_tables mixed IPv4/IPv6 tables support" 461 help 462 This option enables support for a mixed IPv4/IPv6 "inet" table. 463 464config NF_TABLES_NETDEV 465 tristate "Netfilter nf_tables netdev tables support" 466 help 467 This option enables support for the "netdev" table. 468 469config NFT_EXTHDR 470 tristate "Netfilter nf_tables exthdr module" 471 help 472 This option adds the "exthdr" expression that you can use to match 473 IPv6 extension headers and tcp options. 474 475config NFT_META 476 tristate "Netfilter nf_tables meta module" 477 help 478 This option adds the "meta" expression that you can use to match and 479 to set packet metainformation such as the packet mark. 480 481config NFT_RT 482 tristate "Netfilter nf_tables routing module" 483 help 484 This option adds the "rt" expression that you can use to match 485 packet routing information such as the packet nexthop. 486 487config NFT_NUMGEN 488 tristate "Netfilter nf_tables number generator module" 489 help 490 This option adds the number generator expression used to perform 491 incremental counting and random numbers bound to a upper limit. 492 493config NFT_CT 494 depends on NF_CONNTRACK 495 tristate "Netfilter nf_tables conntrack module" 496 help 497 This option adds the "ct" expression that you can use to match 498 connection tracking information such as the flow state. 499 500config NFT_SET_RBTREE 501 tristate "Netfilter nf_tables rbtree set module" 502 help 503 This option adds the "rbtree" set type (Red Black tree) that is used 504 to build interval-based sets. 505 506config NFT_SET_HASH 507 tristate "Netfilter nf_tables hash set module" 508 help 509 This option adds the "hash" set type that is used to build one-way 510 mappings between matchings and actions. 511 512config NFT_SET_BITMAP 513 tristate "Netfilter nf_tables bitmap set module" 514 help 515 This option adds the "bitmap" set type that is used to build sets 516 whose keys are smaller or equal to 16 bits. 517 518config NFT_COUNTER 519 tristate "Netfilter nf_tables counter module" 520 help 521 This option adds the "counter" expression that you can use to 522 include packet and byte counters in a rule. 523 524config NFT_LOG 525 tristate "Netfilter nf_tables log module" 526 help 527 This option adds the "log" expression that you can use to log 528 packets matching some criteria. 529 530config NFT_LIMIT 531 tristate "Netfilter nf_tables limit module" 532 help 533 This option adds the "limit" expression that you can use to 534 ratelimit rule matchings. 535 536config NFT_MASQ 537 depends on NF_CONNTRACK 538 depends on NF_NAT 539 tristate "Netfilter nf_tables masquerade support" 540 help 541 This option adds the "masquerade" expression that you can use 542 to perform NAT in the masquerade flavour. 543 544config NFT_REDIR 545 depends on NF_CONNTRACK 546 depends on NF_NAT 547 tristate "Netfilter nf_tables redirect support" 548 help 549 This options adds the "redirect" expression that you can use 550 to perform NAT in the redirect flavour. 551 552config NFT_NAT 553 depends on NF_CONNTRACK 554 select NF_NAT 555 tristate "Netfilter nf_tables nat module" 556 help 557 This option adds the "nat" expression that you can use to perform 558 typical Network Address Translation (NAT) packet transformations. 559 560config NFT_OBJREF 561 tristate "Netfilter nf_tables stateful object reference module" 562 help 563 This option adds the "objref" expression that allows you to refer to 564 stateful objects, such as counters and quotas. 565 566config NFT_QUEUE 567 depends on NETFILTER_NETLINK_QUEUE 568 tristate "Netfilter nf_tables queue module" 569 help 570 This is required if you intend to use the userspace queueing 571 infrastructure (also known as NFQUEUE) from nftables. 572 573config NFT_QUOTA 574 tristate "Netfilter nf_tables quota module" 575 help 576 This option adds the "quota" expression that you can use to match 577 enforce bytes quotas. 578 579config NFT_REJECT 580 default m if NETFILTER_ADVANCED=n 581 tristate "Netfilter nf_tables reject support" 582 help 583 This option adds the "reject" expression that you can use to 584 explicitly deny and notify via TCP reset/ICMP informational errors 585 unallowed traffic. 586 587config NFT_REJECT_INET 588 depends on NF_TABLES_INET 589 default NFT_REJECT 590 tristate 591 592config NFT_COMPAT 593 depends on NETFILTER_XTABLES 594 tristate "Netfilter x_tables over nf_tables module" 595 help 596 This is required if you intend to use any of existing 597 x_tables match/target extensions over the nf_tables 598 framework. 599 600config NFT_HASH 601 tristate "Netfilter nf_tables hash module" 602 help 603 This option adds the "hash" expression that you can use to perform 604 a hash operation on registers. 605 606config NFT_FIB 607 tristate 608 609config NFT_FIB_INET 610 depends on NF_TABLES_INET 611 depends on NFT_FIB_IPV4 612 depends on NFT_FIB_IPV6 613 tristate "Netfilter nf_tables fib inet support" 614 help 615 This option allows using the FIB expression from the inet table. 616 The lookup will be delegated to the IPv4 or IPv6 FIB depending 617 on the protocol of the packet. 618 619if NF_TABLES_NETDEV 620 621config NF_DUP_NETDEV 622 tristate "Netfilter packet duplication support" 623 help 624 This option enables the generic packet duplication infrastructure 625 for Netfilter. 626 627config NFT_DUP_NETDEV 628 tristate "Netfilter nf_tables netdev packet duplication support" 629 select NF_DUP_NETDEV 630 help 631 This option enables packet duplication for the "netdev" family. 632 633config NFT_FWD_NETDEV 634 tristate "Netfilter nf_tables netdev packet forwarding support" 635 select NF_DUP_NETDEV 636 help 637 This option enables packet forwarding for the "netdev" family. 638 639config NFT_FIB_NETDEV 640 depends on NFT_FIB_IPV4 641 depends on NFT_FIB_IPV6 642 tristate "Netfilter nf_tables netdev fib lookups support" 643 help 644 This option allows using the FIB expression from the netdev table. 645 The lookup will be delegated to the IPv4 or IPv6 FIB depending 646 on the protocol of the packet. 647 648endif # NF_TABLES_NETDEV 649 650endif # NF_TABLES 651 652config NETFILTER_XTABLES 653 tristate "Netfilter Xtables support (required for ip_tables)" 654 default m if NETFILTER_ADVANCED=n 655 help 656 This is required if you intend to use any of ip_tables, 657 ip6_tables or arp_tables. 658 659if NETFILTER_XTABLES 660 661comment "Xtables combined modules" 662 663config NETFILTER_XT_MARK 664 tristate 'nfmark target and match support' 665 default m if NETFILTER_ADVANCED=n 666 ---help--- 667 This option adds the "MARK" target and "mark" match. 668 669 Netfilter mark matching allows you to match packets based on the 670 "nfmark" value in the packet. 671 The target allows you to create rules in the "mangle" table which alter 672 the netfilter mark (nfmark) field associated with the packet. 673 674 Prior to routing, the nfmark can influence the routing method and can 675 also be used by other subsystems to change their behavior. 676 677config NETFILTER_XT_CONNMARK 678 tristate 'ctmark target and match support' 679 depends on NF_CONNTRACK 680 depends on NETFILTER_ADVANCED 681 select NF_CONNTRACK_MARK 682 ---help--- 683 This option adds the "CONNMARK" target and "connmark" match. 684 685 Netfilter allows you to store a mark value per connection (a.k.a. 686 ctmark), similarly to the packet mark (nfmark). Using this 687 target and match, you can set and match on this mark. 688 689config NETFILTER_XT_SET 690 tristate 'set target and match support' 691 depends on IP_SET 692 depends on NETFILTER_ADVANCED 693 help 694 This option adds the "SET" target and "set" match. 695 696 Using this target and match, you can add/delete and match 697 elements in the sets created by ipset(8). 698 699 To compile it as a module, choose M here. If unsure, say N. 700 701# alphabetically ordered list of targets 702 703comment "Xtables targets" 704 705config NETFILTER_XT_TARGET_AUDIT 706 tristate "AUDIT target support" 707 depends on AUDIT 708 depends on NETFILTER_ADVANCED 709 ---help--- 710 This option adds a 'AUDIT' target, which can be used to create 711 audit records for packets dropped/accepted. 712 713 To compileit as a module, choose M here. If unsure, say N. 714 715config NETFILTER_XT_TARGET_CHECKSUM 716 tristate "CHECKSUM target support" 717 depends on IP_NF_MANGLE || IP6_NF_MANGLE 718 depends on NETFILTER_ADVANCED 719 ---help--- 720 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 721 table. 722 723 You can use this target to compute and fill in the checksum in 724 a packet that lacks a checksum. This is particularly useful, 725 if you need to work around old applications such as dhcp clients, 726 that do not work well with checksum offloads, but don't want to disable 727 checksum offload in your device. 728 729 To compile it as a module, choose M here. If unsure, say N. 730 731config NETFILTER_XT_TARGET_CLASSIFY 732 tristate '"CLASSIFY" target support' 733 depends on NETFILTER_ADVANCED 734 help 735 This option adds a `CLASSIFY' target, which enables the user to set 736 the priority of a packet. Some qdiscs can use this value for 737 classification, among these are: 738 739 atm, cbq, dsmark, pfifo_fast, htb, prio 740 741 To compile it as a module, choose M here. If unsure, say N. 742 743config NETFILTER_XT_TARGET_CONNMARK 744 tristate '"CONNMARK" target support' 745 depends on NF_CONNTRACK 746 depends on NETFILTER_ADVANCED 747 select NETFILTER_XT_CONNMARK 748 ---help--- 749 This is a backwards-compat option for the user's convenience 750 (e.g. when running oldconfig). It selects 751 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 752 753config NETFILTER_XT_TARGET_CONNSECMARK 754 tristate '"CONNSECMARK" target support' 755 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 756 default m if NETFILTER_ADVANCED=n 757 help 758 The CONNSECMARK target copies security markings from packets 759 to connections, and restores security markings from connections 760 to packets (if the packets are not already marked). This would 761 normally be used in conjunction with the SECMARK target. 762 763 To compile it as a module, choose M here. If unsure, say N. 764 765config NETFILTER_XT_TARGET_CT 766 tristate '"CT" target support' 767 depends on NF_CONNTRACK 768 depends on IP_NF_RAW || IP6_NF_RAW 769 depends on NETFILTER_ADVANCED 770 help 771 This options adds a `CT' target, which allows to specify initial 772 connection tracking parameters like events to be delivered and 773 the helper to be used. 774 775 To compile it as a module, choose M here. If unsure, say N. 776 777config NETFILTER_XT_TARGET_DSCP 778 tristate '"DSCP" and "TOS" target support' 779 depends on IP_NF_MANGLE || IP6_NF_MANGLE 780 depends on NETFILTER_ADVANCED 781 help 782 This option adds a `DSCP' target, which allows you to manipulate 783 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 784 785 The DSCP field can have any value between 0x0 and 0x3f inclusive. 786 787 It also adds the "TOS" target, which allows you to create rules in 788 the "mangle" table which alter the Type Of Service field of an IPv4 789 or the Priority field of an IPv6 packet, prior to routing. 790 791 To compile it as a module, choose M here. If unsure, say N. 792 793config NETFILTER_XT_TARGET_HL 794 tristate '"HL" hoplimit target support' 795 depends on IP_NF_MANGLE || IP6_NF_MANGLE 796 depends on NETFILTER_ADVANCED 797 ---help--- 798 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 799 targets, which enable the user to change the 800 hoplimit/time-to-live value of the IP header. 801 802 While it is safe to decrement the hoplimit/TTL value, the 803 modules also allow to increment and set the hoplimit value of 804 the header to arbitrary values. This is EXTREMELY DANGEROUS 805 since you can easily create immortal packets that loop 806 forever on the network. 807 808config NETFILTER_XT_TARGET_HMARK 809 tristate '"HMARK" target support' 810 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 811 depends on NETFILTER_ADVANCED 812 ---help--- 813 This option adds the "HMARK" target. 814 815 The target allows you to create rules in the "raw" and "mangle" tables 816 which set the skbuff mark by means of hash calculation within a given 817 range. The nfmark can influence the routing method and can also be used 818 by other subsystems to change their behaviour. 819 820 To compile it as a module, choose M here. If unsure, say N. 821 822config NETFILTER_XT_TARGET_IDLETIMER 823 tristate "IDLETIMER target support" 824 depends on NETFILTER_ADVANCED 825 help 826 827 This option adds the `IDLETIMER' target. Each matching packet 828 resets the timer associated with label specified when the rule is 829 added. When the timer expires, it triggers a sysfs notification. 830 The remaining time for expiration can be read via sysfs. 831 832 To compile it as a module, choose M here. If unsure, say N. 833 834config NETFILTER_XT_TARGET_LED 835 tristate '"LED" target support' 836 depends on LEDS_CLASS && LEDS_TRIGGERS 837 depends on NETFILTER_ADVANCED 838 help 839 This option adds a `LED' target, which allows you to blink LEDs in 840 response to particular packets passing through your machine. 841 842 This can be used to turn a spare LED into a network activity LED, 843 which only flashes in response to FTP transfers, for example. Or 844 you could have an LED which lights up for a minute or two every time 845 somebody connects to your machine via SSH. 846 847 You will need support for the "led" class to make this work. 848 849 To create an LED trigger for incoming SSH traffic: 850 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 851 852 Then attach the new trigger to an LED on your system: 853 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 854 855 For more information on the LEDs available on your system, see 856 Documentation/leds/leds-class.txt 857 858config NETFILTER_XT_TARGET_LOG 859 tristate "LOG target support" 860 select NF_LOG_COMMON 861 select NF_LOG_IPV4 862 select NF_LOG_IPV6 if IPV6 863 default m if NETFILTER_ADVANCED=n 864 help 865 This option adds a `LOG' target, which allows you to create rules in 866 any iptables table which records the packet header to the syslog. 867 868 To compile it as a module, choose M here. If unsure, say N. 869 870config NETFILTER_XT_TARGET_MARK 871 tristate '"MARK" target support' 872 depends on NETFILTER_ADVANCED 873 select NETFILTER_XT_MARK 874 ---help--- 875 This is a backwards-compat option for the user's convenience 876 (e.g. when running oldconfig). It selects 877 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 878 879config NETFILTER_XT_NAT 880 tristate '"SNAT and DNAT" targets support' 881 depends on NF_NAT 882 ---help--- 883 This option enables the SNAT and DNAT targets. 884 885 To compile it as a module, choose M here. If unsure, say N. 886 887config NETFILTER_XT_TARGET_NETMAP 888 tristate '"NETMAP" target support' 889 depends on NF_NAT 890 ---help--- 891 NETMAP is an implementation of static 1:1 NAT mapping of network 892 addresses. It maps the network address part, while keeping the host 893 address part intact. 894 895 To compile it as a module, choose M here. If unsure, say N. 896 897config NETFILTER_XT_TARGET_NFLOG 898 tristate '"NFLOG" target support' 899 default m if NETFILTER_ADVANCED=n 900 select NETFILTER_NETLINK_LOG 901 help 902 This option enables the NFLOG target, which allows to LOG 903 messages through nfnetlink_log. 904 905 To compile it as a module, choose M here. If unsure, say N. 906 907config NETFILTER_XT_TARGET_NFQUEUE 908 tristate '"NFQUEUE" target Support' 909 depends on NETFILTER_ADVANCED 910 select NETFILTER_NETLINK_QUEUE 911 help 912 This target replaced the old obsolete QUEUE target. 913 914 As opposed to QUEUE, it supports 65535 different queues, 915 not just one. 916 917 To compile it as a module, choose M here. If unsure, say N. 918 919config NETFILTER_XT_TARGET_NOTRACK 920 tristate '"NOTRACK" target support (DEPRECATED)' 921 depends on NF_CONNTRACK 922 depends on IP_NF_RAW || IP6_NF_RAW 923 depends on NETFILTER_ADVANCED 924 select NETFILTER_XT_TARGET_CT 925 926config NETFILTER_XT_TARGET_RATEEST 927 tristate '"RATEEST" target support' 928 depends on NETFILTER_ADVANCED 929 help 930 This option adds a `RATEEST' target, which allows to measure 931 rates similar to TC estimators. The `rateest' match can be 932 used to match on the measured rates. 933 934 To compile it as a module, choose M here. If unsure, say N. 935 936config NETFILTER_XT_TARGET_REDIRECT 937 tristate "REDIRECT target support" 938 depends on NF_NAT 939 select NF_NAT_REDIRECT 940 ---help--- 941 REDIRECT is a special case of NAT: all incoming connections are 942 mapped onto the incoming interface's address, causing the packets to 943 come to the local machine instead of passing through. This is 944 useful for transparent proxies. 945 946 To compile it as a module, choose M here. If unsure, say N. 947 948config NETFILTER_XT_TARGET_TEE 949 tristate '"TEE" - packet cloning to alternate destination' 950 depends on NETFILTER_ADVANCED 951 depends on IPV6 || IPV6=n 952 depends on !NF_CONNTRACK || NF_CONNTRACK 953 select NF_DUP_IPV4 954 select NF_DUP_IPV6 if IPV6 955 ---help--- 956 This option adds a "TEE" target with which a packet can be cloned and 957 this clone be rerouted to another nexthop. 958 959config NETFILTER_XT_TARGET_TPROXY 960 tristate '"TPROXY" target transparent proxying support' 961 depends on NETFILTER_XTABLES 962 depends on NETFILTER_ADVANCED 963 depends on IPV6 || IPV6=n 964 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 965 depends on IP_NF_MANGLE 966 select NF_DEFRAG_IPV4 967 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 968 help 969 This option adds a `TPROXY' target, which is somewhat similar to 970 REDIRECT. It can only be used in the mangle table and is useful 971 to redirect traffic to a transparent proxy. It does _not_ depend 972 on Netfilter connection tracking and NAT, unlike REDIRECT. 973 For it to work you will have to configure certain iptables rules 974 and use policy routing. For more information on how to set it up 975 see Documentation/networking/tproxy.txt. 976 977 To compile it as a module, choose M here. If unsure, say N. 978 979config NETFILTER_XT_TARGET_TRACE 980 tristate '"TRACE" target support' 981 depends on IP_NF_RAW || IP6_NF_RAW 982 depends on NETFILTER_ADVANCED 983 help 984 The TRACE target allows you to mark packets so that the kernel 985 will log every rule which match the packets as those traverse 986 the tables, chains, rules. 987 988 If you want to compile it as a module, say M here and read 989 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 990 991config NETFILTER_XT_TARGET_SECMARK 992 tristate '"SECMARK" target support' 993 depends on NETWORK_SECMARK 994 default m if NETFILTER_ADVANCED=n 995 help 996 The SECMARK target allows security marking of network 997 packets, for use with security subsystems. 998 999 To compile it as a module, choose M here. If unsure, say N. 1000 1001config NETFILTER_XT_TARGET_TCPMSS 1002 tristate '"TCPMSS" target support' 1003 depends on IPV6 || IPV6=n 1004 default m if NETFILTER_ADVANCED=n 1005 ---help--- 1006 This option adds a `TCPMSS' target, which allows you to alter the 1007 MSS value of TCP SYN packets, to control the maximum size for that 1008 connection (usually limiting it to your outgoing interface's MTU 1009 minus 40). 1010 1011 This is used to overcome criminally braindead ISPs or servers which 1012 block ICMP Fragmentation Needed packets. The symptoms of this 1013 problem are that everything works fine from your Linux 1014 firewall/router, but machines behind it can never exchange large 1015 packets: 1016 1) Web browsers connect, then hang with no data received. 1017 2) Small mail works fine, but large emails hang. 1018 3) ssh works fine, but scp hangs after initial handshaking. 1019 1020 Workaround: activate this option and add a rule to your firewall 1021 configuration like: 1022 1023 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1024 -j TCPMSS --clamp-mss-to-pmtu 1025 1026 To compile it as a module, choose M here. If unsure, say N. 1027 1028config NETFILTER_XT_TARGET_TCPOPTSTRIP 1029 tristate '"TCPOPTSTRIP" target support' 1030 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1031 depends on NETFILTER_ADVANCED 1032 help 1033 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1034 TCP options from TCP packets. 1035 1036# alphabetically ordered list of matches 1037 1038comment "Xtables matches" 1039 1040config NETFILTER_XT_MATCH_ADDRTYPE 1041 tristate '"addrtype" address type match support' 1042 default m if NETFILTER_ADVANCED=n 1043 ---help--- 1044 This option allows you to match what routing thinks of an address, 1045 eg. UNICAST, LOCAL, BROADCAST, ... 1046 1047 If you want to compile it as a module, say M here and read 1048 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1049 1050config NETFILTER_XT_MATCH_BPF 1051 tristate '"bpf" match support' 1052 depends on NETFILTER_ADVANCED 1053 help 1054 BPF matching applies a linux socket filter to each packet and 1055 accepts those for which the filter returns non-zero. 1056 1057 To compile it as a module, choose M here. If unsure, say N. 1058 1059config NETFILTER_XT_MATCH_CGROUP 1060 tristate '"control group" match support' 1061 depends on NETFILTER_ADVANCED 1062 depends on CGROUPS 1063 select CGROUP_NET_CLASSID 1064 ---help--- 1065 Socket/process control group matching allows you to match locally 1066 generated packets based on which net_cls control group processes 1067 belong to. 1068 1069config NETFILTER_XT_MATCH_CLUSTER 1070 tristate '"cluster" match support' 1071 depends on NF_CONNTRACK 1072 depends on NETFILTER_ADVANCED 1073 ---help--- 1074 This option allows you to build work-load-sharing clusters of 1075 network servers/stateful firewalls without having a dedicated 1076 load-balancing router/server/switch. Basically, this match returns 1077 true when the packet must be handled by this cluster node. Thus, 1078 all nodes see all packets and this match decides which node handles 1079 what packets. The work-load sharing algorithm is based on source 1080 address hashing. 1081 1082 If you say Y or M here, try `iptables -m cluster --help` for 1083 more information. 1084 1085config NETFILTER_XT_MATCH_COMMENT 1086 tristate '"comment" match support' 1087 depends on NETFILTER_ADVANCED 1088 help 1089 This option adds a `comment' dummy-match, which allows you to put 1090 comments in your iptables ruleset. 1091 1092 If you want to compile it as a module, say M here and read 1093 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1094 1095config NETFILTER_XT_MATCH_CONNBYTES 1096 tristate '"connbytes" per-connection counter match support' 1097 depends on NF_CONNTRACK 1098 depends on NETFILTER_ADVANCED 1099 help 1100 This option adds a `connbytes' match, which allows you to match the 1101 number of bytes and/or packets for each direction within a connection. 1102 1103 If you want to compile it as a module, say M here and read 1104 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1105 1106config NETFILTER_XT_MATCH_CONNLABEL 1107 tristate '"connlabel" match support' 1108 select NF_CONNTRACK_LABELS 1109 depends on NF_CONNTRACK 1110 depends on NETFILTER_ADVANCED 1111 ---help--- 1112 This match allows you to test and assign userspace-defined labels names 1113 to a connection. The kernel only stores bit values - mapping 1114 names to bits is done by userspace. 1115 1116 Unlike connmark, more than 32 flag bits may be assigned to a 1117 connection simultaneously. 1118 1119config NETFILTER_XT_MATCH_CONNLIMIT 1120 tristate '"connlimit" match support' 1121 depends on NF_CONNTRACK 1122 depends on NETFILTER_ADVANCED 1123 ---help--- 1124 This match allows you to match against the number of parallel 1125 connections to a server per client IP address (or address block). 1126 1127config NETFILTER_XT_MATCH_CONNMARK 1128 tristate '"connmark" connection mark match support' 1129 depends on NF_CONNTRACK 1130 depends on NETFILTER_ADVANCED 1131 select NETFILTER_XT_CONNMARK 1132 ---help--- 1133 This is a backwards-compat option for the user's convenience 1134 (e.g. when running oldconfig). It selects 1135 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1136 1137config NETFILTER_XT_MATCH_CONNTRACK 1138 tristate '"conntrack" connection tracking match support' 1139 depends on NF_CONNTRACK 1140 default m if NETFILTER_ADVANCED=n 1141 help 1142 This is a general conntrack match module, a superset of the state match. 1143 1144 It allows matching on additional conntrack information, which is 1145 useful in complex configurations, such as NAT gateways with multiple 1146 internet links or tunnels. 1147 1148 To compile it as a module, choose M here. If unsure, say N. 1149 1150config NETFILTER_XT_MATCH_CPU 1151 tristate '"cpu" match support' 1152 depends on NETFILTER_ADVANCED 1153 help 1154 CPU matching allows you to match packets based on the CPU 1155 currently handling the packet. 1156 1157 To compile it as a module, choose M here. If unsure, say N. 1158 1159config NETFILTER_XT_MATCH_DCCP 1160 tristate '"dccp" protocol match support' 1161 depends on NETFILTER_ADVANCED 1162 default IP_DCCP 1163 help 1164 With this option enabled, you will be able to use the iptables 1165 `dccp' match in order to match on DCCP source/destination ports 1166 and DCCP flags. 1167 1168 If you want to compile it as a module, say M here and read 1169 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1170 1171config NETFILTER_XT_MATCH_DEVGROUP 1172 tristate '"devgroup" match support' 1173 depends on NETFILTER_ADVANCED 1174 help 1175 This options adds a `devgroup' match, which allows to match on the 1176 device group a network device is assigned to. 1177 1178 To compile it as a module, choose M here. If unsure, say N. 1179 1180config NETFILTER_XT_MATCH_DSCP 1181 tristate '"dscp" and "tos" match support' 1182 depends on NETFILTER_ADVANCED 1183 help 1184 This option adds a `DSCP' match, which allows you to match against 1185 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1186 1187 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1188 1189 It will also add a "tos" match, which allows you to match packets 1190 based on the Type Of Service fields of the IPv4 packet (which share 1191 the same bits as DSCP). 1192 1193 To compile it as a module, choose M here. If unsure, say N. 1194 1195config NETFILTER_XT_MATCH_ECN 1196 tristate '"ecn" match support' 1197 depends on NETFILTER_ADVANCED 1198 ---help--- 1199 This option adds an "ECN" match, which allows you to match against 1200 the IPv4 and TCP header ECN fields. 1201 1202 To compile it as a module, choose M here. If unsure, say N. 1203 1204config NETFILTER_XT_MATCH_ESP 1205 tristate '"esp" match support' 1206 depends on NETFILTER_ADVANCED 1207 help 1208 This match extension allows you to match a range of SPIs 1209 inside ESP header of IPSec packets. 1210 1211 To compile it as a module, choose M here. If unsure, say N. 1212 1213config NETFILTER_XT_MATCH_HASHLIMIT 1214 tristate '"hashlimit" match support' 1215 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1216 depends on NETFILTER_ADVANCED 1217 help 1218 This option adds a `hashlimit' match. 1219 1220 As opposed to `limit', this match dynamically creates a hash table 1221 of limit buckets, based on your selection of source/destination 1222 addresses and/or ports. 1223 1224 It enables you to express policies like `10kpps for any given 1225 destination address' or `500pps from any given source address' 1226 with a single rule. 1227 1228config NETFILTER_XT_MATCH_HELPER 1229 tristate '"helper" match support' 1230 depends on NF_CONNTRACK 1231 depends on NETFILTER_ADVANCED 1232 help 1233 Helper matching allows you to match packets in dynamic connections 1234 tracked by a conntrack-helper, ie. ip_conntrack_ftp 1235 1236 To compile it as a module, choose M here. If unsure, say Y. 1237 1238config NETFILTER_XT_MATCH_HL 1239 tristate '"hl" hoplimit/TTL match support' 1240 depends on NETFILTER_ADVANCED 1241 ---help--- 1242 HL matching allows you to match packets based on the hoplimit 1243 in the IPv6 header, or the time-to-live field in the IPv4 1244 header of the packet. 1245 1246config NETFILTER_XT_MATCH_IPCOMP 1247 tristate '"ipcomp" match support' 1248 depends on NETFILTER_ADVANCED 1249 help 1250 This match extension allows you to match a range of CPIs(16 bits) 1251 inside IPComp header of IPSec packets. 1252 1253 To compile it as a module, choose M here. If unsure, say N. 1254 1255config NETFILTER_XT_MATCH_IPRANGE 1256 tristate '"iprange" address range match support' 1257 depends on NETFILTER_ADVANCED 1258 ---help--- 1259 This option adds a "iprange" match, which allows you to match based on 1260 an IP address range. (Normal iptables only matches on single addresses 1261 with an optional mask.) 1262 1263 If unsure, say M. 1264 1265config NETFILTER_XT_MATCH_IPVS 1266 tristate '"ipvs" match support' 1267 depends on IP_VS 1268 depends on NETFILTER_ADVANCED 1269 depends on NF_CONNTRACK 1270 help 1271 This option allows you to match against IPVS properties of a packet. 1272 1273 If unsure, say N. 1274 1275config NETFILTER_XT_MATCH_L2TP 1276 tristate '"l2tp" match support' 1277 depends on NETFILTER_ADVANCED 1278 default L2TP 1279 ---help--- 1280 This option adds an "L2TP" match, which allows you to match against 1281 L2TP protocol header fields. 1282 1283 To compile it as a module, choose M here. If unsure, say N. 1284 1285config NETFILTER_XT_MATCH_LENGTH 1286 tristate '"length" match support' 1287 depends on NETFILTER_ADVANCED 1288 help 1289 This option allows you to match the length of a packet against a 1290 specific value or range of values. 1291 1292 To compile it as a module, choose M here. If unsure, say N. 1293 1294config NETFILTER_XT_MATCH_LIMIT 1295 tristate '"limit" match support' 1296 depends on NETFILTER_ADVANCED 1297 help 1298 limit matching allows you to control the rate at which a rule can be 1299 matched: mainly useful in combination with the LOG target ("LOG 1300 target support", below) and to avoid some Denial of Service attacks. 1301 1302 To compile it as a module, choose M here. If unsure, say N. 1303 1304config NETFILTER_XT_MATCH_MAC 1305 tristate '"mac" address match support' 1306 depends on NETFILTER_ADVANCED 1307 help 1308 MAC matching allows you to match packets based on the source 1309 Ethernet address of the packet. 1310 1311 To compile it as a module, choose M here. If unsure, say N. 1312 1313config NETFILTER_XT_MATCH_MARK 1314 tristate '"mark" match support' 1315 depends on NETFILTER_ADVANCED 1316 select NETFILTER_XT_MARK 1317 ---help--- 1318 This is a backwards-compat option for the user's convenience 1319 (e.g. when running oldconfig). It selects 1320 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1321 1322config NETFILTER_XT_MATCH_MULTIPORT 1323 tristate '"multiport" Multiple port match support' 1324 depends on NETFILTER_ADVANCED 1325 help 1326 Multiport matching allows you to match TCP or UDP packets based on 1327 a series of source or destination ports: normally a rule can only 1328 match a single range of ports. 1329 1330 To compile it as a module, choose M here. If unsure, say N. 1331 1332config NETFILTER_XT_MATCH_NFACCT 1333 tristate '"nfacct" match support' 1334 depends on NETFILTER_ADVANCED 1335 select NETFILTER_NETLINK_ACCT 1336 help 1337 This option allows you to use the extended accounting through 1338 nfnetlink_acct. 1339 1340 To compile it as a module, choose M here. If unsure, say N. 1341 1342config NETFILTER_XT_MATCH_OSF 1343 tristate '"osf" Passive OS fingerprint match' 1344 depends on NETFILTER_ADVANCED && NETFILTER_NETLINK 1345 help 1346 This option selects the Passive OS Fingerprinting match module 1347 that allows to passively match the remote operating system by 1348 analyzing incoming TCP SYN packets. 1349 1350 Rules and loading software can be downloaded from 1351 http://www.ioremap.net/projects/osf 1352 1353 To compile it as a module, choose M here. If unsure, say N. 1354 1355config NETFILTER_XT_MATCH_OWNER 1356 tristate '"owner" match support' 1357 depends on NETFILTER_ADVANCED 1358 ---help--- 1359 Socket owner matching allows you to match locally-generated packets 1360 based on who created the socket: the user or group. It is also 1361 possible to check whether a socket actually exists. 1362 1363config NETFILTER_XT_MATCH_POLICY 1364 tristate 'IPsec "policy" match support' 1365 depends on XFRM 1366 default m if NETFILTER_ADVANCED=n 1367 help 1368 Policy matching allows you to match packets based on the 1369 IPsec policy that was used during decapsulation/will 1370 be used during encapsulation. 1371 1372 To compile it as a module, choose M here. If unsure, say N. 1373 1374config NETFILTER_XT_MATCH_PHYSDEV 1375 tristate '"physdev" match support' 1376 depends on BRIDGE && BRIDGE_NETFILTER 1377 depends on NETFILTER_ADVANCED 1378 help 1379 Physdev packet matching matches against the physical bridge ports 1380 the IP packet arrived on or will leave by. 1381 1382 To compile it as a module, choose M here. If unsure, say N. 1383 1384config NETFILTER_XT_MATCH_PKTTYPE 1385 tristate '"pkttype" packet type match support' 1386 depends on NETFILTER_ADVANCED 1387 help 1388 Packet type matching allows you to match a packet by 1389 its "class", eg. BROADCAST, MULTICAST, ... 1390 1391 Typical usage: 1392 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1393 1394 To compile it as a module, choose M here. If unsure, say N. 1395 1396config NETFILTER_XT_MATCH_QUOTA 1397 tristate '"quota" match support' 1398 depends on NETFILTER_ADVANCED 1399 help 1400 This option adds a `quota' match, which allows to match on a 1401 byte counter. 1402 1403 If you want to compile it as a module, say M here and read 1404 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1405 1406config NETFILTER_XT_MATCH_RATEEST 1407 tristate '"rateest" match support' 1408 depends on NETFILTER_ADVANCED 1409 select NETFILTER_XT_TARGET_RATEEST 1410 help 1411 This option adds a `rateest' match, which allows to match on the 1412 rate estimated by the RATEEST target. 1413 1414 To compile it as a module, choose M here. If unsure, say N. 1415 1416config NETFILTER_XT_MATCH_REALM 1417 tristate '"realm" match support' 1418 depends on NETFILTER_ADVANCED 1419 select IP_ROUTE_CLASSID 1420 help 1421 This option adds a `realm' match, which allows you to use the realm 1422 key from the routing subsystem inside iptables. 1423 1424 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1425 in tc world. 1426 1427 If you want to compile it as a module, say M here and read 1428 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1429 1430config NETFILTER_XT_MATCH_RECENT 1431 tristate '"recent" match support' 1432 depends on NETFILTER_ADVANCED 1433 ---help--- 1434 This match is used for creating one or many lists of recently 1435 used addresses and then matching against that/those list(s). 1436 1437 Short options are available by using 'iptables -m recent -h' 1438 Official Website: <http://snowman.net/projects/ipt_recent/> 1439 1440config NETFILTER_XT_MATCH_SCTP 1441 tristate '"sctp" protocol match support' 1442 depends on NETFILTER_ADVANCED 1443 default IP_SCTP 1444 help 1445 With this option enabled, you will be able to use the 1446 `sctp' match in order to match on SCTP source/destination ports 1447 and SCTP chunk types. 1448 1449 If you want to compile it as a module, say M here and read 1450 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1451 1452config NETFILTER_XT_MATCH_SOCKET 1453 tristate '"socket" match support' 1454 depends on NETFILTER_XTABLES 1455 depends on NETFILTER_ADVANCED 1456 depends on IPV6 || IPV6=n 1457 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1458 depends on NF_SOCKET_IPV4 1459 depends on NF_SOCKET_IPV6 1460 select NF_DEFRAG_IPV4 1461 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1462 help 1463 This option adds a `socket' match, which can be used to match 1464 packets for which a TCP or UDP socket lookup finds a valid socket. 1465 It can be used in combination with the MARK target and policy 1466 routing to implement full featured non-locally bound sockets. 1467 1468 To compile it as a module, choose M here. If unsure, say N. 1469 1470config NETFILTER_XT_MATCH_STATE 1471 tristate '"state" match support' 1472 depends on NF_CONNTRACK 1473 default m if NETFILTER_ADVANCED=n 1474 help 1475 Connection state matching allows you to match packets based on their 1476 relationship to a tracked connection (ie. previous packets). This 1477 is a powerful tool for packet classification. 1478 1479 To compile it as a module, choose M here. If unsure, say N. 1480 1481config NETFILTER_XT_MATCH_STATISTIC 1482 tristate '"statistic" match support' 1483 depends on NETFILTER_ADVANCED 1484 help 1485 This option adds a `statistic' match, which allows you to match 1486 on packets periodically or randomly with a given percentage. 1487 1488 To compile it as a module, choose M here. If unsure, say N. 1489 1490config NETFILTER_XT_MATCH_STRING 1491 tristate '"string" match support' 1492 depends on NETFILTER_ADVANCED 1493 select TEXTSEARCH 1494 select TEXTSEARCH_KMP 1495 select TEXTSEARCH_BM 1496 select TEXTSEARCH_FSM 1497 help 1498 This option adds a `string' match, which allows you to look for 1499 pattern matchings in packets. 1500 1501 To compile it as a module, choose M here. If unsure, say N. 1502 1503config NETFILTER_XT_MATCH_TCPMSS 1504 tristate '"tcpmss" match support' 1505 depends on NETFILTER_ADVANCED 1506 help 1507 This option adds a `tcpmss' match, which allows you to examine the 1508 MSS value of TCP SYN packets, which control the maximum packet size 1509 for that connection. 1510 1511 To compile it as a module, choose M here. If unsure, say N. 1512 1513config NETFILTER_XT_MATCH_TIME 1514 tristate '"time" match support' 1515 depends on NETFILTER_ADVANCED 1516 ---help--- 1517 This option adds a "time" match, which allows you to match based on 1518 the packet arrival time (at the machine which netfilter is running) 1519 on) or departure time/date (for locally generated packets). 1520 1521 If you say Y here, try `iptables -m time --help` for 1522 more information. 1523 1524 If you want to compile it as a module, say M here. 1525 If unsure, say N. 1526 1527config NETFILTER_XT_MATCH_U32 1528 tristate '"u32" match support' 1529 depends on NETFILTER_ADVANCED 1530 ---help--- 1531 u32 allows you to extract quantities of up to 4 bytes from a packet, 1532 AND them with specified masks, shift them by specified amounts and 1533 test whether the results are in any of a set of specified ranges. 1534 The specification of what to extract is general enough to skip over 1535 headers with lengths stored in the packet, as in IP or TCP header 1536 lengths. 1537 1538 Details and examples are in the kernel module source. 1539 1540endif # NETFILTER_XTABLES 1541 1542endmenu 1543 1544source "net/netfilter/ipset/Kconfig" 1545 1546source "net/netfilter/ipvs/Kconfig" 1547