Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1menu "Core Netfilter Configuration"
2 depends on NET && INET && NETFILTER
3
4config NETFILTER_INGRESS
5 bool "Netfilter ingress support"
6 default y
7 select NET_INGRESS
8 help
9 This allows you to classify packets from ingress using the Netfilter
10 infrastructure.
11
12config NETFILTER_NETLINK
13 tristate
14
15config NETFILTER_FAMILY_BRIDGE
16 bool
17
18config NETFILTER_FAMILY_ARP
19 bool
20
21config NETFILTER_NETLINK_ACCT
22tristate "Netfilter NFACCT over NFNETLINK interface"
23 depends on NETFILTER_ADVANCED
24 select NETFILTER_NETLINK
25 help
26 If this option is enabled, the kernel will include support
27 for extended accounting via NFNETLINK.
28
29config NETFILTER_NETLINK_QUEUE
30 tristate "Netfilter NFQUEUE over NFNETLINK interface"
31 depends on NETFILTER_ADVANCED
32 select NETFILTER_NETLINK
33 help
34 If this option is enabled, the kernel will include support
35 for queueing packets via NFNETLINK.
36
37config NETFILTER_NETLINK_LOG
38 tristate "Netfilter LOG over NFNETLINK interface"
39 default m if NETFILTER_ADVANCED=n
40 select NETFILTER_NETLINK
41 help
42 If this option is enabled, the kernel will include support
43 for logging packets via NFNETLINK.
44
45 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
46 and is also scheduled to replace the old syslog-based ipt_LOG
47 and ip6t_LOG modules.
48
49config NETFILTER_NETLINK_OSF
50 tristate "Netfilter OSF over NFNETLINK interface"
51 depends on NETFILTER_ADVANCED
52 select NETFILTER_NETLINK
53 help
54 If this option is enabled, the kernel will include support
55 for passive OS fingerprint via NFNETLINK.
56
57config NF_CONNTRACK
58 tristate "Netfilter connection tracking support"
59 default m if NETFILTER_ADVANCED=n
60 select NF_DEFRAG_IPV4
61 select NF_DEFRAG_IPV6 if IPV6 != n
62 help
63 Connection tracking keeps a record of what packets have passed
64 through your machine, in order to figure out how they are related
65 into connections.
66
67 This is required to do Masquerading or other kinds of Network
68 Address Translation. It can also be used to enhance packet
69 filtering (see `Connection state match support' below).
70
71 To compile it as a module, choose M here. If unsure, say N.
72
73config NF_LOG_COMMON
74 tristate
75
76config NF_LOG_NETDEV
77 tristate "Netdev packet logging"
78 select NF_LOG_COMMON
79
80if NF_CONNTRACK
81config NETFILTER_CONNCOUNT
82 tristate
83
84config NF_CONNTRACK_MARK
85 bool 'Connection mark tracking support'
86 depends on NETFILTER_ADVANCED
87 help
88 This option enables support for connection marks, used by the
89 `CONNMARK' target and `connmark' match. Similar to the mark value
90 of packets, but this mark value is kept in the conntrack session
91 instead of the individual packets.
92
93config NF_CONNTRACK_SECMARK
94 bool 'Connection tracking security mark support'
95 depends on NETWORK_SECMARK
96 default m if NETFILTER_ADVANCED=n
97 help
98 This option enables security markings to be applied to
99 connections. Typically they are copied to connections from
100 packets using the CONNSECMARK target and copied back from
101 connections to packets with the same target, with the packets
102 being originally labeled via SECMARK.
103
104 If unsure, say 'N'.
105
106config NF_CONNTRACK_ZONES
107 bool 'Connection tracking zones'
108 depends on NETFILTER_ADVANCED
109 help
110 This option enables support for connection tracking zones.
111 Normally, each connection needs to have a unique system wide
112 identity. Connection tracking zones allow to have multiple
113 connections using the same identity, as long as they are
114 contained in different zones.
115
116 If unsure, say `N'.
117
118config NF_CONNTRACK_PROCFS
119 bool "Supply CT list in procfs (OBSOLETE)"
120 default y
121 depends on PROC_FS
122 ---help---
123 This option enables for the list of known conntrack entries
124 to be shown in procfs under net/netfilter/nf_conntrack. This
125 is considered obsolete in favor of using the conntrack(8)
126 tool which uses Netlink.
127
128config NF_CONNTRACK_EVENTS
129 bool "Connection tracking events"
130 depends on NETFILTER_ADVANCED
131 help
132 If this option is enabled, the connection tracking code will
133 provide a notifier chain that can be used by other kernel code
134 to get notified about changes in the connection tracking state.
135
136 If unsure, say `N'.
137
138config NF_CONNTRACK_TIMEOUT
139 bool 'Connection tracking timeout'
140 depends on NETFILTER_ADVANCED
141 help
142 This option enables support for connection tracking timeout
143 extension. This allows you to attach timeout policies to flow
144 via the CT target.
145
146 If unsure, say `N'.
147
148config NF_CONNTRACK_TIMESTAMP
149 bool 'Connection tracking timestamping'
150 depends on NETFILTER_ADVANCED
151 help
152 This option enables support for connection tracking timestamping.
153 This allows you to store the flow start-time and to obtain
154 the flow-stop time (once it has been destroyed) via Connection
155 tracking events.
156
157 If unsure, say `N'.
158
159config NF_CONNTRACK_LABELS
160 bool "Connection tracking labels"
161 help
162 This option enables support for assigning user-defined flag bits
163 to connection tracking entries. It can be used with xtables connlabel
164 match and the nftables ct expression.
165
166config NF_CT_PROTO_DCCP
167 bool 'DCCP protocol connection tracking support'
168 depends on NETFILTER_ADVANCED
169 default y
170 help
171 With this option enabled, the layer 3 independent connection
172 tracking code will be able to do state tracking on DCCP connections.
173
174 If unsure, say Y.
175
176config NF_CT_PROTO_GRE
177 bool
178
179config NF_CT_PROTO_SCTP
180 bool 'SCTP protocol connection tracking support'
181 depends on NETFILTER_ADVANCED
182 default y
183 select LIBCRC32C
184 help
185 With this option enabled, the layer 3 independent connection
186 tracking code will be able to do state tracking on SCTP connections.
187
188 If unsure, say Y.
189
190config NF_CT_PROTO_UDPLITE
191 bool 'UDP-Lite protocol connection tracking support'
192 depends on NETFILTER_ADVANCED
193 default y
194 help
195 With this option enabled, the layer 3 independent connection
196 tracking code will be able to do state tracking on UDP-Lite
197 connections.
198
199 If unsure, say Y.
200
201config NF_CONNTRACK_AMANDA
202 tristate "Amanda backup protocol support"
203 depends on NETFILTER_ADVANCED
204 select TEXTSEARCH
205 select TEXTSEARCH_KMP
206 help
207 If you are running the Amanda backup package <http://www.amanda.org/>
208 on this machine or machines that will be MASQUERADED through this
209 machine, then you may want to enable this feature. This allows the
210 connection tracking and natting code to allow the sub-channels that
211 Amanda requires for communication of the backup data, messages and
212 index.
213
214 To compile it as a module, choose M here. If unsure, say N.
215
216config NF_CONNTRACK_FTP
217 tristate "FTP protocol support"
218 default m if NETFILTER_ADVANCED=n
219 help
220 Tracking FTP connections is problematic: special helpers are
221 required for tracking them, and doing masquerading and other forms
222 of Network Address Translation on them.
223
224 This is FTP support on Layer 3 independent connection tracking.
225 Layer 3 independent connection tracking is experimental scheme
226 which generalize ip_conntrack to support other layer 3 protocols.
227
228 To compile it as a module, choose M here. If unsure, say N.
229
230config NF_CONNTRACK_H323
231 tristate "H.323 protocol support"
232 depends on IPV6 || IPV6=n
233 depends on NETFILTER_ADVANCED
234 help
235 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
236 important VoIP protocols, it is widely used by voice hardware and
237 software including voice gateways, IP phones, Netmeeting, OpenPhone,
238 Gnomemeeting, etc.
239
240 With this module you can support H.323 on a connection tracking/NAT
241 firewall.
242
243 This module supports RAS, Fast Start, H.245 Tunnelling, Call
244 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
245 whiteboard, file transfer, etc. For more information, please
246 visit http://nath323.sourceforge.net/.
247
248 To compile it as a module, choose M here. If unsure, say N.
249
250config NF_CONNTRACK_IRC
251 tristate "IRC protocol support"
252 default m if NETFILTER_ADVANCED=n
253 help
254 There is a commonly-used extension to IRC called
255 Direct Client-to-Client Protocol (DCC). This enables users to send
256 files to each other, and also chat to each other without the need
257 of a server. DCC Sending is used anywhere you send files over IRC,
258 and DCC Chat is most commonly used by Eggdrop bots. If you are
259 using NAT, this extension will enable you to send files and initiate
260 chats. Note that you do NOT need this extension to get files or
261 have others initiate chats, or everything else in IRC.
262
263 To compile it as a module, choose M here. If unsure, say N.
264
265config NF_CONNTRACK_BROADCAST
266 tristate
267
268config NF_CONNTRACK_NETBIOS_NS
269 tristate "NetBIOS name service protocol support"
270 select NF_CONNTRACK_BROADCAST
271 help
272 NetBIOS name service requests are sent as broadcast messages from an
273 unprivileged port and responded to with unicast messages to the
274 same port. This make them hard to firewall properly because connection
275 tracking doesn't deal with broadcasts. This helper tracks locally
276 originating NetBIOS name service requests and the corresponding
277 responses. It relies on correct IP address configuration, specifically
278 netmask and broadcast address. When properly configured, the output
279 of "ip address show" should look similar to this:
280
281 $ ip -4 address show eth0
282 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
283 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
284
285 To compile it as a module, choose M here. If unsure, say N.
286
287config NF_CONNTRACK_SNMP
288 tristate "SNMP service protocol support"
289 depends on NETFILTER_ADVANCED
290 select NF_CONNTRACK_BROADCAST
291 help
292 SNMP service requests are sent as broadcast messages from an
293 unprivileged port and responded to with unicast messages to the
294 same port. This make them hard to firewall properly because connection
295 tracking doesn't deal with broadcasts. This helper tracks locally
296 originating SNMP service requests and the corresponding
297 responses. It relies on correct IP address configuration, specifically
298 netmask and broadcast address.
299
300 To compile it as a module, choose M here. If unsure, say N.
301
302config NF_CONNTRACK_PPTP
303 tristate "PPtP protocol support"
304 depends on NETFILTER_ADVANCED
305 select NF_CT_PROTO_GRE
306 help
307 This module adds support for PPTP (Point to Point Tunnelling
308 Protocol, RFC2637) connection tracking and NAT.
309
310 If you are running PPTP sessions over a stateful firewall or NAT
311 box, you may want to enable this feature.
312
313 Please note that not all PPTP modes of operation are supported yet.
314 Specifically these limitations exist:
315 - Blindly assumes that control connections are always established
316 in PNS->PAC direction. This is a violation of RFC2637.
317 - Only supports a single call within each session
318
319 To compile it as a module, choose M here. If unsure, say N.
320
321config NF_CONNTRACK_SANE
322 tristate "SANE protocol support"
323 depends on NETFILTER_ADVANCED
324 help
325 SANE is a protocol for remote access to scanners as implemented
326 by the 'saned' daemon. Like FTP, it uses separate control and
327 data connections.
328
329 With this module you can support SANE on a connection tracking
330 firewall.
331
332 To compile it as a module, choose M here. If unsure, say N.
333
334config NF_CONNTRACK_SIP
335 tristate "SIP protocol support"
336 default m if NETFILTER_ADVANCED=n
337 help
338 SIP is an application-layer control protocol that can establish,
339 modify, and terminate multimedia sessions (conferences) such as
340 Internet telephony calls. With the ip_conntrack_sip and
341 the nf_nat_sip modules you can support the protocol on a connection
342 tracking/NATing firewall.
343
344 To compile it as a module, choose M here. If unsure, say N.
345
346config NF_CONNTRACK_TFTP
347 tristate "TFTP protocol support"
348 depends on NETFILTER_ADVANCED
349 help
350 TFTP connection tracking helper, this is required depending
351 on how restrictive your ruleset is.
352 If you are using a tftp client behind -j SNAT or -j MASQUERADING
353 you will need this.
354
355 To compile it as a module, choose M here. If unsure, say N.
356
357config NF_CT_NETLINK
358 tristate 'Connection tracking netlink interface'
359 select NETFILTER_NETLINK
360 default m if NETFILTER_ADVANCED=n
361 help
362 This option enables support for a netlink-based userspace interface
363
364config NF_CT_NETLINK_TIMEOUT
365 tristate 'Connection tracking timeout tuning via Netlink'
366 select NETFILTER_NETLINK
367 depends on NETFILTER_ADVANCED
368 depends on NF_CONNTRACK_TIMEOUT
369 help
370 This option enables support for connection tracking timeout
371 fine-grain tuning. This allows you to attach specific timeout
372 policies to flows, instead of using the global timeout policy.
373
374 If unsure, say `N'.
375
376config NF_CT_NETLINK_HELPER
377 tristate 'Connection tracking helpers in user-space via Netlink'
378 select NETFILTER_NETLINK
379 depends on NF_CT_NETLINK
380 depends on NETFILTER_NETLINK_QUEUE
381 depends on NETFILTER_NETLINK_GLUE_CT
382 depends on NETFILTER_ADVANCED
383 help
384 This option enables the user-space connection tracking helpers
385 infrastructure.
386
387 If unsure, say `N'.
388
389config NETFILTER_NETLINK_GLUE_CT
390 bool "NFQUEUE and NFLOG integration with Connection Tracking"
391 default n
392 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
393 help
394 If this option is enabled, NFQUEUE and NFLOG can include
395 Connection Tracking information together with the packet is
396 the enqueued via NFNETLINK.
397
398config NF_NAT
399 tristate "Network Address Translation support"
400 depends on NF_CONNTRACK
401 default m if NETFILTER_ADVANCED=n
402 help
403 The NAT option allows masquerading, port forwarding and other
404 forms of full Network Address Port Translation. This can be
405 controlled by iptables, ip6tables or nft.
406
407config NF_NAT_NEEDED
408 bool
409 depends on NF_NAT
410 default y
411
412config NF_NAT_AMANDA
413 tristate
414 depends on NF_CONNTRACK && NF_NAT
415 default NF_NAT && NF_CONNTRACK_AMANDA
416
417config NF_NAT_FTP
418 tristate
419 depends on NF_CONNTRACK && NF_NAT
420 default NF_NAT && NF_CONNTRACK_FTP
421
422config NF_NAT_IRC
423 tristate
424 depends on NF_CONNTRACK && NF_NAT
425 default NF_NAT && NF_CONNTRACK_IRC
426
427config NF_NAT_SIP
428 tristate
429 depends on NF_CONNTRACK && NF_NAT
430 default NF_NAT && NF_CONNTRACK_SIP
431
432config NF_NAT_TFTP
433 tristate
434 depends on NF_CONNTRACK && NF_NAT
435 default NF_NAT && NF_CONNTRACK_TFTP
436
437config NF_NAT_REDIRECT
438 bool
439
440config NF_NAT_MASQUERADE
441 bool
442
443config NETFILTER_SYNPROXY
444 tristate
445
446endif # NF_CONNTRACK
447
448config NF_TABLES
449 select NETFILTER_NETLINK
450 tristate "Netfilter nf_tables support"
451 help
452 nftables is the new packet classification framework that intends to
453 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
454 provides a pseudo-state machine with an extensible instruction-set
455 (also known as expressions) that the userspace 'nft' utility
456 (http://www.netfilter.org/projects/nftables) uses to build the
457 rule-set. It also comes with the generic set infrastructure that
458 allows you to construct mappings between matchings and actions
459 for performance lookups.
460
461 To compile it as a module, choose M here.
462
463if NF_TABLES
464
465config NF_TABLES_SET
466 tristate "Netfilter nf_tables set infrastructure"
467 help
468 This option enables the nf_tables set infrastructure that allows to
469 look up for elements in a set and to build one-way mappings between
470 matchings and actions.
471
472config NF_TABLES_INET
473 depends on IPV6
474 select NF_TABLES_IPV4
475 select NF_TABLES_IPV6
476 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
477 help
478 This option enables support for a mixed IPv4/IPv6 "inet" table.
479
480config NF_TABLES_NETDEV
481 bool "Netfilter nf_tables netdev tables support"
482 help
483 This option enables support for the "netdev" table.
484
485config NFT_NUMGEN
486 tristate "Netfilter nf_tables number generator module"
487 help
488 This option adds the number generator expression used to perform
489 incremental counting and random numbers bound to a upper limit.
490
491config NFT_CT
492 depends on NF_CONNTRACK
493 tristate "Netfilter nf_tables conntrack module"
494 help
495 This option adds the "ct" expression that you can use to match
496 connection tracking information such as the flow state.
497
498config NFT_FLOW_OFFLOAD
499 depends on NF_CONNTRACK && NF_FLOW_TABLE
500 tristate "Netfilter nf_tables hardware flow offload module"
501 help
502 This option adds the "flow_offload" expression that you can use to
503 choose what flows are placed into the hardware.
504
505config NFT_COUNTER
506 tristate "Netfilter nf_tables counter module"
507 help
508 This option adds the "counter" expression that you can use to
509 include packet and byte counters in a rule.
510
511config NFT_CONNLIMIT
512 tristate "Netfilter nf_tables connlimit module"
513 depends on NF_CONNTRACK
514 depends on NETFILTER_ADVANCED
515 select NETFILTER_CONNCOUNT
516 help
517 This option adds the "connlimit" expression that you can use to
518 ratelimit rule matchings per connections.
519
520config NFT_LOG
521 tristate "Netfilter nf_tables log module"
522 help
523 This option adds the "log" expression that you can use to log
524 packets matching some criteria.
525
526config NFT_LIMIT
527 tristate "Netfilter nf_tables limit module"
528 help
529 This option adds the "limit" expression that you can use to
530 ratelimit rule matchings.
531
532config NFT_MASQ
533 depends on NF_CONNTRACK
534 depends on NF_NAT
535 select NF_NAT_MASQUERADE
536 tristate "Netfilter nf_tables masquerade support"
537 help
538 This option adds the "masquerade" expression that you can use
539 to perform NAT in the masquerade flavour.
540
541config NFT_REDIR
542 depends on NF_CONNTRACK
543 depends on NF_NAT
544 tristate "Netfilter nf_tables redirect support"
545 select NF_NAT_REDIRECT
546 help
547 This options adds the "redirect" expression that you can use
548 to perform NAT in the redirect flavour.
549
550config NFT_NAT
551 depends on NF_CONNTRACK
552 select NF_NAT
553 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
554 tristate "Netfilter nf_tables nat module"
555 help
556 This option adds the "nat" expression that you can use to perform
557 typical Network Address Translation (NAT) packet transformations.
558
559config NFT_TUNNEL
560 tristate "Netfilter nf_tables tunnel module"
561 help
562 This option adds the "tunnel" expression that you can use to set
563 tunneling policies.
564
565config NFT_OBJREF
566 tristate "Netfilter nf_tables stateful object reference module"
567 help
568 This option adds the "objref" expression that allows you to refer to
569 stateful objects, such as counters and quotas.
570
571config NFT_QUEUE
572 depends on NETFILTER_NETLINK_QUEUE
573 tristate "Netfilter nf_tables queue module"
574 help
575 This is required if you intend to use the userspace queueing
576 infrastructure (also known as NFQUEUE) from nftables.
577
578config NFT_QUOTA
579 tristate "Netfilter nf_tables quota module"
580 help
581 This option adds the "quota" expression that you can use to match
582 enforce bytes quotas.
583
584config NFT_REJECT
585 default m if NETFILTER_ADVANCED=n
586 tristate "Netfilter nf_tables reject support"
587 depends on !NF_TABLES_INET || (IPV6!=m || m)
588 help
589 This option adds the "reject" expression that you can use to
590 explicitly deny and notify via TCP reset/ICMP informational errors
591 unallowed traffic.
592
593config NFT_REJECT_INET
594 depends on NF_TABLES_INET
595 default NFT_REJECT
596 tristate
597
598config NFT_COMPAT
599 depends on NETFILTER_XTABLES
600 tristate "Netfilter x_tables over nf_tables module"
601 help
602 This is required if you intend to use any of existing
603 x_tables match/target extensions over the nf_tables
604 framework.
605
606config NFT_HASH
607 tristate "Netfilter nf_tables hash module"
608 help
609 This option adds the "hash" expression that you can use to perform
610 a hash operation on registers.
611
612config NFT_FIB
613 tristate
614
615config NFT_FIB_INET
616 depends on NF_TABLES_INET
617 depends on NFT_FIB_IPV4
618 depends on NFT_FIB_IPV6
619 tristate "Netfilter nf_tables fib inet support"
620 help
621 This option allows using the FIB expression from the inet table.
622 The lookup will be delegated to the IPv4 or IPv6 FIB depending
623 on the protocol of the packet.
624
625config NFT_XFRM
626 tristate "Netfilter nf_tables xfrm/IPSec security association matching"
627 depends on XFRM
628 help
629 This option adds an expression that you can use to extract properties
630 of a packets security association.
631
632config NFT_SOCKET
633 tristate "Netfilter nf_tables socket match support"
634 depends on IPV6 || IPV6=n
635 select NF_SOCKET_IPV4
636 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
637 help
638 This option allows matching for the presence or absence of a
639 corresponding socket and its attributes.
640
641config NFT_OSF
642 tristate "Netfilter nf_tables passive OS fingerprint support"
643 depends on NETFILTER_ADVANCED
644 select NETFILTER_NETLINK_OSF
645 help
646 This option allows matching packets from an specific OS.
647
648config NFT_TPROXY
649 tristate "Netfilter nf_tables tproxy support"
650 depends on IPV6 || IPV6=n
651 select NF_DEFRAG_IPV4
652 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
653 select NF_TPROXY_IPV4
654 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
655 help
656 This makes transparent proxy support available in nftables.
657
658if NF_TABLES_NETDEV
659
660config NF_DUP_NETDEV
661 tristate "Netfilter packet duplication support"
662 help
663 This option enables the generic packet duplication infrastructure
664 for Netfilter.
665
666config NFT_DUP_NETDEV
667 tristate "Netfilter nf_tables netdev packet duplication support"
668 select NF_DUP_NETDEV
669 help
670 This option enables packet duplication for the "netdev" family.
671
672config NFT_FWD_NETDEV
673 tristate "Netfilter nf_tables netdev packet forwarding support"
674 select NF_DUP_NETDEV
675 help
676 This option enables packet forwarding for the "netdev" family.
677
678config NFT_FIB_NETDEV
679 depends on NFT_FIB_IPV4
680 depends on NFT_FIB_IPV6
681 tristate "Netfilter nf_tables netdev fib lookups support"
682 help
683 This option allows using the FIB expression from the netdev table.
684 The lookup will be delegated to the IPv4 or IPv6 FIB depending
685 on the protocol of the packet.
686
687endif # NF_TABLES_NETDEV
688
689endif # NF_TABLES
690
691config NF_FLOW_TABLE_INET
692 tristate "Netfilter flow table mixed IPv4/IPv6 module"
693 depends on NF_FLOW_TABLE
694 help
695 This option adds the flow table mixed IPv4/IPv6 support.
696
697 To compile it as a module, choose M here.
698
699config NF_FLOW_TABLE
700 tristate "Netfilter flow table module"
701 depends on NETFILTER_INGRESS
702 depends on NF_CONNTRACK
703 depends on NF_TABLES
704 help
705 This option adds the flow table core infrastructure.
706
707 To compile it as a module, choose M here.
708
709config NETFILTER_XTABLES
710 tristate "Netfilter Xtables support (required for ip_tables)"
711 default m if NETFILTER_ADVANCED=n
712 help
713 This is required if you intend to use any of ip_tables,
714 ip6_tables or arp_tables.
715
716if NETFILTER_XTABLES
717
718comment "Xtables combined modules"
719
720config NETFILTER_XT_MARK
721 tristate 'nfmark target and match support'
722 default m if NETFILTER_ADVANCED=n
723 ---help---
724 This option adds the "MARK" target and "mark" match.
725
726 Netfilter mark matching allows you to match packets based on the
727 "nfmark" value in the packet.
728 The target allows you to create rules in the "mangle" table which alter
729 the netfilter mark (nfmark) field associated with the packet.
730
731 Prior to routing, the nfmark can influence the routing method and can
732 also be used by other subsystems to change their behavior.
733
734config NETFILTER_XT_CONNMARK
735 tristate 'ctmark target and match support'
736 depends on NF_CONNTRACK
737 depends on NETFILTER_ADVANCED
738 select NF_CONNTRACK_MARK
739 ---help---
740 This option adds the "CONNMARK" target and "connmark" match.
741
742 Netfilter allows you to store a mark value per connection (a.k.a.
743 ctmark), similarly to the packet mark (nfmark). Using this
744 target and match, you can set and match on this mark.
745
746config NETFILTER_XT_SET
747 tristate 'set target and match support'
748 depends on IP_SET
749 depends on NETFILTER_ADVANCED
750 help
751 This option adds the "SET" target and "set" match.
752
753 Using this target and match, you can add/delete and match
754 elements in the sets created by ipset(8).
755
756 To compile it as a module, choose M here. If unsure, say N.
757
758# alphabetically ordered list of targets
759
760comment "Xtables targets"
761
762config NETFILTER_XT_TARGET_AUDIT
763 tristate "AUDIT target support"
764 depends on AUDIT
765 depends on NETFILTER_ADVANCED
766 ---help---
767 This option adds a 'AUDIT' target, which can be used to create
768 audit records for packets dropped/accepted.
769
770 To compileit as a module, choose M here. If unsure, say N.
771
772config NETFILTER_XT_TARGET_CHECKSUM
773 tristate "CHECKSUM target support"
774 depends on IP_NF_MANGLE || IP6_NF_MANGLE
775 depends on NETFILTER_ADVANCED
776 ---help---
777 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
778 table to work around buggy DHCP clients in virtualized environments.
779
780 Some old DHCP clients drop packets because they are not aware
781 that the checksum would normally be offloaded to hardware and
782 thus should be considered valid.
783 This target can be used to fill in the checksum using iptables
784 when such packets are sent via a virtual network device.
785
786 To compile it as a module, choose M here. If unsure, say N.
787
788config NETFILTER_XT_TARGET_CLASSIFY
789 tristate '"CLASSIFY" target support'
790 depends on NETFILTER_ADVANCED
791 help
792 This option adds a `CLASSIFY' target, which enables the user to set
793 the priority of a packet. Some qdiscs can use this value for
794 classification, among these are:
795
796 atm, cbq, dsmark, pfifo_fast, htb, prio
797
798 To compile it as a module, choose M here. If unsure, say N.
799
800config NETFILTER_XT_TARGET_CONNMARK
801 tristate '"CONNMARK" target support'
802 depends on NF_CONNTRACK
803 depends on NETFILTER_ADVANCED
804 select NETFILTER_XT_CONNMARK
805 ---help---
806 This is a backwards-compat option for the user's convenience
807 (e.g. when running oldconfig). It selects
808 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
809
810config NETFILTER_XT_TARGET_CONNSECMARK
811 tristate '"CONNSECMARK" target support'
812 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
813 default m if NETFILTER_ADVANCED=n
814 help
815 The CONNSECMARK target copies security markings from packets
816 to connections, and restores security markings from connections
817 to packets (if the packets are not already marked). This would
818 normally be used in conjunction with the SECMARK target.
819
820 To compile it as a module, choose M here. If unsure, say N.
821
822config NETFILTER_XT_TARGET_CT
823 tristate '"CT" target support'
824 depends on NF_CONNTRACK
825 depends on IP_NF_RAW || IP6_NF_RAW
826 depends on NETFILTER_ADVANCED
827 help
828 This options adds a `CT' target, which allows to specify initial
829 connection tracking parameters like events to be delivered and
830 the helper to be used.
831
832 To compile it as a module, choose M here. If unsure, say N.
833
834config NETFILTER_XT_TARGET_DSCP
835 tristate '"DSCP" and "TOS" target support'
836 depends on IP_NF_MANGLE || IP6_NF_MANGLE
837 depends on NETFILTER_ADVANCED
838 help
839 This option adds a `DSCP' target, which allows you to manipulate
840 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
841
842 The DSCP field can have any value between 0x0 and 0x3f inclusive.
843
844 It also adds the "TOS" target, which allows you to create rules in
845 the "mangle" table which alter the Type Of Service field of an IPv4
846 or the Priority field of an IPv6 packet, prior to routing.
847
848 To compile it as a module, choose M here. If unsure, say N.
849
850config NETFILTER_XT_TARGET_HL
851 tristate '"HL" hoplimit target support'
852 depends on IP_NF_MANGLE || IP6_NF_MANGLE
853 depends on NETFILTER_ADVANCED
854 ---help---
855 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
856 targets, which enable the user to change the
857 hoplimit/time-to-live value of the IP header.
858
859 While it is safe to decrement the hoplimit/TTL value, the
860 modules also allow to increment and set the hoplimit value of
861 the header to arbitrary values. This is EXTREMELY DANGEROUS
862 since you can easily create immortal packets that loop
863 forever on the network.
864
865config NETFILTER_XT_TARGET_HMARK
866 tristate '"HMARK" target support'
867 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
868 depends on NETFILTER_ADVANCED
869 ---help---
870 This option adds the "HMARK" target.
871
872 The target allows you to create rules in the "raw" and "mangle" tables
873 which set the skbuff mark by means of hash calculation within a given
874 range. The nfmark can influence the routing method and can also be used
875 by other subsystems to change their behaviour.
876
877 To compile it as a module, choose M here. If unsure, say N.
878
879config NETFILTER_XT_TARGET_IDLETIMER
880 tristate "IDLETIMER target support"
881 depends on NETFILTER_ADVANCED
882 help
883
884 This option adds the `IDLETIMER' target. Each matching packet
885 resets the timer associated with label specified when the rule is
886 added. When the timer expires, it triggers a sysfs notification.
887 The remaining time for expiration can be read via sysfs.
888
889 To compile it as a module, choose M here. If unsure, say N.
890
891config NETFILTER_XT_TARGET_LED
892 tristate '"LED" target support'
893 depends on LEDS_CLASS && LEDS_TRIGGERS
894 depends on NETFILTER_ADVANCED
895 help
896 This option adds a `LED' target, which allows you to blink LEDs in
897 response to particular packets passing through your machine.
898
899 This can be used to turn a spare LED into a network activity LED,
900 which only flashes in response to FTP transfers, for example. Or
901 you could have an LED which lights up for a minute or two every time
902 somebody connects to your machine via SSH.
903
904 You will need support for the "led" class to make this work.
905
906 To create an LED trigger for incoming SSH traffic:
907 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
908
909 Then attach the new trigger to an LED on your system:
910 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
911
912 For more information on the LEDs available on your system, see
913 Documentation/leds/leds-class.txt
914
915config NETFILTER_XT_TARGET_LOG
916 tristate "LOG target support"
917 select NF_LOG_COMMON
918 select NF_LOG_IPV4
919 select NF_LOG_IPV6 if IP6_NF_IPTABLES
920 default m if NETFILTER_ADVANCED=n
921 help
922 This option adds a `LOG' target, which allows you to create rules in
923 any iptables table which records the packet header to the syslog.
924
925 To compile it as a module, choose M here. If unsure, say N.
926
927config NETFILTER_XT_TARGET_MARK
928 tristate '"MARK" target support'
929 depends on NETFILTER_ADVANCED
930 select NETFILTER_XT_MARK
931 ---help---
932 This is a backwards-compat option for the user's convenience
933 (e.g. when running oldconfig). It selects
934 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
935
936config NETFILTER_XT_NAT
937 tristate '"SNAT and DNAT" targets support'
938 depends on NF_NAT
939 ---help---
940 This option enables the SNAT and DNAT targets.
941
942 To compile it as a module, choose M here. If unsure, say N.
943
944config NETFILTER_XT_TARGET_NETMAP
945 tristate '"NETMAP" target support'
946 depends on NF_NAT
947 ---help---
948 NETMAP is an implementation of static 1:1 NAT mapping of network
949 addresses. It maps the network address part, while keeping the host
950 address part intact.
951
952 To compile it as a module, choose M here. If unsure, say N.
953
954config NETFILTER_XT_TARGET_NFLOG
955 tristate '"NFLOG" target support'
956 default m if NETFILTER_ADVANCED=n
957 select NETFILTER_NETLINK_LOG
958 help
959 This option enables the NFLOG target, which allows to LOG
960 messages through nfnetlink_log.
961
962 To compile it as a module, choose M here. If unsure, say N.
963
964config NETFILTER_XT_TARGET_NFQUEUE
965 tristate '"NFQUEUE" target Support'
966 depends on NETFILTER_ADVANCED
967 select NETFILTER_NETLINK_QUEUE
968 help
969 This target replaced the old obsolete QUEUE target.
970
971 As opposed to QUEUE, it supports 65535 different queues,
972 not just one.
973
974 To compile it as a module, choose M here. If unsure, say N.
975
976config NETFILTER_XT_TARGET_NOTRACK
977 tristate '"NOTRACK" target support (DEPRECATED)'
978 depends on NF_CONNTRACK
979 depends on IP_NF_RAW || IP6_NF_RAW
980 depends on NETFILTER_ADVANCED
981 select NETFILTER_XT_TARGET_CT
982
983config NETFILTER_XT_TARGET_RATEEST
984 tristate '"RATEEST" target support'
985 depends on NETFILTER_ADVANCED
986 help
987 This option adds a `RATEEST' target, which allows to measure
988 rates similar to TC estimators. The `rateest' match can be
989 used to match on the measured rates.
990
991 To compile it as a module, choose M here. If unsure, say N.
992
993config NETFILTER_XT_TARGET_REDIRECT
994 tristate "REDIRECT target support"
995 depends on NF_NAT
996 select NF_NAT_REDIRECT
997 ---help---
998 REDIRECT is a special case of NAT: all incoming connections are
999 mapped onto the incoming interface's address, causing the packets to
1000 come to the local machine instead of passing through. This is
1001 useful for transparent proxies.
1002
1003 To compile it as a module, choose M here. If unsure, say N.
1004
1005config NETFILTER_XT_TARGET_TEE
1006 tristate '"TEE" - packet cloning to alternate destination'
1007 depends on NETFILTER_ADVANCED
1008 depends on IPV6 || IPV6=n
1009 depends on !NF_CONNTRACK || NF_CONNTRACK
1010 select NF_DUP_IPV4
1011 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1012 ---help---
1013 This option adds a "TEE" target with which a packet can be cloned and
1014 this clone be rerouted to another nexthop.
1015
1016config NETFILTER_XT_TARGET_TPROXY
1017 tristate '"TPROXY" target transparent proxying support'
1018 depends on NETFILTER_XTABLES
1019 depends on NETFILTER_ADVANCED
1020 depends on IPV6 || IPV6=n
1021 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1022 depends on IP_NF_MANGLE
1023 select NF_DEFRAG_IPV4
1024 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1025 select NF_TPROXY_IPV4
1026 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1027 help
1028 This option adds a `TPROXY' target, which is somewhat similar to
1029 REDIRECT. It can only be used in the mangle table and is useful
1030 to redirect traffic to a transparent proxy. It does _not_ depend
1031 on Netfilter connection tracking and NAT, unlike REDIRECT.
1032 For it to work you will have to configure certain iptables rules
1033 and use policy routing. For more information on how to set it up
1034 see Documentation/networking/tproxy.txt.
1035
1036 To compile it as a module, choose M here. If unsure, say N.
1037
1038config NETFILTER_XT_TARGET_TRACE
1039 tristate '"TRACE" target support'
1040 depends on IP_NF_RAW || IP6_NF_RAW
1041 depends on NETFILTER_ADVANCED
1042 help
1043 The TRACE target allows you to mark packets so that the kernel
1044 will log every rule which match the packets as those traverse
1045 the tables, chains, rules.
1046
1047 If you want to compile it as a module, say M here and read
1048 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1049
1050config NETFILTER_XT_TARGET_SECMARK
1051 tristate '"SECMARK" target support'
1052 depends on NETWORK_SECMARK
1053 default m if NETFILTER_ADVANCED=n
1054 help
1055 The SECMARK target allows security marking of network
1056 packets, for use with security subsystems.
1057
1058 To compile it as a module, choose M here. If unsure, say N.
1059
1060config NETFILTER_XT_TARGET_TCPMSS
1061 tristate '"TCPMSS" target support'
1062 depends on IPV6 || IPV6=n
1063 default m if NETFILTER_ADVANCED=n
1064 ---help---
1065 This option adds a `TCPMSS' target, which allows you to alter the
1066 MSS value of TCP SYN packets, to control the maximum size for that
1067 connection (usually limiting it to your outgoing interface's MTU
1068 minus 40).
1069
1070 This is used to overcome criminally braindead ISPs or servers which
1071 block ICMP Fragmentation Needed packets. The symptoms of this
1072 problem are that everything works fine from your Linux
1073 firewall/router, but machines behind it can never exchange large
1074 packets:
1075 1) Web browsers connect, then hang with no data received.
1076 2) Small mail works fine, but large emails hang.
1077 3) ssh works fine, but scp hangs after initial handshaking.
1078
1079 Workaround: activate this option and add a rule to your firewall
1080 configuration like:
1081
1082 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1083 -j TCPMSS --clamp-mss-to-pmtu
1084
1085 To compile it as a module, choose M here. If unsure, say N.
1086
1087config NETFILTER_XT_TARGET_TCPOPTSTRIP
1088 tristate '"TCPOPTSTRIP" target support'
1089 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1090 depends on NETFILTER_ADVANCED
1091 help
1092 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1093 TCP options from TCP packets.
1094
1095# alphabetically ordered list of matches
1096
1097comment "Xtables matches"
1098
1099config NETFILTER_XT_MATCH_ADDRTYPE
1100 tristate '"addrtype" address type match support'
1101 default m if NETFILTER_ADVANCED=n
1102 ---help---
1103 This option allows you to match what routing thinks of an address,
1104 eg. UNICAST, LOCAL, BROADCAST, ...
1105
1106 If you want to compile it as a module, say M here and read
1107 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1108
1109config NETFILTER_XT_MATCH_BPF
1110 tristate '"bpf" match support'
1111 depends on NETFILTER_ADVANCED
1112 help
1113 BPF matching applies a linux socket filter to each packet and
1114 accepts those for which the filter returns non-zero.
1115
1116 To compile it as a module, choose M here. If unsure, say N.
1117
1118config NETFILTER_XT_MATCH_CGROUP
1119 tristate '"control group" match support'
1120 depends on NETFILTER_ADVANCED
1121 depends on CGROUPS
1122 select CGROUP_NET_CLASSID
1123 ---help---
1124 Socket/process control group matching allows you to match locally
1125 generated packets based on which net_cls control group processes
1126 belong to.
1127
1128config NETFILTER_XT_MATCH_CLUSTER
1129 tristate '"cluster" match support'
1130 depends on NF_CONNTRACK
1131 depends on NETFILTER_ADVANCED
1132 ---help---
1133 This option allows you to build work-load-sharing clusters of
1134 network servers/stateful firewalls without having a dedicated
1135 load-balancing router/server/switch. Basically, this match returns
1136 true when the packet must be handled by this cluster node. Thus,
1137 all nodes see all packets and this match decides which node handles
1138 what packets. The work-load sharing algorithm is based on source
1139 address hashing.
1140
1141 If you say Y or M here, try `iptables -m cluster --help` for
1142 more information.
1143
1144config NETFILTER_XT_MATCH_COMMENT
1145 tristate '"comment" match support'
1146 depends on NETFILTER_ADVANCED
1147 help
1148 This option adds a `comment' dummy-match, which allows you to put
1149 comments in your iptables ruleset.
1150
1151 If you want to compile it as a module, say M here and read
1152 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1153
1154config NETFILTER_XT_MATCH_CONNBYTES
1155 tristate '"connbytes" per-connection counter match support'
1156 depends on NF_CONNTRACK
1157 depends on NETFILTER_ADVANCED
1158 help
1159 This option adds a `connbytes' match, which allows you to match the
1160 number of bytes and/or packets for each direction within a connection.
1161
1162 If you want to compile it as a module, say M here and read
1163 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1164
1165config NETFILTER_XT_MATCH_CONNLABEL
1166 tristate '"connlabel" match support'
1167 select NF_CONNTRACK_LABELS
1168 depends on NF_CONNTRACK
1169 depends on NETFILTER_ADVANCED
1170 ---help---
1171 This match allows you to test and assign userspace-defined labels names
1172 to a connection. The kernel only stores bit values - mapping
1173 names to bits is done by userspace.
1174
1175 Unlike connmark, more than 32 flag bits may be assigned to a
1176 connection simultaneously.
1177
1178config NETFILTER_XT_MATCH_CONNLIMIT
1179 tristate '"connlimit" match support'
1180 depends on NF_CONNTRACK
1181 depends on NETFILTER_ADVANCED
1182 select NETFILTER_CONNCOUNT
1183 ---help---
1184 This match allows you to match against the number of parallel
1185 connections to a server per client IP address (or address block).
1186
1187config NETFILTER_XT_MATCH_CONNMARK
1188 tristate '"connmark" connection mark match support'
1189 depends on NF_CONNTRACK
1190 depends on NETFILTER_ADVANCED
1191 select NETFILTER_XT_CONNMARK
1192 ---help---
1193 This is a backwards-compat option for the user's convenience
1194 (e.g. when running oldconfig). It selects
1195 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1196
1197config NETFILTER_XT_MATCH_CONNTRACK
1198 tristate '"conntrack" connection tracking match support'
1199 depends on NF_CONNTRACK
1200 default m if NETFILTER_ADVANCED=n
1201 help
1202 This is a general conntrack match module, a superset of the state match.
1203
1204 It allows matching on additional conntrack information, which is
1205 useful in complex configurations, such as NAT gateways with multiple
1206 internet links or tunnels.
1207
1208 To compile it as a module, choose M here. If unsure, say N.
1209
1210config NETFILTER_XT_MATCH_CPU
1211 tristate '"cpu" match support'
1212 depends on NETFILTER_ADVANCED
1213 help
1214 CPU matching allows you to match packets based on the CPU
1215 currently handling the packet.
1216
1217 To compile it as a module, choose M here. If unsure, say N.
1218
1219config NETFILTER_XT_MATCH_DCCP
1220 tristate '"dccp" protocol match support'
1221 depends on NETFILTER_ADVANCED
1222 default IP_DCCP
1223 help
1224 With this option enabled, you will be able to use the iptables
1225 `dccp' match in order to match on DCCP source/destination ports
1226 and DCCP flags.
1227
1228 If you want to compile it as a module, say M here and read
1229 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1230
1231config NETFILTER_XT_MATCH_DEVGROUP
1232 tristate '"devgroup" match support'
1233 depends on NETFILTER_ADVANCED
1234 help
1235 This options adds a `devgroup' match, which allows to match on the
1236 device group a network device is assigned to.
1237
1238 To compile it as a module, choose M here. If unsure, say N.
1239
1240config NETFILTER_XT_MATCH_DSCP
1241 tristate '"dscp" and "tos" match support'
1242 depends on NETFILTER_ADVANCED
1243 help
1244 This option adds a `DSCP' match, which allows you to match against
1245 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1246
1247 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1248
1249 It will also add a "tos" match, which allows you to match packets
1250 based on the Type Of Service fields of the IPv4 packet (which share
1251 the same bits as DSCP).
1252
1253 To compile it as a module, choose M here. If unsure, say N.
1254
1255config NETFILTER_XT_MATCH_ECN
1256 tristate '"ecn" match support'
1257 depends on NETFILTER_ADVANCED
1258 ---help---
1259 This option adds an "ECN" match, which allows you to match against
1260 the IPv4 and TCP header ECN fields.
1261
1262 To compile it as a module, choose M here. If unsure, say N.
1263
1264config NETFILTER_XT_MATCH_ESP
1265 tristate '"esp" match support'
1266 depends on NETFILTER_ADVANCED
1267 help
1268 This match extension allows you to match a range of SPIs
1269 inside ESP header of IPSec packets.
1270
1271 To compile it as a module, choose M here. If unsure, say N.
1272
1273config NETFILTER_XT_MATCH_HASHLIMIT
1274 tristate '"hashlimit" match support'
1275 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1276 depends on NETFILTER_ADVANCED
1277 help
1278 This option adds a `hashlimit' match.
1279
1280 As opposed to `limit', this match dynamically creates a hash table
1281 of limit buckets, based on your selection of source/destination
1282 addresses and/or ports.
1283
1284 It enables you to express policies like `10kpps for any given
1285 destination address' or `500pps from any given source address'
1286 with a single rule.
1287
1288config NETFILTER_XT_MATCH_HELPER
1289 tristate '"helper" match support'
1290 depends on NF_CONNTRACK
1291 depends on NETFILTER_ADVANCED
1292 help
1293 Helper matching allows you to match packets in dynamic connections
1294 tracked by a conntrack-helper, ie. ip_conntrack_ftp
1295
1296 To compile it as a module, choose M here. If unsure, say Y.
1297
1298config NETFILTER_XT_MATCH_HL
1299 tristate '"hl" hoplimit/TTL match support'
1300 depends on NETFILTER_ADVANCED
1301 ---help---
1302 HL matching allows you to match packets based on the hoplimit
1303 in the IPv6 header, or the time-to-live field in the IPv4
1304 header of the packet.
1305
1306config NETFILTER_XT_MATCH_IPCOMP
1307 tristate '"ipcomp" match support'
1308 depends on NETFILTER_ADVANCED
1309 help
1310 This match extension allows you to match a range of CPIs(16 bits)
1311 inside IPComp header of IPSec packets.
1312
1313 To compile it as a module, choose M here. If unsure, say N.
1314
1315config NETFILTER_XT_MATCH_IPRANGE
1316 tristate '"iprange" address range match support'
1317 depends on NETFILTER_ADVANCED
1318 ---help---
1319 This option adds a "iprange" match, which allows you to match based on
1320 an IP address range. (Normal iptables only matches on single addresses
1321 with an optional mask.)
1322
1323 If unsure, say M.
1324
1325config NETFILTER_XT_MATCH_IPVS
1326 tristate '"ipvs" match support'
1327 depends on IP_VS
1328 depends on NETFILTER_ADVANCED
1329 depends on NF_CONNTRACK
1330 help
1331 This option allows you to match against IPVS properties of a packet.
1332
1333 If unsure, say N.
1334
1335config NETFILTER_XT_MATCH_L2TP
1336 tristate '"l2tp" match support'
1337 depends on NETFILTER_ADVANCED
1338 default L2TP
1339 ---help---
1340 This option adds an "L2TP" match, which allows you to match against
1341 L2TP protocol header fields.
1342
1343 To compile it as a module, choose M here. If unsure, say N.
1344
1345config NETFILTER_XT_MATCH_LENGTH
1346 tristate '"length" match support'
1347 depends on NETFILTER_ADVANCED
1348 help
1349 This option allows you to match the length of a packet against a
1350 specific value or range of values.
1351
1352 To compile it as a module, choose M here. If unsure, say N.
1353
1354config NETFILTER_XT_MATCH_LIMIT
1355 tristate '"limit" match support'
1356 depends on NETFILTER_ADVANCED
1357 help
1358 limit matching allows you to control the rate at which a rule can be
1359 matched: mainly useful in combination with the LOG target ("LOG
1360 target support", below) and to avoid some Denial of Service attacks.
1361
1362 To compile it as a module, choose M here. If unsure, say N.
1363
1364config NETFILTER_XT_MATCH_MAC
1365 tristate '"mac" address match support'
1366 depends on NETFILTER_ADVANCED
1367 help
1368 MAC matching allows you to match packets based on the source
1369 Ethernet address of the packet.
1370
1371 To compile it as a module, choose M here. If unsure, say N.
1372
1373config NETFILTER_XT_MATCH_MARK
1374 tristate '"mark" match support'
1375 depends on NETFILTER_ADVANCED
1376 select NETFILTER_XT_MARK
1377 ---help---
1378 This is a backwards-compat option for the user's convenience
1379 (e.g. when running oldconfig). It selects
1380 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1381
1382config NETFILTER_XT_MATCH_MULTIPORT
1383 tristate '"multiport" Multiple port match support'
1384 depends on NETFILTER_ADVANCED
1385 help
1386 Multiport matching allows you to match TCP or UDP packets based on
1387 a series of source or destination ports: normally a rule can only
1388 match a single range of ports.
1389
1390 To compile it as a module, choose M here. If unsure, say N.
1391
1392config NETFILTER_XT_MATCH_NFACCT
1393 tristate '"nfacct" match support'
1394 depends on NETFILTER_ADVANCED
1395 select NETFILTER_NETLINK_ACCT
1396 help
1397 This option allows you to use the extended accounting through
1398 nfnetlink_acct.
1399
1400 To compile it as a module, choose M here. If unsure, say N.
1401
1402config NETFILTER_XT_MATCH_OSF
1403 tristate '"osf" Passive OS fingerprint match'
1404 depends on NETFILTER_ADVANCED
1405 select NETFILTER_NETLINK_OSF
1406 help
1407 This option selects the Passive OS Fingerprinting match module
1408 that allows to passively match the remote operating system by
1409 analyzing incoming TCP SYN packets.
1410
1411 Rules and loading software can be downloaded from
1412 http://www.ioremap.net/projects/osf
1413
1414 To compile it as a module, choose M here. If unsure, say N.
1415
1416config NETFILTER_XT_MATCH_OWNER
1417 tristate '"owner" match support'
1418 depends on NETFILTER_ADVANCED
1419 ---help---
1420 Socket owner matching allows you to match locally-generated packets
1421 based on who created the socket: the user or group. It is also
1422 possible to check whether a socket actually exists.
1423
1424config NETFILTER_XT_MATCH_POLICY
1425 tristate 'IPsec "policy" match support'
1426 depends on XFRM
1427 default m if NETFILTER_ADVANCED=n
1428 help
1429 Policy matching allows you to match packets based on the
1430 IPsec policy that was used during decapsulation/will
1431 be used during encapsulation.
1432
1433 To compile it as a module, choose M here. If unsure, say N.
1434
1435config NETFILTER_XT_MATCH_PHYSDEV
1436 tristate '"physdev" match support'
1437 depends on BRIDGE && BRIDGE_NETFILTER
1438 depends on NETFILTER_ADVANCED
1439 help
1440 Physdev packet matching matches against the physical bridge ports
1441 the IP packet arrived on or will leave by.
1442
1443 To compile it as a module, choose M here. If unsure, say N.
1444
1445config NETFILTER_XT_MATCH_PKTTYPE
1446 tristate '"pkttype" packet type match support'
1447 depends on NETFILTER_ADVANCED
1448 help
1449 Packet type matching allows you to match a packet by
1450 its "class", eg. BROADCAST, MULTICAST, ...
1451
1452 Typical usage:
1453 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1454
1455 To compile it as a module, choose M here. If unsure, say N.
1456
1457config NETFILTER_XT_MATCH_QUOTA
1458 tristate '"quota" match support'
1459 depends on NETFILTER_ADVANCED
1460 help
1461 This option adds a `quota' match, which allows to match on a
1462 byte counter.
1463
1464 If you want to compile it as a module, say M here and read
1465 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1466
1467config NETFILTER_XT_MATCH_RATEEST
1468 tristate '"rateest" match support'
1469 depends on NETFILTER_ADVANCED
1470 select NETFILTER_XT_TARGET_RATEEST
1471 help
1472 This option adds a `rateest' match, which allows to match on the
1473 rate estimated by the RATEEST target.
1474
1475 To compile it as a module, choose M here. If unsure, say N.
1476
1477config NETFILTER_XT_MATCH_REALM
1478 tristate '"realm" match support'
1479 depends on NETFILTER_ADVANCED
1480 select IP_ROUTE_CLASSID
1481 help
1482 This option adds a `realm' match, which allows you to use the realm
1483 key from the routing subsystem inside iptables.
1484
1485 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1486 in tc world.
1487
1488 If you want to compile it as a module, say M here and read
1489 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1490
1491config NETFILTER_XT_MATCH_RECENT
1492 tristate '"recent" match support'
1493 depends on NETFILTER_ADVANCED
1494 ---help---
1495 This match is used for creating one or many lists of recently
1496 used addresses and then matching against that/those list(s).
1497
1498 Short options are available by using 'iptables -m recent -h'
1499 Official Website: <http://snowman.net/projects/ipt_recent/>
1500
1501config NETFILTER_XT_MATCH_SCTP
1502 tristate '"sctp" protocol match support'
1503 depends on NETFILTER_ADVANCED
1504 default IP_SCTP
1505 help
1506 With this option enabled, you will be able to use the
1507 `sctp' match in order to match on SCTP source/destination ports
1508 and SCTP chunk types.
1509
1510 If you want to compile it as a module, say M here and read
1511 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1512
1513config NETFILTER_XT_MATCH_SOCKET
1514 tristate '"socket" match support'
1515 depends on NETFILTER_XTABLES
1516 depends on NETFILTER_ADVANCED
1517 depends on IPV6 || IPV6=n
1518 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1519 select NF_SOCKET_IPV4
1520 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1521 select NF_DEFRAG_IPV4
1522 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1523 help
1524 This option adds a `socket' match, which can be used to match
1525 packets for which a TCP or UDP socket lookup finds a valid socket.
1526 It can be used in combination with the MARK target and policy
1527 routing to implement full featured non-locally bound sockets.
1528
1529 To compile it as a module, choose M here. If unsure, say N.
1530
1531config NETFILTER_XT_MATCH_STATE
1532 tristate '"state" match support'
1533 depends on NF_CONNTRACK
1534 default m if NETFILTER_ADVANCED=n
1535 help
1536 Connection state matching allows you to match packets based on their
1537 relationship to a tracked connection (ie. previous packets). This
1538 is a powerful tool for packet classification.
1539
1540 To compile it as a module, choose M here. If unsure, say N.
1541
1542config NETFILTER_XT_MATCH_STATISTIC
1543 tristate '"statistic" match support'
1544 depends on NETFILTER_ADVANCED
1545 help
1546 This option adds a `statistic' match, which allows you to match
1547 on packets periodically or randomly with a given percentage.
1548
1549 To compile it as a module, choose M here. If unsure, say N.
1550
1551config NETFILTER_XT_MATCH_STRING
1552 tristate '"string" match support'
1553 depends on NETFILTER_ADVANCED
1554 select TEXTSEARCH
1555 select TEXTSEARCH_KMP
1556 select TEXTSEARCH_BM
1557 select TEXTSEARCH_FSM
1558 help
1559 This option adds a `string' match, which allows you to look for
1560 pattern matchings in packets.
1561
1562 To compile it as a module, choose M here. If unsure, say N.
1563
1564config NETFILTER_XT_MATCH_TCPMSS
1565 tristate '"tcpmss" match support'
1566 depends on NETFILTER_ADVANCED
1567 help
1568 This option adds a `tcpmss' match, which allows you to examine the
1569 MSS value of TCP SYN packets, which control the maximum packet size
1570 for that connection.
1571
1572 To compile it as a module, choose M here. If unsure, say N.
1573
1574config NETFILTER_XT_MATCH_TIME
1575 tristate '"time" match support'
1576 depends on NETFILTER_ADVANCED
1577 ---help---
1578 This option adds a "time" match, which allows you to match based on
1579 the packet arrival time (at the machine which netfilter is running)
1580 on) or departure time/date (for locally generated packets).
1581
1582 If you say Y here, try `iptables -m time --help` for
1583 more information.
1584
1585 If you want to compile it as a module, say M here.
1586 If unsure, say N.
1587
1588config NETFILTER_XT_MATCH_U32
1589 tristate '"u32" match support'
1590 depends on NETFILTER_ADVANCED
1591 ---help---
1592 u32 allows you to extract quantities of up to 4 bytes from a packet,
1593 AND them with specified masks, shift them by specified amounts and
1594 test whether the results are in any of a set of specified ranges.
1595 The specification of what to extract is general enough to skip over
1596 headers with lengths stored in the packet, as in IP or TCP header
1597 lengths.
1598
1599 Details and examples are in the kernel module source.
1600
1601endif # NETFILTER_XTABLES
1602
1603endmenu
1604
1605source "net/netfilter/ipset/Kconfig"
1606
1607source "net/netfilter/ipvs/Kconfig"