Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1# SPDX-License-Identifier: GPL-2.0-only
2menu "Core Netfilter Configuration"
3 depends on NET && INET && NETFILTER
4
5config NETFILTER_INGRESS
6 bool "Netfilter ingress support"
7 default y
8 select NET_INGRESS
9 help
10 This allows you to classify packets from ingress using the Netfilter
11 infrastructure.
12
13config NETFILTER_NETLINK
14 tristate
15
16config NETFILTER_FAMILY_BRIDGE
17 bool
18
19config NETFILTER_FAMILY_ARP
20 bool
21
22config NETFILTER_NETLINK_ACCT
23 tristate "Netfilter NFACCT over NFNETLINK interface"
24 depends on NETFILTER_ADVANCED
25 select NETFILTER_NETLINK
26 help
27 If this option is enabled, the kernel will include support
28 for extended accounting via NFNETLINK.
29
30config NETFILTER_NETLINK_QUEUE
31 tristate "Netfilter NFQUEUE over NFNETLINK interface"
32 depends on NETFILTER_ADVANCED
33 select NETFILTER_NETLINK
34 help
35 If this option is enabled, the kernel will include support
36 for queueing packets via NFNETLINK.
37
38config NETFILTER_NETLINK_LOG
39 tristate "Netfilter LOG over NFNETLINK interface"
40 default m if NETFILTER_ADVANCED=n
41 select NETFILTER_NETLINK
42 help
43 If this option is enabled, the kernel will include support
44 for logging packets via NFNETLINK.
45
46 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
47 and is also scheduled to replace the old syslog-based ipt_LOG
48 and ip6t_LOG modules.
49
50config NETFILTER_NETLINK_OSF
51 tristate "Netfilter OSF over NFNETLINK interface"
52 depends on NETFILTER_ADVANCED
53 select NETFILTER_NETLINK
54 help
55 If this option is enabled, the kernel will include support
56 for passive OS fingerprint via NFNETLINK.
57
58config NF_CONNTRACK
59 tristate "Netfilter connection tracking support"
60 default m if NETFILTER_ADVANCED=n
61 select NF_DEFRAG_IPV4
62 select NF_DEFRAG_IPV6 if IPV6 != n
63 help
64 Connection tracking keeps a record of what packets have passed
65 through your machine, in order to figure out how they are related
66 into connections.
67
68 This is required to do Masquerading or other kinds of Network
69 Address Translation. It can also be used to enhance packet
70 filtering (see `Connection state match support' below).
71
72 To compile it as a module, choose M here. If unsure, say N.
73
74config NF_LOG_COMMON
75 tristate
76
77config NF_LOG_NETDEV
78 tristate "Netdev packet logging"
79 select NF_LOG_COMMON
80
81if NF_CONNTRACK
82config NETFILTER_CONNCOUNT
83 tristate
84
85config NF_CONNTRACK_MARK
86 bool 'Connection mark tracking support'
87 depends on NETFILTER_ADVANCED
88 help
89 This option enables support for connection marks, used by the
90 `CONNMARK' target and `connmark' match. Similar to the mark value
91 of packets, but this mark value is kept in the conntrack session
92 instead of the individual packets.
93
94config NF_CONNTRACK_SECMARK
95 bool 'Connection tracking security mark support'
96 depends on NETWORK_SECMARK
97 default m if NETFILTER_ADVANCED=n
98 help
99 This option enables security markings to be applied to
100 connections. Typically they are copied to connections from
101 packets using the CONNSECMARK target and copied back from
102 connections to packets with the same target, with the packets
103 being originally labeled via SECMARK.
104
105 If unsure, say 'N'.
106
107config NF_CONNTRACK_ZONES
108 bool 'Connection tracking zones'
109 depends on NETFILTER_ADVANCED
110 help
111 This option enables support for connection tracking zones.
112 Normally, each connection needs to have a unique system wide
113 identity. Connection tracking zones allow to have multiple
114 connections using the same identity, as long as they are
115 contained in different zones.
116
117 If unsure, say `N'.
118
119config NF_CONNTRACK_PROCFS
120 bool "Supply CT list in procfs (OBSOLETE)"
121 default y
122 depends on PROC_FS
123 help
124 This option enables for the list of known conntrack entries
125 to be shown in procfs under net/netfilter/nf_conntrack. This
126 is considered obsolete in favor of using the conntrack(8)
127 tool which uses Netlink.
128
129config NF_CONNTRACK_EVENTS
130 bool "Connection tracking events"
131 depends on NETFILTER_ADVANCED
132 help
133 If this option is enabled, the connection tracking code will
134 provide a notifier chain that can be used by other kernel code
135 to get notified about changes in the connection tracking state.
136
137 If unsure, say `N'.
138
139config NF_CONNTRACK_TIMEOUT
140 bool 'Connection tracking timeout'
141 depends on NETFILTER_ADVANCED
142 help
143 This option enables support for connection tracking timeout
144 extension. This allows you to attach timeout policies to flow
145 via the CT target.
146
147 If unsure, say `N'.
148
149config NF_CONNTRACK_TIMESTAMP
150 bool 'Connection tracking timestamping'
151 depends on NETFILTER_ADVANCED
152 help
153 This option enables support for connection tracking timestamping.
154 This allows you to store the flow start-time and to obtain
155 the flow-stop time (once it has been destroyed) via Connection
156 tracking events.
157
158 If unsure, say `N'.
159
160config NF_CONNTRACK_LABELS
161 bool "Connection tracking labels"
162 help
163 This option enables support for assigning user-defined flag bits
164 to connection tracking entries. It can be used with xtables connlabel
165 match and the nftables ct expression.
166
167config NF_CT_PROTO_DCCP
168 bool 'DCCP protocol connection tracking support'
169 depends on NETFILTER_ADVANCED
170 default y
171 help
172 With this option enabled, the layer 3 independent connection
173 tracking code will be able to do state tracking on DCCP connections.
174
175 If unsure, say Y.
176
177config NF_CT_PROTO_GRE
178 bool
179
180config NF_CT_PROTO_SCTP
181 bool 'SCTP protocol connection tracking support'
182 depends on NETFILTER_ADVANCED
183 default y
184 select LIBCRC32C
185 help
186 With this option enabled, the layer 3 independent connection
187 tracking code will be able to do state tracking on SCTP connections.
188
189 If unsure, say Y.
190
191config NF_CT_PROTO_UDPLITE
192 bool 'UDP-Lite protocol connection tracking support'
193 depends on NETFILTER_ADVANCED
194 default y
195 help
196 With this option enabled, the layer 3 independent connection
197 tracking code will be able to do state tracking on UDP-Lite
198 connections.
199
200 If unsure, say Y.
201
202config NF_CONNTRACK_AMANDA
203 tristate "Amanda backup protocol support"
204 depends on NETFILTER_ADVANCED
205 select TEXTSEARCH
206 select TEXTSEARCH_KMP
207 help
208 If you are running the Amanda backup package <http://www.amanda.org/>
209 on this machine or machines that will be MASQUERADED through this
210 machine, then you may want to enable this feature. This allows the
211 connection tracking and natting code to allow the sub-channels that
212 Amanda requires for communication of the backup data, messages and
213 index.
214
215 To compile it as a module, choose M here. If unsure, say N.
216
217config NF_CONNTRACK_FTP
218 tristate "FTP protocol support"
219 default m if NETFILTER_ADVANCED=n
220 help
221 Tracking FTP connections is problematic: special helpers are
222 required for tracking them, and doing masquerading and other forms
223 of Network Address Translation on them.
224
225 This is FTP support on Layer 3 independent connection tracking.
226
227 To compile it as a module, choose M here. If unsure, say N.
228
229config NF_CONNTRACK_H323
230 tristate "H.323 protocol support"
231 depends on IPV6 || IPV6=n
232 depends on NETFILTER_ADVANCED
233 help
234 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
235 important VoIP protocols, it is widely used by voice hardware and
236 software including voice gateways, IP phones, Netmeeting, OpenPhone,
237 Gnomemeeting, etc.
238
239 With this module you can support H.323 on a connection tracking/NAT
240 firewall.
241
242 This module supports RAS, Fast Start, H.245 Tunnelling, Call
243 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
244 whiteboard, file transfer, etc. For more information, please
245 visit http://nath323.sourceforge.net/.
246
247 To compile it as a module, choose M here. If unsure, say N.
248
249config NF_CONNTRACK_IRC
250 tristate "IRC protocol support"
251 default m if NETFILTER_ADVANCED=n
252 help
253 There is a commonly-used extension to IRC called
254 Direct Client-to-Client Protocol (DCC). This enables users to send
255 files to each other, and also chat to each other without the need
256 of a server. DCC Sending is used anywhere you send files over IRC,
257 and DCC Chat is most commonly used by Eggdrop bots. If you are
258 using NAT, this extension will enable you to send files and initiate
259 chats. Note that you do NOT need this extension to get files or
260 have others initiate chats, or everything else in IRC.
261
262 To compile it as a module, choose M here. If unsure, say N.
263
264config NF_CONNTRACK_BROADCAST
265 tristate
266
267config NF_CONNTRACK_NETBIOS_NS
268 tristate "NetBIOS name service protocol support"
269 select NF_CONNTRACK_BROADCAST
270 help
271 NetBIOS name service requests are sent as broadcast messages from an
272 unprivileged port and responded to with unicast messages to the
273 same port. This make them hard to firewall properly because connection
274 tracking doesn't deal with broadcasts. This helper tracks locally
275 originating NetBIOS name service requests and the corresponding
276 responses. It relies on correct IP address configuration, specifically
277 netmask and broadcast address. When properly configured, the output
278 of "ip address show" should look similar to this:
279
280 $ ip -4 address show eth0
281 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
282 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
283
284 To compile it as a module, choose M here. If unsure, say N.
285
286config NF_CONNTRACK_SNMP
287 tristate "SNMP service protocol support"
288 depends on NETFILTER_ADVANCED
289 select NF_CONNTRACK_BROADCAST
290 help
291 SNMP service requests are sent as broadcast messages from an
292 unprivileged port and responded to with unicast messages to the
293 same port. This make them hard to firewall properly because connection
294 tracking doesn't deal with broadcasts. This helper tracks locally
295 originating SNMP service requests and the corresponding
296 responses. It relies on correct IP address configuration, specifically
297 netmask and broadcast address.
298
299 To compile it as a module, choose M here. If unsure, say N.
300
301config NF_CONNTRACK_PPTP
302 tristate "PPtP protocol support"
303 depends on NETFILTER_ADVANCED
304 select NF_CT_PROTO_GRE
305 help
306 This module adds support for PPTP (Point to Point Tunnelling
307 Protocol, RFC2637) connection tracking and NAT.
308
309 If you are running PPTP sessions over a stateful firewall or NAT
310 box, you may want to enable this feature.
311
312 Please note that not all PPTP modes of operation are supported yet.
313 Specifically these limitations exist:
314 - Blindly assumes that control connections are always established
315 in PNS->PAC direction. This is a violation of RFC2637.
316 - Only supports a single call within each session
317
318 To compile it as a module, choose M here. If unsure, say N.
319
320config NF_CONNTRACK_SANE
321 tristate "SANE protocol support"
322 depends on NETFILTER_ADVANCED
323 help
324 SANE is a protocol for remote access to scanners as implemented
325 by the 'saned' daemon. Like FTP, it uses separate control and
326 data connections.
327
328 With this module you can support SANE on a connection tracking
329 firewall.
330
331 To compile it as a module, choose M here. If unsure, say N.
332
333config NF_CONNTRACK_SIP
334 tristate "SIP protocol support"
335 default m if NETFILTER_ADVANCED=n
336 help
337 SIP is an application-layer control protocol that can establish,
338 modify, and terminate multimedia sessions (conferences) such as
339 Internet telephony calls. With the nf_conntrack_sip and
340 the nf_nat_sip modules you can support the protocol on a connection
341 tracking/NATing firewall.
342
343 To compile it as a module, choose M here. If unsure, say N.
344
345config NF_CONNTRACK_TFTP
346 tristate "TFTP protocol support"
347 depends on NETFILTER_ADVANCED
348 help
349 TFTP connection tracking helper, this is required depending
350 on how restrictive your ruleset is.
351 If you are using a tftp client behind -j SNAT or -j MASQUERADING
352 you will need this.
353
354 To compile it as a module, choose M here. If unsure, say N.
355
356config NF_CT_NETLINK
357 tristate 'Connection tracking netlink interface'
358 select NETFILTER_NETLINK
359 default m if NETFILTER_ADVANCED=n
360 help
361 This option enables support for a netlink-based userspace interface
362
363config NF_CT_NETLINK_TIMEOUT
364 tristate 'Connection tracking timeout tuning via Netlink'
365 select NETFILTER_NETLINK
366 depends on NETFILTER_ADVANCED
367 depends on NF_CONNTRACK_TIMEOUT
368 help
369 This option enables support for connection tracking timeout
370 fine-grain tuning. This allows you to attach specific timeout
371 policies to flows, instead of using the global timeout policy.
372
373 If unsure, say `N'.
374
375config NF_CT_NETLINK_HELPER
376 tristate 'Connection tracking helpers in user-space via Netlink'
377 select NETFILTER_NETLINK
378 depends on NF_CT_NETLINK
379 depends on NETFILTER_NETLINK_QUEUE
380 depends on NETFILTER_NETLINK_GLUE_CT
381 depends on NETFILTER_ADVANCED
382 help
383 This option enables the user-space connection tracking helpers
384 infrastructure.
385
386 If unsure, say `N'.
387
388config NETFILTER_NETLINK_GLUE_CT
389 bool "NFQUEUE and NFLOG integration with Connection Tracking"
390 default n
391 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
392 help
393 If this option is enabled, NFQUEUE and NFLOG can include
394 Connection Tracking information together with the packet is
395 the enqueued via NFNETLINK.
396
397config NF_NAT
398 tristate "Network Address Translation support"
399 depends on NF_CONNTRACK
400 default m if NETFILTER_ADVANCED=n
401 help
402 The NAT option allows masquerading, port forwarding and other
403 forms of full Network Address Port Translation. This can be
404 controlled by iptables, ip6tables or nft.
405
406config NF_NAT_AMANDA
407 tristate
408 depends on NF_CONNTRACK && NF_NAT
409 default NF_NAT && NF_CONNTRACK_AMANDA
410
411config NF_NAT_FTP
412 tristate
413 depends on NF_CONNTRACK && NF_NAT
414 default NF_NAT && NF_CONNTRACK_FTP
415
416config NF_NAT_IRC
417 tristate
418 depends on NF_CONNTRACK && NF_NAT
419 default NF_NAT && NF_CONNTRACK_IRC
420
421config NF_NAT_SIP
422 tristate
423 depends on NF_CONNTRACK && NF_NAT
424 default NF_NAT && NF_CONNTRACK_SIP
425
426config NF_NAT_TFTP
427 tristate
428 depends on NF_CONNTRACK && NF_NAT
429 default NF_NAT && NF_CONNTRACK_TFTP
430
431config NF_NAT_REDIRECT
432 bool
433
434config NF_NAT_MASQUERADE
435 bool
436
437config NETFILTER_SYNPROXY
438 tristate
439
440endif # NF_CONNTRACK
441
442config NF_TABLES
443 select NETFILTER_NETLINK
444 select LIBCRC32C
445 tristate "Netfilter nf_tables support"
446 help
447 nftables is the new packet classification framework that intends to
448 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
449 provides a pseudo-state machine with an extensible instruction-set
450 (also known as expressions) that the userspace 'nft' utility
451 (https://www.netfilter.org/projects/nftables) uses to build the
452 rule-set. It also comes with the generic set infrastructure that
453 allows you to construct mappings between matchings and actions
454 for performance lookups.
455
456 To compile it as a module, choose M here.
457
458if NF_TABLES
459config NF_TABLES_INET
460 depends on IPV6
461 select NF_TABLES_IPV4
462 select NF_TABLES_IPV6
463 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
464 help
465 This option enables support for a mixed IPv4/IPv6 "inet" table.
466
467config NF_TABLES_NETDEV
468 bool "Netfilter nf_tables netdev tables support"
469 help
470 This option enables support for the "netdev" table.
471
472config NFT_NUMGEN
473 tristate "Netfilter nf_tables number generator module"
474 help
475 This option adds the number generator expression used to perform
476 incremental counting and random numbers bound to a upper limit.
477
478config NFT_CT
479 depends on NF_CONNTRACK
480 tristate "Netfilter nf_tables conntrack module"
481 help
482 This option adds the "ct" expression that you can use to match
483 connection tracking information such as the flow state.
484
485config NFT_FLOW_OFFLOAD
486 depends on NF_CONNTRACK && NF_FLOW_TABLE
487 tristate "Netfilter nf_tables hardware flow offload module"
488 help
489 This option adds the "flow_offload" expression that you can use to
490 choose what flows are placed into the hardware.
491
492config NFT_COUNTER
493 tristate "Netfilter nf_tables counter module"
494 help
495 This option adds the "counter" expression that you can use to
496 include packet and byte counters in a rule.
497
498config NFT_CONNLIMIT
499 tristate "Netfilter nf_tables connlimit module"
500 depends on NF_CONNTRACK
501 depends on NETFILTER_ADVANCED
502 select NETFILTER_CONNCOUNT
503 help
504 This option adds the "connlimit" expression that you can use to
505 ratelimit rule matchings per connections.
506
507config NFT_LOG
508 tristate "Netfilter nf_tables log module"
509 help
510 This option adds the "log" expression that you can use to log
511 packets matching some criteria.
512
513config NFT_LIMIT
514 tristate "Netfilter nf_tables limit module"
515 help
516 This option adds the "limit" expression that you can use to
517 ratelimit rule matchings.
518
519config NFT_MASQ
520 depends on NF_CONNTRACK
521 depends on NF_NAT
522 select NF_NAT_MASQUERADE
523 tristate "Netfilter nf_tables masquerade support"
524 help
525 This option adds the "masquerade" expression that you can use
526 to perform NAT in the masquerade flavour.
527
528config NFT_REDIR
529 depends on NF_CONNTRACK
530 depends on NF_NAT
531 tristate "Netfilter nf_tables redirect support"
532 select NF_NAT_REDIRECT
533 help
534 This options adds the "redirect" expression that you can use
535 to perform NAT in the redirect flavour.
536
537config NFT_NAT
538 depends on NF_CONNTRACK
539 select NF_NAT
540 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
541 tristate "Netfilter nf_tables nat module"
542 help
543 This option adds the "nat" expression that you can use to perform
544 typical Network Address Translation (NAT) packet transformations.
545
546config NFT_TUNNEL
547 tristate "Netfilter nf_tables tunnel module"
548 help
549 This option adds the "tunnel" expression that you can use to set
550 tunneling policies.
551
552config NFT_OBJREF
553 tristate "Netfilter nf_tables stateful object reference module"
554 help
555 This option adds the "objref" expression that allows you to refer to
556 stateful objects, such as counters and quotas.
557
558config NFT_QUEUE
559 depends on NETFILTER_NETLINK_QUEUE
560 tristate "Netfilter nf_tables queue module"
561 help
562 This is required if you intend to use the userspace queueing
563 infrastructure (also known as NFQUEUE) from nftables.
564
565config NFT_QUOTA
566 tristate "Netfilter nf_tables quota module"
567 help
568 This option adds the "quota" expression that you can use to match
569 enforce bytes quotas.
570
571config NFT_REJECT
572 default m if NETFILTER_ADVANCED=n
573 tristate "Netfilter nf_tables reject support"
574 depends on !NF_TABLES_INET || (IPV6!=m || m)
575 help
576 This option adds the "reject" expression that you can use to
577 explicitly deny and notify via TCP reset/ICMP informational errors
578 unallowed traffic.
579
580config NFT_REJECT_INET
581 depends on NF_TABLES_INET
582 default NFT_REJECT
583 tristate
584
585config NFT_COMPAT
586 depends on NETFILTER_XTABLES
587 tristate "Netfilter x_tables over nf_tables module"
588 help
589 This is required if you intend to use any of existing
590 x_tables match/target extensions over the nf_tables
591 framework.
592
593config NFT_HASH
594 tristate "Netfilter nf_tables hash module"
595 help
596 This option adds the "hash" expression that you can use to perform
597 a hash operation on registers.
598
599config NFT_FIB
600 tristate
601
602config NFT_FIB_INET
603 depends on NF_TABLES_INET
604 depends on NFT_FIB_IPV4
605 depends on NFT_FIB_IPV6
606 tristate "Netfilter nf_tables fib inet support"
607 help
608 This option allows using the FIB expression from the inet table.
609 The lookup will be delegated to the IPv4 or IPv6 FIB depending
610 on the protocol of the packet.
611
612config NFT_XFRM
613 tristate "Netfilter nf_tables xfrm/IPSec security association matching"
614 depends on XFRM
615 help
616 This option adds an expression that you can use to extract properties
617 of a packets security association.
618
619config NFT_SOCKET
620 tristate "Netfilter nf_tables socket match support"
621 depends on IPV6 || IPV6=n
622 select NF_SOCKET_IPV4
623 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
624 help
625 This option allows matching for the presence or absence of a
626 corresponding socket and its attributes.
627
628config NFT_OSF
629 tristate "Netfilter nf_tables passive OS fingerprint support"
630 depends on NETFILTER_ADVANCED
631 select NETFILTER_NETLINK_OSF
632 help
633 This option allows matching packets from an specific OS.
634
635config NFT_TPROXY
636 tristate "Netfilter nf_tables tproxy support"
637 depends on IPV6 || IPV6=n
638 select NF_DEFRAG_IPV4
639 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
640 select NF_TPROXY_IPV4
641 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
642 help
643 This makes transparent proxy support available in nftables.
644
645config NFT_SYNPROXY
646 tristate "Netfilter nf_tables SYNPROXY expression support"
647 depends on NF_CONNTRACK && NETFILTER_ADVANCED
648 select NETFILTER_SYNPROXY
649 select SYN_COOKIES
650 help
651 The SYNPROXY expression allows you to intercept TCP connections and
652 establish them using syncookies before they are passed on to the
653 server. This allows to avoid conntrack and server resource usage
654 during SYN-flood attacks.
655
656if NF_TABLES_NETDEV
657
658config NF_DUP_NETDEV
659 tristate "Netfilter packet duplication support"
660 help
661 This option enables the generic packet duplication infrastructure
662 for Netfilter.
663
664config NFT_DUP_NETDEV
665 tristate "Netfilter nf_tables netdev packet duplication support"
666 select NF_DUP_NETDEV
667 help
668 This option enables packet duplication for the "netdev" family.
669
670config NFT_FWD_NETDEV
671 tristate "Netfilter nf_tables netdev packet forwarding support"
672 select NF_DUP_NETDEV
673 help
674 This option enables packet forwarding for the "netdev" family.
675
676config NFT_FIB_NETDEV
677 depends on NFT_FIB_IPV4
678 depends on NFT_FIB_IPV6
679 tristate "Netfilter nf_tables netdev fib lookups support"
680 help
681 This option allows using the FIB expression from the netdev table.
682 The lookup will be delegated to the IPv4 or IPv6 FIB depending
683 on the protocol of the packet.
684
685config NFT_REJECT_NETDEV
686 depends on NFT_REJECT_IPV4
687 depends on NFT_REJECT_IPV6
688 tristate "Netfilter nf_tables netdev REJECT support"
689 help
690 This option enables the REJECT support from the netdev table.
691 The return packet generation will be delegated to the IPv4
692 or IPv6 ICMP or TCP RST implementation depending on the
693 protocol of the packet.
694
695endif # NF_TABLES_NETDEV
696
697endif # NF_TABLES
698
699config NF_FLOW_TABLE_INET
700 tristate "Netfilter flow table mixed IPv4/IPv6 module"
701 depends on NF_FLOW_TABLE
702 help
703 This option adds the flow table mixed IPv4/IPv6 support.
704
705 To compile it as a module, choose M here.
706
707config NF_FLOW_TABLE
708 tristate "Netfilter flow table module"
709 depends on NETFILTER_INGRESS
710 depends on NF_CONNTRACK
711 depends on NF_TABLES
712 help
713 This option adds the flow table core infrastructure.
714
715 To compile it as a module, choose M here.
716
717config NETFILTER_XTABLES
718 tristate "Netfilter Xtables support (required for ip_tables)"
719 default m if NETFILTER_ADVANCED=n
720 help
721 This is required if you intend to use any of ip_tables,
722 ip6_tables or arp_tables.
723
724if NETFILTER_XTABLES
725
726comment "Xtables combined modules"
727
728config NETFILTER_XT_MARK
729 tristate 'nfmark target and match support'
730 default m if NETFILTER_ADVANCED=n
731 help
732 This option adds the "MARK" target and "mark" match.
733
734 Netfilter mark matching allows you to match packets based on the
735 "nfmark" value in the packet.
736 The target allows you to create rules in the "mangle" table which alter
737 the netfilter mark (nfmark) field associated with the packet.
738
739 Prior to routing, the nfmark can influence the routing method and can
740 also be used by other subsystems to change their behavior.
741
742config NETFILTER_XT_CONNMARK
743 tristate 'ctmark target and match support'
744 depends on NF_CONNTRACK
745 depends on NETFILTER_ADVANCED
746 select NF_CONNTRACK_MARK
747 help
748 This option adds the "CONNMARK" target and "connmark" match.
749
750 Netfilter allows you to store a mark value per connection (a.k.a.
751 ctmark), similarly to the packet mark (nfmark). Using this
752 target and match, you can set and match on this mark.
753
754config NETFILTER_XT_SET
755 tristate 'set target and match support'
756 depends on IP_SET
757 depends on NETFILTER_ADVANCED
758 help
759 This option adds the "SET" target and "set" match.
760
761 Using this target and match, you can add/delete and match
762 elements in the sets created by ipset(8).
763
764 To compile it as a module, choose M here. If unsure, say N.
765
766# alphabetically ordered list of targets
767
768comment "Xtables targets"
769
770config NETFILTER_XT_TARGET_AUDIT
771 tristate "AUDIT target support"
772 depends on AUDIT
773 depends on NETFILTER_ADVANCED
774 help
775 This option adds a 'AUDIT' target, which can be used to create
776 audit records for packets dropped/accepted.
777
778 To compileit as a module, choose M here. If unsure, say N.
779
780config NETFILTER_XT_TARGET_CHECKSUM
781 tristate "CHECKSUM target support"
782 depends on IP_NF_MANGLE || IP6_NF_MANGLE
783 depends on NETFILTER_ADVANCED
784 help
785 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
786 table to work around buggy DHCP clients in virtualized environments.
787
788 Some old DHCP clients drop packets because they are not aware
789 that the checksum would normally be offloaded to hardware and
790 thus should be considered valid.
791 This target can be used to fill in the checksum using iptables
792 when such packets are sent via a virtual network device.
793
794 To compile it as a module, choose M here. If unsure, say N.
795
796config NETFILTER_XT_TARGET_CLASSIFY
797 tristate '"CLASSIFY" target support'
798 depends on NETFILTER_ADVANCED
799 help
800 This option adds a `CLASSIFY' target, which enables the user to set
801 the priority of a packet. Some qdiscs can use this value for
802 classification, among these are:
803
804 atm, cbq, dsmark, pfifo_fast, htb, prio
805
806 To compile it as a module, choose M here. If unsure, say N.
807
808config NETFILTER_XT_TARGET_CONNMARK
809 tristate '"CONNMARK" target support'
810 depends on NF_CONNTRACK
811 depends on NETFILTER_ADVANCED
812 select NETFILTER_XT_CONNMARK
813 help
814 This is a backwards-compat option for the user's convenience
815 (e.g. when running oldconfig). It selects
816 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
817
818config NETFILTER_XT_TARGET_CONNSECMARK
819 tristate '"CONNSECMARK" target support'
820 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
821 default m if NETFILTER_ADVANCED=n
822 help
823 The CONNSECMARK target copies security markings from packets
824 to connections, and restores security markings from connections
825 to packets (if the packets are not already marked). This would
826 normally be used in conjunction with the SECMARK target.
827
828 To compile it as a module, choose M here. If unsure, say N.
829
830config NETFILTER_XT_TARGET_CT
831 tristate '"CT" target support'
832 depends on NF_CONNTRACK
833 depends on IP_NF_RAW || IP6_NF_RAW
834 depends on NETFILTER_ADVANCED
835 help
836 This options adds a `CT' target, which allows to specify initial
837 connection tracking parameters like events to be delivered and
838 the helper to be used.
839
840 To compile it as a module, choose M here. If unsure, say N.
841
842config NETFILTER_XT_TARGET_DSCP
843 tristate '"DSCP" and "TOS" target support'
844 depends on IP_NF_MANGLE || IP6_NF_MANGLE
845 depends on NETFILTER_ADVANCED
846 help
847 This option adds a `DSCP' target, which allows you to manipulate
848 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
849
850 The DSCP field can have any value between 0x0 and 0x3f inclusive.
851
852 It also adds the "TOS" target, which allows you to create rules in
853 the "mangle" table which alter the Type Of Service field of an IPv4
854 or the Priority field of an IPv6 packet, prior to routing.
855
856 To compile it as a module, choose M here. If unsure, say N.
857
858config NETFILTER_XT_TARGET_HL
859 tristate '"HL" hoplimit target support'
860 depends on IP_NF_MANGLE || IP6_NF_MANGLE
861 depends on NETFILTER_ADVANCED
862 help
863 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
864 targets, which enable the user to change the
865 hoplimit/time-to-live value of the IP header.
866
867 While it is safe to decrement the hoplimit/TTL value, the
868 modules also allow to increment and set the hoplimit value of
869 the header to arbitrary values. This is EXTREMELY DANGEROUS
870 since you can easily create immortal packets that loop
871 forever on the network.
872
873config NETFILTER_XT_TARGET_HMARK
874 tristate '"HMARK" target support'
875 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
876 depends on NETFILTER_ADVANCED
877 help
878 This option adds the "HMARK" target.
879
880 The target allows you to create rules in the "raw" and "mangle" tables
881 which set the skbuff mark by means of hash calculation within a given
882 range. The nfmark can influence the routing method and can also be used
883 by other subsystems to change their behaviour.
884
885 To compile it as a module, choose M here. If unsure, say N.
886
887config NETFILTER_XT_TARGET_IDLETIMER
888 tristate "IDLETIMER target support"
889 depends on NETFILTER_ADVANCED
890 help
891
892 This option adds the `IDLETIMER' target. Each matching packet
893 resets the timer associated with label specified when the rule is
894 added. When the timer expires, it triggers a sysfs notification.
895 The remaining time for expiration can be read via sysfs.
896
897 To compile it as a module, choose M here. If unsure, say N.
898
899config NETFILTER_XT_TARGET_LED
900 tristate '"LED" target support'
901 depends on LEDS_CLASS && LEDS_TRIGGERS
902 depends on NETFILTER_ADVANCED
903 help
904 This option adds a `LED' target, which allows you to blink LEDs in
905 response to particular packets passing through your machine.
906
907 This can be used to turn a spare LED into a network activity LED,
908 which only flashes in response to FTP transfers, for example. Or
909 you could have an LED which lights up for a minute or two every time
910 somebody connects to your machine via SSH.
911
912 You will need support for the "led" class to make this work.
913
914 To create an LED trigger for incoming SSH traffic:
915 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
916
917 Then attach the new trigger to an LED on your system:
918 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
919
920 For more information on the LEDs available on your system, see
921 Documentation/leds/leds-class.rst
922
923config NETFILTER_XT_TARGET_LOG
924 tristate "LOG target support"
925 select NF_LOG_COMMON
926 select NF_LOG_IPV4
927 select NF_LOG_IPV6 if IP6_NF_IPTABLES
928 default m if NETFILTER_ADVANCED=n
929 help
930 This option adds a `LOG' target, which allows you to create rules in
931 any iptables table which records the packet header to the syslog.
932
933 To compile it as a module, choose M here. If unsure, say N.
934
935config NETFILTER_XT_TARGET_MARK
936 tristate '"MARK" target support'
937 depends on NETFILTER_ADVANCED
938 select NETFILTER_XT_MARK
939 help
940 This is a backwards-compat option for the user's convenience
941 (e.g. when running oldconfig). It selects
942 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
943
944config NETFILTER_XT_NAT
945 tristate '"SNAT and DNAT" targets support'
946 depends on NF_NAT
947 help
948 This option enables the SNAT and DNAT targets.
949
950 To compile it as a module, choose M here. If unsure, say N.
951
952config NETFILTER_XT_TARGET_NETMAP
953 tristate '"NETMAP" target support'
954 depends on NF_NAT
955 help
956 NETMAP is an implementation of static 1:1 NAT mapping of network
957 addresses. It maps the network address part, while keeping the host
958 address part intact.
959
960 To compile it as a module, choose M here. If unsure, say N.
961
962config NETFILTER_XT_TARGET_NFLOG
963 tristate '"NFLOG" target support'
964 default m if NETFILTER_ADVANCED=n
965 select NETFILTER_NETLINK_LOG
966 help
967 This option enables the NFLOG target, which allows to LOG
968 messages through nfnetlink_log.
969
970 To compile it as a module, choose M here. If unsure, say N.
971
972config NETFILTER_XT_TARGET_NFQUEUE
973 tristate '"NFQUEUE" target Support'
974 depends on NETFILTER_ADVANCED
975 select NETFILTER_NETLINK_QUEUE
976 help
977 This target replaced the old obsolete QUEUE target.
978
979 As opposed to QUEUE, it supports 65535 different queues,
980 not just one.
981
982 To compile it as a module, choose M here. If unsure, say N.
983
984config NETFILTER_XT_TARGET_NOTRACK
985 tristate '"NOTRACK" target support (DEPRECATED)'
986 depends on NF_CONNTRACK
987 depends on IP_NF_RAW || IP6_NF_RAW
988 depends on NETFILTER_ADVANCED
989 select NETFILTER_XT_TARGET_CT
990
991config NETFILTER_XT_TARGET_RATEEST
992 tristate '"RATEEST" target support'
993 depends on NETFILTER_ADVANCED
994 help
995 This option adds a `RATEEST' target, which allows to measure
996 rates similar to TC estimators. The `rateest' match can be
997 used to match on the measured rates.
998
999 To compile it as a module, choose M here. If unsure, say N.
1000
1001config NETFILTER_XT_TARGET_REDIRECT
1002 tristate "REDIRECT target support"
1003 depends on NF_NAT
1004 select NF_NAT_REDIRECT
1005 help
1006 REDIRECT is a special case of NAT: all incoming connections are
1007 mapped onto the incoming interface's address, causing the packets to
1008 come to the local machine instead of passing through. This is
1009 useful for transparent proxies.
1010
1011 To compile it as a module, choose M here. If unsure, say N.
1012
1013config NETFILTER_XT_TARGET_MASQUERADE
1014 tristate "MASQUERADE target support"
1015 depends on NF_NAT
1016 default m if NETFILTER_ADVANCED=n
1017 select NF_NAT_MASQUERADE
1018 help
1019 Masquerading is a special case of NAT: all outgoing connections are
1020 changed to seem to come from a particular interface's address, and
1021 if the interface goes down, those connections are lost. This is
1022 only useful for dialup accounts with dynamic IP address (ie. your IP
1023 address will be different on next dialup).
1024
1025 To compile it as a module, choose M here. If unsure, say N.
1026
1027config NETFILTER_XT_TARGET_TEE
1028 tristate '"TEE" - packet cloning to alternate destination'
1029 depends on NETFILTER_ADVANCED
1030 depends on IPV6 || IPV6=n
1031 depends on !NF_CONNTRACK || NF_CONNTRACK
1032 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1033 select NF_DUP_IPV4
1034 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1035 help
1036 This option adds a "TEE" target with which a packet can be cloned and
1037 this clone be rerouted to another nexthop.
1038
1039config NETFILTER_XT_TARGET_TPROXY
1040 tristate '"TPROXY" target transparent proxying support'
1041 depends on NETFILTER_XTABLES
1042 depends on NETFILTER_ADVANCED
1043 depends on IPV6 || IPV6=n
1044 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1045 depends on IP_NF_MANGLE
1046 select NF_DEFRAG_IPV4
1047 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1048 select NF_TPROXY_IPV4
1049 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1050 help
1051 This option adds a `TPROXY' target, which is somewhat similar to
1052 REDIRECT. It can only be used in the mangle table and is useful
1053 to redirect traffic to a transparent proxy. It does _not_ depend
1054 on Netfilter connection tracking and NAT, unlike REDIRECT.
1055 For it to work you will have to configure certain iptables rules
1056 and use policy routing. For more information on how to set it up
1057 see Documentation/networking/tproxy.rst.
1058
1059 To compile it as a module, choose M here. If unsure, say N.
1060
1061config NETFILTER_XT_TARGET_TRACE
1062 tristate '"TRACE" target support'
1063 depends on IP_NF_RAW || IP6_NF_RAW
1064 depends on NETFILTER_ADVANCED
1065 help
1066 The TRACE target allows you to mark packets so that the kernel
1067 will log every rule which match the packets as those traverse
1068 the tables, chains, rules.
1069
1070 If you want to compile it as a module, say M here and read
1071 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1072
1073config NETFILTER_XT_TARGET_SECMARK
1074 tristate '"SECMARK" target support'
1075 depends on NETWORK_SECMARK
1076 default m if NETFILTER_ADVANCED=n
1077 help
1078 The SECMARK target allows security marking of network
1079 packets, for use with security subsystems.
1080
1081 To compile it as a module, choose M here. If unsure, say N.
1082
1083config NETFILTER_XT_TARGET_TCPMSS
1084 tristate '"TCPMSS" target support'
1085 depends on IPV6 || IPV6=n
1086 default m if NETFILTER_ADVANCED=n
1087 help
1088 This option adds a `TCPMSS' target, which allows you to alter the
1089 MSS value of TCP SYN packets, to control the maximum size for that
1090 connection (usually limiting it to your outgoing interface's MTU
1091 minus 40).
1092
1093 This is used to overcome criminally braindead ISPs or servers which
1094 block ICMP Fragmentation Needed packets. The symptoms of this
1095 problem are that everything works fine from your Linux
1096 firewall/router, but machines behind it can never exchange large
1097 packets:
1098 1) Web browsers connect, then hang with no data received.
1099 2) Small mail works fine, but large emails hang.
1100 3) ssh works fine, but scp hangs after initial handshaking.
1101
1102 Workaround: activate this option and add a rule to your firewall
1103 configuration like:
1104
1105 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1106 -j TCPMSS --clamp-mss-to-pmtu
1107
1108 To compile it as a module, choose M here. If unsure, say N.
1109
1110config NETFILTER_XT_TARGET_TCPOPTSTRIP
1111 tristate '"TCPOPTSTRIP" target support'
1112 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1113 depends on NETFILTER_ADVANCED
1114 help
1115 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1116 TCP options from TCP packets.
1117
1118# alphabetically ordered list of matches
1119
1120comment "Xtables matches"
1121
1122config NETFILTER_XT_MATCH_ADDRTYPE
1123 tristate '"addrtype" address type match support'
1124 default m if NETFILTER_ADVANCED=n
1125 help
1126 This option allows you to match what routing thinks of an address,
1127 eg. UNICAST, LOCAL, BROADCAST, ...
1128
1129 If you want to compile it as a module, say M here and read
1130 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1131
1132config NETFILTER_XT_MATCH_BPF
1133 tristate '"bpf" match support'
1134 depends on NETFILTER_ADVANCED
1135 help
1136 BPF matching applies a linux socket filter to each packet and
1137 accepts those for which the filter returns non-zero.
1138
1139 To compile it as a module, choose M here. If unsure, say N.
1140
1141config NETFILTER_XT_MATCH_CGROUP
1142 tristate '"control group" match support'
1143 depends on NETFILTER_ADVANCED
1144 depends on CGROUPS
1145 select CGROUP_NET_CLASSID
1146 help
1147 Socket/process control group matching allows you to match locally
1148 generated packets based on which net_cls control group processes
1149 belong to.
1150
1151config NETFILTER_XT_MATCH_CLUSTER
1152 tristate '"cluster" match support'
1153 depends on NF_CONNTRACK
1154 depends on NETFILTER_ADVANCED
1155 help
1156 This option allows you to build work-load-sharing clusters of
1157 network servers/stateful firewalls without having a dedicated
1158 load-balancing router/server/switch. Basically, this match returns
1159 true when the packet must be handled by this cluster node. Thus,
1160 all nodes see all packets and this match decides which node handles
1161 what packets. The work-load sharing algorithm is based on source
1162 address hashing.
1163
1164 If you say Y or M here, try `iptables -m cluster --help` for
1165 more information.
1166
1167config NETFILTER_XT_MATCH_COMMENT
1168 tristate '"comment" match support'
1169 depends on NETFILTER_ADVANCED
1170 help
1171 This option adds a `comment' dummy-match, which allows you to put
1172 comments in your iptables ruleset.
1173
1174 If you want to compile it as a module, say M here and read
1175 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1176
1177config NETFILTER_XT_MATCH_CONNBYTES
1178 tristate '"connbytes" per-connection counter match support'
1179 depends on NF_CONNTRACK
1180 depends on NETFILTER_ADVANCED
1181 help
1182 This option adds a `connbytes' match, which allows you to match the
1183 number of bytes and/or packets for each direction within a connection.
1184
1185 If you want to compile it as a module, say M here and read
1186 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1187
1188config NETFILTER_XT_MATCH_CONNLABEL
1189 tristate '"connlabel" match support'
1190 select NF_CONNTRACK_LABELS
1191 depends on NF_CONNTRACK
1192 depends on NETFILTER_ADVANCED
1193 help
1194 This match allows you to test and assign userspace-defined labels names
1195 to a connection. The kernel only stores bit values - mapping
1196 names to bits is done by userspace.
1197
1198 Unlike connmark, more than 32 flag bits may be assigned to a
1199 connection simultaneously.
1200
1201config NETFILTER_XT_MATCH_CONNLIMIT
1202 tristate '"connlimit" match support'
1203 depends on NF_CONNTRACK
1204 depends on NETFILTER_ADVANCED
1205 select NETFILTER_CONNCOUNT
1206 help
1207 This match allows you to match against the number of parallel
1208 connections to a server per client IP address (or address block).
1209
1210config NETFILTER_XT_MATCH_CONNMARK
1211 tristate '"connmark" connection mark match support'
1212 depends on NF_CONNTRACK
1213 depends on NETFILTER_ADVANCED
1214 select NETFILTER_XT_CONNMARK
1215 help
1216 This is a backwards-compat option for the user's convenience
1217 (e.g. when running oldconfig). It selects
1218 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1219
1220config NETFILTER_XT_MATCH_CONNTRACK
1221 tristate '"conntrack" connection tracking match support'
1222 depends on NF_CONNTRACK
1223 default m if NETFILTER_ADVANCED=n
1224 help
1225 This is a general conntrack match module, a superset of the state match.
1226
1227 It allows matching on additional conntrack information, which is
1228 useful in complex configurations, such as NAT gateways with multiple
1229 internet links or tunnels.
1230
1231 To compile it as a module, choose M here. If unsure, say N.
1232
1233config NETFILTER_XT_MATCH_CPU
1234 tristate '"cpu" match support'
1235 depends on NETFILTER_ADVANCED
1236 help
1237 CPU matching allows you to match packets based on the CPU
1238 currently handling the packet.
1239
1240 To compile it as a module, choose M here. If unsure, say N.
1241
1242config NETFILTER_XT_MATCH_DCCP
1243 tristate '"dccp" protocol match support'
1244 depends on NETFILTER_ADVANCED
1245 default IP_DCCP
1246 help
1247 With this option enabled, you will be able to use the iptables
1248 `dccp' match in order to match on DCCP source/destination ports
1249 and DCCP flags.
1250
1251 If you want to compile it as a module, say M here and read
1252 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1253
1254config NETFILTER_XT_MATCH_DEVGROUP
1255 tristate '"devgroup" match support'
1256 depends on NETFILTER_ADVANCED
1257 help
1258 This options adds a `devgroup' match, which allows to match on the
1259 device group a network device is assigned to.
1260
1261 To compile it as a module, choose M here. If unsure, say N.
1262
1263config NETFILTER_XT_MATCH_DSCP
1264 tristate '"dscp" and "tos" match support'
1265 depends on NETFILTER_ADVANCED
1266 help
1267 This option adds a `DSCP' match, which allows you to match against
1268 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1269
1270 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1271
1272 It will also add a "tos" match, which allows you to match packets
1273 based on the Type Of Service fields of the IPv4 packet (which share
1274 the same bits as DSCP).
1275
1276 To compile it as a module, choose M here. If unsure, say N.
1277
1278config NETFILTER_XT_MATCH_ECN
1279 tristate '"ecn" match support'
1280 depends on NETFILTER_ADVANCED
1281 help
1282 This option adds an "ECN" match, which allows you to match against
1283 the IPv4 and TCP header ECN fields.
1284
1285 To compile it as a module, choose M here. If unsure, say N.
1286
1287config NETFILTER_XT_MATCH_ESP
1288 tristate '"esp" match support'
1289 depends on NETFILTER_ADVANCED
1290 help
1291 This match extension allows you to match a range of SPIs
1292 inside ESP header of IPSec packets.
1293
1294 To compile it as a module, choose M here. If unsure, say N.
1295
1296config NETFILTER_XT_MATCH_HASHLIMIT
1297 tristate '"hashlimit" match support'
1298 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1299 depends on NETFILTER_ADVANCED
1300 help
1301 This option adds a `hashlimit' match.
1302
1303 As opposed to `limit', this match dynamically creates a hash table
1304 of limit buckets, based on your selection of source/destination
1305 addresses and/or ports.
1306
1307 It enables you to express policies like `10kpps for any given
1308 destination address' or `500pps from any given source address'
1309 with a single rule.
1310
1311config NETFILTER_XT_MATCH_HELPER
1312 tristate '"helper" match support'
1313 depends on NF_CONNTRACK
1314 depends on NETFILTER_ADVANCED
1315 help
1316 Helper matching allows you to match packets in dynamic connections
1317 tracked by a conntrack-helper, ie. nf_conntrack_ftp
1318
1319 To compile it as a module, choose M here. If unsure, say Y.
1320
1321config NETFILTER_XT_MATCH_HL
1322 tristate '"hl" hoplimit/TTL match support'
1323 depends on NETFILTER_ADVANCED
1324 help
1325 HL matching allows you to match packets based on the hoplimit
1326 in the IPv6 header, or the time-to-live field in the IPv4
1327 header of the packet.
1328
1329config NETFILTER_XT_MATCH_IPCOMP
1330 tristate '"ipcomp" match support'
1331 depends on NETFILTER_ADVANCED
1332 help
1333 This match extension allows you to match a range of CPIs(16 bits)
1334 inside IPComp header of IPSec packets.
1335
1336 To compile it as a module, choose M here. If unsure, say N.
1337
1338config NETFILTER_XT_MATCH_IPRANGE
1339 tristate '"iprange" address range match support'
1340 depends on NETFILTER_ADVANCED
1341 help
1342 This option adds a "iprange" match, which allows you to match based on
1343 an IP address range. (Normal iptables only matches on single addresses
1344 with an optional mask.)
1345
1346 If unsure, say M.
1347
1348config NETFILTER_XT_MATCH_IPVS
1349 tristate '"ipvs" match support'
1350 depends on IP_VS
1351 depends on NETFILTER_ADVANCED
1352 depends on NF_CONNTRACK
1353 help
1354 This option allows you to match against IPVS properties of a packet.
1355
1356 If unsure, say N.
1357
1358config NETFILTER_XT_MATCH_L2TP
1359 tristate '"l2tp" match support'
1360 depends on NETFILTER_ADVANCED
1361 default L2TP
1362 help
1363 This option adds an "L2TP" match, which allows you to match against
1364 L2TP protocol header fields.
1365
1366 To compile it as a module, choose M here. If unsure, say N.
1367
1368config NETFILTER_XT_MATCH_LENGTH
1369 tristate '"length" match support'
1370 depends on NETFILTER_ADVANCED
1371 help
1372 This option allows you to match the length of a packet against a
1373 specific value or range of values.
1374
1375 To compile it as a module, choose M here. If unsure, say N.
1376
1377config NETFILTER_XT_MATCH_LIMIT
1378 tristate '"limit" match support'
1379 depends on NETFILTER_ADVANCED
1380 help
1381 limit matching allows you to control the rate at which a rule can be
1382 matched: mainly useful in combination with the LOG target ("LOG
1383 target support", below) and to avoid some Denial of Service attacks.
1384
1385 To compile it as a module, choose M here. If unsure, say N.
1386
1387config NETFILTER_XT_MATCH_MAC
1388 tristate '"mac" address match support'
1389 depends on NETFILTER_ADVANCED
1390 help
1391 MAC matching allows you to match packets based on the source
1392 Ethernet address of the packet.
1393
1394 To compile it as a module, choose M here. If unsure, say N.
1395
1396config NETFILTER_XT_MATCH_MARK
1397 tristate '"mark" match support'
1398 depends on NETFILTER_ADVANCED
1399 select NETFILTER_XT_MARK
1400 help
1401 This is a backwards-compat option for the user's convenience
1402 (e.g. when running oldconfig). It selects
1403 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1404
1405config NETFILTER_XT_MATCH_MULTIPORT
1406 tristate '"multiport" Multiple port match support'
1407 depends on NETFILTER_ADVANCED
1408 help
1409 Multiport matching allows you to match TCP or UDP packets based on
1410 a series of source or destination ports: normally a rule can only
1411 match a single range of ports.
1412
1413 To compile it as a module, choose M here. If unsure, say N.
1414
1415config NETFILTER_XT_MATCH_NFACCT
1416 tristate '"nfacct" match support'
1417 depends on NETFILTER_ADVANCED
1418 select NETFILTER_NETLINK_ACCT
1419 help
1420 This option allows you to use the extended accounting through
1421 nfnetlink_acct.
1422
1423 To compile it as a module, choose M here. If unsure, say N.
1424
1425config NETFILTER_XT_MATCH_OSF
1426 tristate '"osf" Passive OS fingerprint match'
1427 depends on NETFILTER_ADVANCED
1428 select NETFILTER_NETLINK_OSF
1429 help
1430 This option selects the Passive OS Fingerprinting match module
1431 that allows to passively match the remote operating system by
1432 analyzing incoming TCP SYN packets.
1433
1434 Rules and loading software can be downloaded from
1435 http://www.ioremap.net/projects/osf
1436
1437 To compile it as a module, choose M here. If unsure, say N.
1438
1439config NETFILTER_XT_MATCH_OWNER
1440 tristate '"owner" match support'
1441 depends on NETFILTER_ADVANCED
1442 help
1443 Socket owner matching allows you to match locally-generated packets
1444 based on who created the socket: the user or group. It is also
1445 possible to check whether a socket actually exists.
1446
1447config NETFILTER_XT_MATCH_POLICY
1448 tristate 'IPsec "policy" match support'
1449 depends on XFRM
1450 default m if NETFILTER_ADVANCED=n
1451 help
1452 Policy matching allows you to match packets based on the
1453 IPsec policy that was used during decapsulation/will
1454 be used during encapsulation.
1455
1456 To compile it as a module, choose M here. If unsure, say N.
1457
1458config NETFILTER_XT_MATCH_PHYSDEV
1459 tristate '"physdev" match support'
1460 depends on BRIDGE && BRIDGE_NETFILTER
1461 depends on NETFILTER_ADVANCED
1462 help
1463 Physdev packet matching matches against the physical bridge ports
1464 the IP packet arrived on or will leave by.
1465
1466 To compile it as a module, choose M here. If unsure, say N.
1467
1468config NETFILTER_XT_MATCH_PKTTYPE
1469 tristate '"pkttype" packet type match support'
1470 depends on NETFILTER_ADVANCED
1471 help
1472 Packet type matching allows you to match a packet by
1473 its "class", eg. BROADCAST, MULTICAST, ...
1474
1475 Typical usage:
1476 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1477
1478 To compile it as a module, choose M here. If unsure, say N.
1479
1480config NETFILTER_XT_MATCH_QUOTA
1481 tristate '"quota" match support'
1482 depends on NETFILTER_ADVANCED
1483 help
1484 This option adds a `quota' match, which allows to match on a
1485 byte counter.
1486
1487 If you want to compile it as a module, say M here and read
1488 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1489
1490config NETFILTER_XT_MATCH_RATEEST
1491 tristate '"rateest" match support'
1492 depends on NETFILTER_ADVANCED
1493 select NETFILTER_XT_TARGET_RATEEST
1494 help
1495 This option adds a `rateest' match, which allows to match on the
1496 rate estimated by the RATEEST target.
1497
1498 To compile it as a module, choose M here. If unsure, say N.
1499
1500config NETFILTER_XT_MATCH_REALM
1501 tristate '"realm" match support'
1502 depends on NETFILTER_ADVANCED
1503 select IP_ROUTE_CLASSID
1504 help
1505 This option adds a `realm' match, which allows you to use the realm
1506 key from the routing subsystem inside iptables.
1507
1508 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1509 in tc world.
1510
1511 If you want to compile it as a module, say M here and read
1512 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1513
1514config NETFILTER_XT_MATCH_RECENT
1515 tristate '"recent" match support'
1516 depends on NETFILTER_ADVANCED
1517 help
1518 This match is used for creating one or many lists of recently
1519 used addresses and then matching against that/those list(s).
1520
1521 Short options are available by using 'iptables -m recent -h'
1522 Official Website: <http://snowman.net/projects/ipt_recent/>
1523
1524config NETFILTER_XT_MATCH_SCTP
1525 tristate '"sctp" protocol match support'
1526 depends on NETFILTER_ADVANCED
1527 default IP_SCTP
1528 help
1529 With this option enabled, you will be able to use the
1530 `sctp' match in order to match on SCTP source/destination ports
1531 and SCTP chunk types.
1532
1533 If you want to compile it as a module, say M here and read
1534 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1535
1536config NETFILTER_XT_MATCH_SOCKET
1537 tristate '"socket" match support'
1538 depends on NETFILTER_XTABLES
1539 depends on NETFILTER_ADVANCED
1540 depends on IPV6 || IPV6=n
1541 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1542 select NF_SOCKET_IPV4
1543 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1544 select NF_DEFRAG_IPV4
1545 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1546 help
1547 This option adds a `socket' match, which can be used to match
1548 packets for which a TCP or UDP socket lookup finds a valid socket.
1549 It can be used in combination with the MARK target and policy
1550 routing to implement full featured non-locally bound sockets.
1551
1552 To compile it as a module, choose M here. If unsure, say N.
1553
1554config NETFILTER_XT_MATCH_STATE
1555 tristate '"state" match support'
1556 depends on NF_CONNTRACK
1557 default m if NETFILTER_ADVANCED=n
1558 help
1559 Connection state matching allows you to match packets based on their
1560 relationship to a tracked connection (ie. previous packets). This
1561 is a powerful tool for packet classification.
1562
1563 To compile it as a module, choose M here. If unsure, say N.
1564
1565config NETFILTER_XT_MATCH_STATISTIC
1566 tristate '"statistic" match support'
1567 depends on NETFILTER_ADVANCED
1568 help
1569 This option adds a `statistic' match, which allows you to match
1570 on packets periodically or randomly with a given percentage.
1571
1572 To compile it as a module, choose M here. If unsure, say N.
1573
1574config NETFILTER_XT_MATCH_STRING
1575 tristate '"string" match support'
1576 depends on NETFILTER_ADVANCED
1577 select TEXTSEARCH
1578 select TEXTSEARCH_KMP
1579 select TEXTSEARCH_BM
1580 select TEXTSEARCH_FSM
1581 help
1582 This option adds a `string' match, which allows you to look for
1583 pattern matchings in packets.
1584
1585 To compile it as a module, choose M here. If unsure, say N.
1586
1587config NETFILTER_XT_MATCH_TCPMSS
1588 tristate '"tcpmss" match support'
1589 depends on NETFILTER_ADVANCED
1590 help
1591 This option adds a `tcpmss' match, which allows you to examine the
1592 MSS value of TCP SYN packets, which control the maximum packet size
1593 for that connection.
1594
1595 To compile it as a module, choose M here. If unsure, say N.
1596
1597config NETFILTER_XT_MATCH_TIME
1598 tristate '"time" match support'
1599 depends on NETFILTER_ADVANCED
1600 help
1601 This option adds a "time" match, which allows you to match based on
1602 the packet arrival time (at the machine which netfilter is running)
1603 on) or departure time/date (for locally generated packets).
1604
1605 If you say Y here, try `iptables -m time --help` for
1606 more information.
1607
1608 If you want to compile it as a module, say M here.
1609 If unsure, say N.
1610
1611config NETFILTER_XT_MATCH_U32
1612 tristate '"u32" match support'
1613 depends on NETFILTER_ADVANCED
1614 help
1615 u32 allows you to extract quantities of up to 4 bytes from a packet,
1616 AND them with specified masks, shift them by specified amounts and
1617 test whether the results are in any of a set of specified ranges.
1618 The specification of what to extract is general enough to skip over
1619 headers with lengths stored in the packet, as in IP or TCP header
1620 lengths.
1621
1622 Details and examples are in the kernel module source.
1623
1624endif # NETFILTER_XTABLES
1625
1626endmenu
1627
1628source "net/netfilter/ipset/Kconfig"
1629
1630source "net/netfilter/ipvs/Kconfig"