1# SPDX-License-Identifier: GPL-2.0-only 2menu "Core Netfilter Configuration" 3 depends on NET && INET && NETFILTER 4 5config NETFILTER_INGRESS 6 bool "Netfilter ingress support" 7 default y 8 select NET_INGRESS 9 help 10 This allows you to classify packets from ingress using the Netfilter 11 infrastructure. 12 13config NETFILTER_NETLINK 14 tristate 15 16config NETFILTER_FAMILY_BRIDGE 17 bool 18 19config NETFILTER_FAMILY_ARP 20 bool 21 22config NETFILTER_NETLINK_ACCT 23 tristate "Netfilter NFACCT over NFNETLINK interface" 24 depends on NETFILTER_ADVANCED 25 select NETFILTER_NETLINK 26 help 27 If this option is enabled, the kernel will include support 28 for extended accounting via NFNETLINK. 29 30config NETFILTER_NETLINK_QUEUE 31 tristate "Netfilter NFQUEUE over NFNETLINK interface" 32 depends on NETFILTER_ADVANCED 33 select NETFILTER_NETLINK 34 help 35 If this option is enabled, the kernel will include support 36 for queueing packets via NFNETLINK. 37 38config NETFILTER_NETLINK_LOG 39 tristate "Netfilter LOG over NFNETLINK interface" 40 default m if NETFILTER_ADVANCED=n 41 select NETFILTER_NETLINK 42 help 43 If this option is enabled, the kernel will include support 44 for logging packets via NFNETLINK. 45 46 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 47 and is also scheduled to replace the old syslog-based ipt_LOG 48 and ip6t_LOG modules. 49 50config NETFILTER_NETLINK_OSF 51 tristate "Netfilter OSF over NFNETLINK interface" 52 depends on NETFILTER_ADVANCED 53 select NETFILTER_NETLINK 54 help 55 If this option is enabled, the kernel will include support 56 for passive OS fingerprint via NFNETLINK. 57 58config NF_CONNTRACK 59 tristate "Netfilter connection tracking support" 60 default m if NETFILTER_ADVANCED=n 61 select NF_DEFRAG_IPV4 62 select NF_DEFRAG_IPV6 if IPV6 != n 63 help 64 Connection tracking keeps a record of what packets have passed 65 through your machine, in order to figure out how they are related 66 into connections. 67 68 This is required to do Masquerading or other kinds of Network 69 Address Translation. It can also be used to enhance packet 70 filtering (see `Connection state match support' below). 71 72 To compile it as a module, choose M here. If unsure, say N. 73 74config NF_LOG_COMMON 75 tristate 76 77config NF_LOG_NETDEV 78 tristate "Netdev packet logging" 79 select NF_LOG_COMMON 80 81if NF_CONNTRACK 82config NETFILTER_CONNCOUNT 83 tristate 84 85config NF_CONNTRACK_MARK 86 bool 'Connection mark tracking support' 87 depends on NETFILTER_ADVANCED 88 help 89 This option enables support for connection marks, used by the 90 `CONNMARK' target and `connmark' match. Similar to the mark value 91 of packets, but this mark value is kept in the conntrack session 92 instead of the individual packets. 93 94config NF_CONNTRACK_SECMARK 95 bool 'Connection tracking security mark support' 96 depends on NETWORK_SECMARK 97 default m if NETFILTER_ADVANCED=n 98 help 99 This option enables security markings to be applied to 100 connections. Typically they are copied to connections from 101 packets using the CONNSECMARK target and copied back from 102 connections to packets with the same target, with the packets 103 being originally labeled via SECMARK. 104 105 If unsure, say 'N'. 106 107config NF_CONNTRACK_ZONES 108 bool 'Connection tracking zones' 109 depends on NETFILTER_ADVANCED 110 help 111 This option enables support for connection tracking zones. 112 Normally, each connection needs to have a unique system wide 113 identity. Connection tracking zones allow to have multiple 114 connections using the same identity, as long as they are 115 contained in different zones. 116 117 If unsure, say `N'. 118 119config NF_CONNTRACK_PROCFS 120 bool "Supply CT list in procfs (OBSOLETE)" 121 default y 122 depends on PROC_FS 123 help 124 This option enables for the list of known conntrack entries 125 to be shown in procfs under net/netfilter/nf_conntrack. This 126 is considered obsolete in favor of using the conntrack(8) 127 tool which uses Netlink. 128 129config NF_CONNTRACK_EVENTS 130 bool "Connection tracking events" 131 depends on NETFILTER_ADVANCED 132 help 133 If this option is enabled, the connection tracking code will 134 provide a notifier chain that can be used by other kernel code 135 to get notified about changes in the connection tracking state. 136 137 If unsure, say `N'. 138 139config NF_CONNTRACK_TIMEOUT 140 bool 'Connection tracking timeout' 141 depends on NETFILTER_ADVANCED 142 help 143 This option enables support for connection tracking timeout 144 extension. This allows you to attach timeout policies to flow 145 via the CT target. 146 147 If unsure, say `N'. 148 149config NF_CONNTRACK_TIMESTAMP 150 bool 'Connection tracking timestamping' 151 depends on NETFILTER_ADVANCED 152 help 153 This option enables support for connection tracking timestamping. 154 This allows you to store the flow start-time and to obtain 155 the flow-stop time (once it has been destroyed) via Connection 156 tracking events. 157 158 If unsure, say `N'. 159 160config NF_CONNTRACK_LABELS 161 bool "Connection tracking labels" 162 help 163 This option enables support for assigning user-defined flag bits 164 to connection tracking entries. It can be used with xtables connlabel 165 match and the nftables ct expression. 166 167config NF_CT_PROTO_DCCP 168 bool 'DCCP protocol connection tracking support' 169 depends on NETFILTER_ADVANCED 170 default y 171 help 172 With this option enabled, the layer 3 independent connection 173 tracking code will be able to do state tracking on DCCP connections. 174 175 If unsure, say Y. 176 177config NF_CT_PROTO_GRE 178 bool 179 180config NF_CT_PROTO_SCTP 181 bool 'SCTP protocol connection tracking support' 182 depends on NETFILTER_ADVANCED 183 default y 184 select LIBCRC32C 185 help 186 With this option enabled, the layer 3 independent connection 187 tracking code will be able to do state tracking on SCTP connections. 188 189 If unsure, say Y. 190 191config NF_CT_PROTO_UDPLITE 192 bool 'UDP-Lite protocol connection tracking support' 193 depends on NETFILTER_ADVANCED 194 default y 195 help 196 With this option enabled, the layer 3 independent connection 197 tracking code will be able to do state tracking on UDP-Lite 198 connections. 199 200 If unsure, say Y. 201 202config NF_CONNTRACK_AMANDA 203 tristate "Amanda backup protocol support" 204 depends on NETFILTER_ADVANCED 205 select TEXTSEARCH 206 select TEXTSEARCH_KMP 207 help 208 If you are running the Amanda backup package <http://www.amanda.org/> 209 on this machine or machines that will be MASQUERADED through this 210 machine, then you may want to enable this feature. This allows the 211 connection tracking and natting code to allow the sub-channels that 212 Amanda requires for communication of the backup data, messages and 213 index. 214 215 To compile it as a module, choose M here. If unsure, say N. 216 217config NF_CONNTRACK_FTP 218 tristate "FTP protocol support" 219 default m if NETFILTER_ADVANCED=n 220 help 221 Tracking FTP connections is problematic: special helpers are 222 required for tracking them, and doing masquerading and other forms 223 of Network Address Translation on them. 224 225 This is FTP support on Layer 3 independent connection tracking. 226 227 To compile it as a module, choose M here. If unsure, say N. 228 229config NF_CONNTRACK_H323 230 tristate "H.323 protocol support" 231 depends on IPV6 || IPV6=n 232 depends on NETFILTER_ADVANCED 233 help 234 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 235 important VoIP protocols, it is widely used by voice hardware and 236 software including voice gateways, IP phones, Netmeeting, OpenPhone, 237 Gnomemeeting, etc. 238 239 With this module you can support H.323 on a connection tracking/NAT 240 firewall. 241 242 This module supports RAS, Fast Start, H.245 Tunnelling, Call 243 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 244 whiteboard, file transfer, etc. For more information, please 245 visit http://nath323.sourceforge.net/. 246 247 To compile it as a module, choose M here. If unsure, say N. 248 249config NF_CONNTRACK_IRC 250 tristate "IRC protocol support" 251 default m if NETFILTER_ADVANCED=n 252 help 253 There is a commonly-used extension to IRC called 254 Direct Client-to-Client Protocol (DCC). This enables users to send 255 files to each other, and also chat to each other without the need 256 of a server. DCC Sending is used anywhere you send files over IRC, 257 and DCC Chat is most commonly used by Eggdrop bots. If you are 258 using NAT, this extension will enable you to send files and initiate 259 chats. Note that you do NOT need this extension to get files or 260 have others initiate chats, or everything else in IRC. 261 262 To compile it as a module, choose M here. If unsure, say N. 263 264config NF_CONNTRACK_BROADCAST 265 tristate 266 267config NF_CONNTRACK_NETBIOS_NS 268 tristate "NetBIOS name service protocol support" 269 select NF_CONNTRACK_BROADCAST 270 help 271 NetBIOS name service requests are sent as broadcast messages from an 272 unprivileged port and responded to with unicast messages to the 273 same port. This make them hard to firewall properly because connection 274 tracking doesn't deal with broadcasts. This helper tracks locally 275 originating NetBIOS name service requests and the corresponding 276 responses. It relies on correct IP address configuration, specifically 277 netmask and broadcast address. When properly configured, the output 278 of "ip address show" should look similar to this: 279 280 $ ip -4 address show eth0 281 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 282 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 283 284 To compile it as a module, choose M here. If unsure, say N. 285 286config NF_CONNTRACK_SNMP 287 tristate "SNMP service protocol support" 288 depends on NETFILTER_ADVANCED 289 select NF_CONNTRACK_BROADCAST 290 help 291 SNMP service requests are sent as broadcast messages from an 292 unprivileged port and responded to with unicast messages to the 293 same port. This make them hard to firewall properly because connection 294 tracking doesn't deal with broadcasts. This helper tracks locally 295 originating SNMP service requests and the corresponding 296 responses. It relies on correct IP address configuration, specifically 297 netmask and broadcast address. 298 299 To compile it as a module, choose M here. If unsure, say N. 300 301config NF_CONNTRACK_PPTP 302 tristate "PPtP protocol support" 303 depends on NETFILTER_ADVANCED 304 select NF_CT_PROTO_GRE 305 help 306 This module adds support for PPTP (Point to Point Tunnelling 307 Protocol, RFC2637) connection tracking and NAT. 308 309 If you are running PPTP sessions over a stateful firewall or NAT 310 box, you may want to enable this feature. 311 312 Please note that not all PPTP modes of operation are supported yet. 313 Specifically these limitations exist: 314 - Blindly assumes that control connections are always established 315 in PNS->PAC direction. This is a violation of RFC2637. 316 - Only supports a single call within each session 317 318 To compile it as a module, choose M here. If unsure, say N. 319 320config NF_CONNTRACK_SANE 321 tristate "SANE protocol support" 322 depends on NETFILTER_ADVANCED 323 help 324 SANE is a protocol for remote access to scanners as implemented 325 by the 'saned' daemon. Like FTP, it uses separate control and 326 data connections. 327 328 With this module you can support SANE on a connection tracking 329 firewall. 330 331 To compile it as a module, choose M here. If unsure, say N. 332 333config NF_CONNTRACK_SIP 334 tristate "SIP protocol support" 335 default m if NETFILTER_ADVANCED=n 336 help 337 SIP is an application-layer control protocol that can establish, 338 modify, and terminate multimedia sessions (conferences) such as 339 Internet telephony calls. With the nf_conntrack_sip and 340 the nf_nat_sip modules you can support the protocol on a connection 341 tracking/NATing firewall. 342 343 To compile it as a module, choose M here. If unsure, say N. 344 345config NF_CONNTRACK_TFTP 346 tristate "TFTP protocol support" 347 depends on NETFILTER_ADVANCED 348 help 349 TFTP connection tracking helper, this is required depending 350 on how restrictive your ruleset is. 351 If you are using a tftp client behind -j SNAT or -j MASQUERADING 352 you will need this. 353 354 To compile it as a module, choose M here. If unsure, say N. 355 356config NF_CT_NETLINK 357 tristate 'Connection tracking netlink interface' 358 select NETFILTER_NETLINK 359 default m if NETFILTER_ADVANCED=n 360 help 361 This option enables support for a netlink-based userspace interface 362 363config NF_CT_NETLINK_TIMEOUT 364 tristate 'Connection tracking timeout tuning via Netlink' 365 select NETFILTER_NETLINK 366 depends on NETFILTER_ADVANCED 367 depends on NF_CONNTRACK_TIMEOUT 368 help 369 This option enables support for connection tracking timeout 370 fine-grain tuning. This allows you to attach specific timeout 371 policies to flows, instead of using the global timeout policy. 372 373 If unsure, say `N'. 374 375config NF_CT_NETLINK_HELPER 376 tristate 'Connection tracking helpers in user-space via Netlink' 377 select NETFILTER_NETLINK 378 depends on NF_CT_NETLINK 379 depends on NETFILTER_NETLINK_QUEUE 380 depends on NETFILTER_NETLINK_GLUE_CT 381 depends on NETFILTER_ADVANCED 382 help 383 This option enables the user-space connection tracking helpers 384 infrastructure. 385 386 If unsure, say `N'. 387 388config NETFILTER_NETLINK_GLUE_CT 389 bool "NFQUEUE and NFLOG integration with Connection Tracking" 390 default n 391 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 392 help 393 If this option is enabled, NFQUEUE and NFLOG can include 394 Connection Tracking information together with the packet is 395 the enqueued via NFNETLINK. 396 397config NF_NAT 398 tristate "Network Address Translation support" 399 depends on NF_CONNTRACK 400 default m if NETFILTER_ADVANCED=n 401 help 402 The NAT option allows masquerading, port forwarding and other 403 forms of full Network Address Port Translation. This can be 404 controlled by iptables, ip6tables or nft. 405 406config NF_NAT_AMANDA 407 tristate 408 depends on NF_CONNTRACK && NF_NAT 409 default NF_NAT && NF_CONNTRACK_AMANDA 410 411config NF_NAT_FTP 412 tristate 413 depends on NF_CONNTRACK && NF_NAT 414 default NF_NAT && NF_CONNTRACK_FTP 415 416config NF_NAT_IRC 417 tristate 418 depends on NF_CONNTRACK && NF_NAT 419 default NF_NAT && NF_CONNTRACK_IRC 420 421config NF_NAT_SIP 422 tristate 423 depends on NF_CONNTRACK && NF_NAT 424 default NF_NAT && NF_CONNTRACK_SIP 425 426config NF_NAT_TFTP 427 tristate 428 depends on NF_CONNTRACK && NF_NAT 429 default NF_NAT && NF_CONNTRACK_TFTP 430 431config NF_NAT_REDIRECT 432 bool 433 434config NF_NAT_MASQUERADE 435 bool 436 437config NETFILTER_SYNPROXY 438 tristate 439 440endif # NF_CONNTRACK 441 442config NF_TABLES 443 select NETFILTER_NETLINK 444 select LIBCRC32C 445 tristate "Netfilter nf_tables support" 446 help 447 nftables is the new packet classification framework that intends to 448 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 449 provides a pseudo-state machine with an extensible instruction-set 450 (also known as expressions) that the userspace 'nft' utility 451 (https://www.netfilter.org/projects/nftables) uses to build the 452 rule-set. It also comes with the generic set infrastructure that 453 allows you to construct mappings between matchings and actions 454 for performance lookups. 455 456 To compile it as a module, choose M here. 457 458if NF_TABLES 459config NF_TABLES_INET 460 depends on IPV6 461 select NF_TABLES_IPV4 462 select NF_TABLES_IPV6 463 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support" 464 help 465 This option enables support for a mixed IPv4/IPv6 "inet" table. 466 467config NF_TABLES_NETDEV 468 bool "Netfilter nf_tables netdev tables support" 469 help 470 This option enables support for the "netdev" table. 471 472config NFT_NUMGEN 473 tristate "Netfilter nf_tables number generator module" 474 help 475 This option adds the number generator expression used to perform 476 incremental counting and random numbers bound to a upper limit. 477 478config NFT_CT 479 depends on NF_CONNTRACK 480 tristate "Netfilter nf_tables conntrack module" 481 help 482 This option adds the "ct" expression that you can use to match 483 connection tracking information such as the flow state. 484 485config NFT_FLOW_OFFLOAD 486 depends on NF_CONNTRACK && NF_FLOW_TABLE 487 tristate "Netfilter nf_tables hardware flow offload module" 488 help 489 This option adds the "flow_offload" expression that you can use to 490 choose what flows are placed into the hardware. 491 492config NFT_COUNTER 493 tristate "Netfilter nf_tables counter module" 494 help 495 This option adds the "counter" expression that you can use to 496 include packet and byte counters in a rule. 497 498config NFT_CONNLIMIT 499 tristate "Netfilter nf_tables connlimit module" 500 depends on NF_CONNTRACK 501 depends on NETFILTER_ADVANCED 502 select NETFILTER_CONNCOUNT 503 help 504 This option adds the "connlimit" expression that you can use to 505 ratelimit rule matchings per connections. 506 507config NFT_LOG 508 tristate "Netfilter nf_tables log module" 509 help 510 This option adds the "log" expression that you can use to log 511 packets matching some criteria. 512 513config NFT_LIMIT 514 tristate "Netfilter nf_tables limit module" 515 help 516 This option adds the "limit" expression that you can use to 517 ratelimit rule matchings. 518 519config NFT_MASQ 520 depends on NF_CONNTRACK 521 depends on NF_NAT 522 select NF_NAT_MASQUERADE 523 tristate "Netfilter nf_tables masquerade support" 524 help 525 This option adds the "masquerade" expression that you can use 526 to perform NAT in the masquerade flavour. 527 528config NFT_REDIR 529 depends on NF_CONNTRACK 530 depends on NF_NAT 531 tristate "Netfilter nf_tables redirect support" 532 select NF_NAT_REDIRECT 533 help 534 This options adds the "redirect" expression that you can use 535 to perform NAT in the redirect flavour. 536 537config NFT_NAT 538 depends on NF_CONNTRACK 539 select NF_NAT 540 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6 541 tristate "Netfilter nf_tables nat module" 542 help 543 This option adds the "nat" expression that you can use to perform 544 typical Network Address Translation (NAT) packet transformations. 545 546config NFT_TUNNEL 547 tristate "Netfilter nf_tables tunnel module" 548 help 549 This option adds the "tunnel" expression that you can use to set 550 tunneling policies. 551 552config NFT_OBJREF 553 tristate "Netfilter nf_tables stateful object reference module" 554 help 555 This option adds the "objref" expression that allows you to refer to 556 stateful objects, such as counters and quotas. 557 558config NFT_QUEUE 559 depends on NETFILTER_NETLINK_QUEUE 560 tristate "Netfilter nf_tables queue module" 561 help 562 This is required if you intend to use the userspace queueing 563 infrastructure (also known as NFQUEUE) from nftables. 564 565config NFT_QUOTA 566 tristate "Netfilter nf_tables quota module" 567 help 568 This option adds the "quota" expression that you can use to match 569 enforce bytes quotas. 570 571config NFT_REJECT 572 default m if NETFILTER_ADVANCED=n 573 tristate "Netfilter nf_tables reject support" 574 depends on !NF_TABLES_INET || (IPV6!=m || m) 575 help 576 This option adds the "reject" expression that you can use to 577 explicitly deny and notify via TCP reset/ICMP informational errors 578 unallowed traffic. 579 580config NFT_REJECT_INET 581 depends on NF_TABLES_INET 582 default NFT_REJECT 583 tristate 584 585config NFT_COMPAT 586 depends on NETFILTER_XTABLES 587 tristate "Netfilter x_tables over nf_tables module" 588 help 589 This is required if you intend to use any of existing 590 x_tables match/target extensions over the nf_tables 591 framework. 592 593config NFT_HASH 594 tristate "Netfilter nf_tables hash module" 595 help 596 This option adds the "hash" expression that you can use to perform 597 a hash operation on registers. 598 599config NFT_FIB 600 tristate 601 602config NFT_FIB_INET 603 depends on NF_TABLES_INET 604 depends on NFT_FIB_IPV4 605 depends on NFT_FIB_IPV6 606 tristate "Netfilter nf_tables fib inet support" 607 help 608 This option allows using the FIB expression from the inet table. 609 The lookup will be delegated to the IPv4 or IPv6 FIB depending 610 on the protocol of the packet. 611 612config NFT_XFRM 613 tristate "Netfilter nf_tables xfrm/IPSec security association matching" 614 depends on XFRM 615 help 616 This option adds an expression that you can use to extract properties 617 of a packets security association. 618 619config NFT_SOCKET 620 tristate "Netfilter nf_tables socket match support" 621 depends on IPV6 || IPV6=n 622 select NF_SOCKET_IPV4 623 select NF_SOCKET_IPV6 if NF_TABLES_IPV6 624 help 625 This option allows matching for the presence or absence of a 626 corresponding socket and its attributes. 627 628config NFT_OSF 629 tristate "Netfilter nf_tables passive OS fingerprint support" 630 depends on NETFILTER_ADVANCED 631 select NETFILTER_NETLINK_OSF 632 help 633 This option allows matching packets from an specific OS. 634 635config NFT_TPROXY 636 tristate "Netfilter nf_tables tproxy support" 637 depends on IPV6 || IPV6=n 638 select NF_DEFRAG_IPV4 639 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6 640 select NF_TPROXY_IPV4 641 select NF_TPROXY_IPV6 if NF_TABLES_IPV6 642 help 643 This makes transparent proxy support available in nftables. 644 645config NFT_SYNPROXY 646 tristate "Netfilter nf_tables SYNPROXY expression support" 647 depends on NF_CONNTRACK && NETFILTER_ADVANCED 648 select NETFILTER_SYNPROXY 649 select SYN_COOKIES 650 help 651 The SYNPROXY expression allows you to intercept TCP connections and 652 establish them using syncookies before they are passed on to the 653 server. This allows to avoid conntrack and server resource usage 654 during SYN-flood attacks. 655 656if NF_TABLES_NETDEV 657 658config NF_DUP_NETDEV 659 tristate "Netfilter packet duplication support" 660 help 661 This option enables the generic packet duplication infrastructure 662 for Netfilter. 663 664config NFT_DUP_NETDEV 665 tristate "Netfilter nf_tables netdev packet duplication support" 666 select NF_DUP_NETDEV 667 help 668 This option enables packet duplication for the "netdev" family. 669 670config NFT_FWD_NETDEV 671 tristate "Netfilter nf_tables netdev packet forwarding support" 672 select NF_DUP_NETDEV 673 help 674 This option enables packet forwarding for the "netdev" family. 675 676config NFT_FIB_NETDEV 677 depends on NFT_FIB_IPV4 678 depends on NFT_FIB_IPV6 679 tristate "Netfilter nf_tables netdev fib lookups support" 680 help 681 This option allows using the FIB expression from the netdev table. 682 The lookup will be delegated to the IPv4 or IPv6 FIB depending 683 on the protocol of the packet. 684 685endif # NF_TABLES_NETDEV 686 687endif # NF_TABLES 688 689config NF_FLOW_TABLE_INET 690 tristate "Netfilter flow table mixed IPv4/IPv6 module" 691 depends on NF_FLOW_TABLE 692 help 693 This option adds the flow table mixed IPv4/IPv6 support. 694 695 To compile it as a module, choose M here. 696 697config NF_FLOW_TABLE 698 tristate "Netfilter flow table module" 699 depends on NETFILTER_INGRESS 700 depends on NF_CONNTRACK 701 depends on NF_TABLES 702 help 703 This option adds the flow table core infrastructure. 704 705 To compile it as a module, choose M here. 706 707config NETFILTER_XTABLES 708 tristate "Netfilter Xtables support (required for ip_tables)" 709 default m if NETFILTER_ADVANCED=n 710 help 711 This is required if you intend to use any of ip_tables, 712 ip6_tables or arp_tables. 713 714if NETFILTER_XTABLES 715 716comment "Xtables combined modules" 717 718config NETFILTER_XT_MARK 719 tristate 'nfmark target and match support' 720 default m if NETFILTER_ADVANCED=n 721 help 722 This option adds the "MARK" target and "mark" match. 723 724 Netfilter mark matching allows you to match packets based on the 725 "nfmark" value in the packet. 726 The target allows you to create rules in the "mangle" table which alter 727 the netfilter mark (nfmark) field associated with the packet. 728 729 Prior to routing, the nfmark can influence the routing method and can 730 also be used by other subsystems to change their behavior. 731 732config NETFILTER_XT_CONNMARK 733 tristate 'ctmark target and match support' 734 depends on NF_CONNTRACK 735 depends on NETFILTER_ADVANCED 736 select NF_CONNTRACK_MARK 737 help 738 This option adds the "CONNMARK" target and "connmark" match. 739 740 Netfilter allows you to store a mark value per connection (a.k.a. 741 ctmark), similarly to the packet mark (nfmark). Using this 742 target and match, you can set and match on this mark. 743 744config NETFILTER_XT_SET 745 tristate 'set target and match support' 746 depends on IP_SET 747 depends on NETFILTER_ADVANCED 748 help 749 This option adds the "SET" target and "set" match. 750 751 Using this target and match, you can add/delete and match 752 elements in the sets created by ipset(8). 753 754 To compile it as a module, choose M here. If unsure, say N. 755 756# alphabetically ordered list of targets 757 758comment "Xtables targets" 759 760config NETFILTER_XT_TARGET_AUDIT 761 tristate "AUDIT target support" 762 depends on AUDIT 763 depends on NETFILTER_ADVANCED 764 help 765 This option adds a 'AUDIT' target, which can be used to create 766 audit records for packets dropped/accepted. 767 768 To compileit as a module, choose M here. If unsure, say N. 769 770config NETFILTER_XT_TARGET_CHECKSUM 771 tristate "CHECKSUM target support" 772 depends on IP_NF_MANGLE || IP6_NF_MANGLE 773 depends on NETFILTER_ADVANCED 774 help 775 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 776 table to work around buggy DHCP clients in virtualized environments. 777 778 Some old DHCP clients drop packets because they are not aware 779 that the checksum would normally be offloaded to hardware and 780 thus should be considered valid. 781 This target can be used to fill in the checksum using iptables 782 when such packets are sent via a virtual network device. 783 784 To compile it as a module, choose M here. If unsure, say N. 785 786config NETFILTER_XT_TARGET_CLASSIFY 787 tristate '"CLASSIFY" target support' 788 depends on NETFILTER_ADVANCED 789 help 790 This option adds a `CLASSIFY' target, which enables the user to set 791 the priority of a packet. Some qdiscs can use this value for 792 classification, among these are: 793 794 atm, cbq, dsmark, pfifo_fast, htb, prio 795 796 To compile it as a module, choose M here. If unsure, say N. 797 798config NETFILTER_XT_TARGET_CONNMARK 799 tristate '"CONNMARK" target support' 800 depends on NF_CONNTRACK 801 depends on NETFILTER_ADVANCED 802 select NETFILTER_XT_CONNMARK 803 help 804 This is a backwards-compat option for the user's convenience 805 (e.g. when running oldconfig). It selects 806 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 807 808config NETFILTER_XT_TARGET_CONNSECMARK 809 tristate '"CONNSECMARK" target support' 810 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 811 default m if NETFILTER_ADVANCED=n 812 help 813 The CONNSECMARK target copies security markings from packets 814 to connections, and restores security markings from connections 815 to packets (if the packets are not already marked). This would 816 normally be used in conjunction with the SECMARK target. 817 818 To compile it as a module, choose M here. If unsure, say N. 819 820config NETFILTER_XT_TARGET_CT 821 tristate '"CT" target support' 822 depends on NF_CONNTRACK 823 depends on IP_NF_RAW || IP6_NF_RAW 824 depends on NETFILTER_ADVANCED 825 help 826 This options adds a `CT' target, which allows to specify initial 827 connection tracking parameters like events to be delivered and 828 the helper to be used. 829 830 To compile it as a module, choose M here. If unsure, say N. 831 832config NETFILTER_XT_TARGET_DSCP 833 tristate '"DSCP" and "TOS" target support' 834 depends on IP_NF_MANGLE || IP6_NF_MANGLE 835 depends on NETFILTER_ADVANCED 836 help 837 This option adds a `DSCP' target, which allows you to manipulate 838 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 839 840 The DSCP field can have any value between 0x0 and 0x3f inclusive. 841 842 It also adds the "TOS" target, which allows you to create rules in 843 the "mangle" table which alter the Type Of Service field of an IPv4 844 or the Priority field of an IPv6 packet, prior to routing. 845 846 To compile it as a module, choose M here. If unsure, say N. 847 848config NETFILTER_XT_TARGET_HL 849 tristate '"HL" hoplimit target support' 850 depends on IP_NF_MANGLE || IP6_NF_MANGLE 851 depends on NETFILTER_ADVANCED 852 help 853 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 854 targets, which enable the user to change the 855 hoplimit/time-to-live value of the IP header. 856 857 While it is safe to decrement the hoplimit/TTL value, the 858 modules also allow to increment and set the hoplimit value of 859 the header to arbitrary values. This is EXTREMELY DANGEROUS 860 since you can easily create immortal packets that loop 861 forever on the network. 862 863config NETFILTER_XT_TARGET_HMARK 864 tristate '"HMARK" target support' 865 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 866 depends on NETFILTER_ADVANCED 867 help 868 This option adds the "HMARK" target. 869 870 The target allows you to create rules in the "raw" and "mangle" tables 871 which set the skbuff mark by means of hash calculation within a given 872 range. The nfmark can influence the routing method and can also be used 873 by other subsystems to change their behaviour. 874 875 To compile it as a module, choose M here. If unsure, say N. 876 877config NETFILTER_XT_TARGET_IDLETIMER 878 tristate "IDLETIMER target support" 879 depends on NETFILTER_ADVANCED 880 help 881 882 This option adds the `IDLETIMER' target. Each matching packet 883 resets the timer associated with label specified when the rule is 884 added. When the timer expires, it triggers a sysfs notification. 885 The remaining time for expiration can be read via sysfs. 886 887 To compile it as a module, choose M here. If unsure, say N. 888 889config NETFILTER_XT_TARGET_LED 890 tristate '"LED" target support' 891 depends on LEDS_CLASS && LEDS_TRIGGERS 892 depends on NETFILTER_ADVANCED 893 help 894 This option adds a `LED' target, which allows you to blink LEDs in 895 response to particular packets passing through your machine. 896 897 This can be used to turn a spare LED into a network activity LED, 898 which only flashes in response to FTP transfers, for example. Or 899 you could have an LED which lights up for a minute or two every time 900 somebody connects to your machine via SSH. 901 902 You will need support for the "led" class to make this work. 903 904 To create an LED trigger for incoming SSH traffic: 905 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 906 907 Then attach the new trigger to an LED on your system: 908 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 909 910 For more information on the LEDs available on your system, see 911 Documentation/leds/leds-class.rst 912 913config NETFILTER_XT_TARGET_LOG 914 tristate "LOG target support" 915 select NF_LOG_COMMON 916 select NF_LOG_IPV4 917 select NF_LOG_IPV6 if IP6_NF_IPTABLES 918 default m if NETFILTER_ADVANCED=n 919 help 920 This option adds a `LOG' target, which allows you to create rules in 921 any iptables table which records the packet header to the syslog. 922 923 To compile it as a module, choose M here. If unsure, say N. 924 925config NETFILTER_XT_TARGET_MARK 926 tristate '"MARK" target support' 927 depends on NETFILTER_ADVANCED 928 select NETFILTER_XT_MARK 929 help 930 This is a backwards-compat option for the user's convenience 931 (e.g. when running oldconfig). It selects 932 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 933 934config NETFILTER_XT_NAT 935 tristate '"SNAT and DNAT" targets support' 936 depends on NF_NAT 937 help 938 This option enables the SNAT and DNAT targets. 939 940 To compile it as a module, choose M here. If unsure, say N. 941 942config NETFILTER_XT_TARGET_NETMAP 943 tristate '"NETMAP" target support' 944 depends on NF_NAT 945 help 946 NETMAP is an implementation of static 1:1 NAT mapping of network 947 addresses. It maps the network address part, while keeping the host 948 address part intact. 949 950 To compile it as a module, choose M here. If unsure, say N. 951 952config NETFILTER_XT_TARGET_NFLOG 953 tristate '"NFLOG" target support' 954 default m if NETFILTER_ADVANCED=n 955 select NETFILTER_NETLINK_LOG 956 help 957 This option enables the NFLOG target, which allows to LOG 958 messages through nfnetlink_log. 959 960 To compile it as a module, choose M here. If unsure, say N. 961 962config NETFILTER_XT_TARGET_NFQUEUE 963 tristate '"NFQUEUE" target Support' 964 depends on NETFILTER_ADVANCED 965 select NETFILTER_NETLINK_QUEUE 966 help 967 This target replaced the old obsolete QUEUE target. 968 969 As opposed to QUEUE, it supports 65535 different queues, 970 not just one. 971 972 To compile it as a module, choose M here. If unsure, say N. 973 974config NETFILTER_XT_TARGET_NOTRACK 975 tristate '"NOTRACK" target support (DEPRECATED)' 976 depends on NF_CONNTRACK 977 depends on IP_NF_RAW || IP6_NF_RAW 978 depends on NETFILTER_ADVANCED 979 select NETFILTER_XT_TARGET_CT 980 981config NETFILTER_XT_TARGET_RATEEST 982 tristate '"RATEEST" target support' 983 depends on NETFILTER_ADVANCED 984 help 985 This option adds a `RATEEST' target, which allows to measure 986 rates similar to TC estimators. The `rateest' match can be 987 used to match on the measured rates. 988 989 To compile it as a module, choose M here. If unsure, say N. 990 991config NETFILTER_XT_TARGET_REDIRECT 992 tristate "REDIRECT target support" 993 depends on NF_NAT 994 select NF_NAT_REDIRECT 995 help 996 REDIRECT is a special case of NAT: all incoming connections are 997 mapped onto the incoming interface's address, causing the packets to 998 come to the local machine instead of passing through. This is 999 useful for transparent proxies. 1000 1001 To compile it as a module, choose M here. If unsure, say N. 1002 1003config NETFILTER_XT_TARGET_MASQUERADE 1004 tristate "MASQUERADE target support" 1005 depends on NF_NAT 1006 default m if NETFILTER_ADVANCED=n 1007 select NF_NAT_MASQUERADE 1008 help 1009 Masquerading is a special case of NAT: all outgoing connections are 1010 changed to seem to come from a particular interface's address, and 1011 if the interface goes down, those connections are lost. This is 1012 only useful for dialup accounts with dynamic IP address (ie. your IP 1013 address will be different on next dialup). 1014 1015 To compile it as a module, choose M here. If unsure, say N. 1016 1017config NETFILTER_XT_TARGET_TEE 1018 tristate '"TEE" - packet cloning to alternate destination' 1019 depends on NETFILTER_ADVANCED 1020 depends on IPV6 || IPV6=n 1021 depends on !NF_CONNTRACK || NF_CONNTRACK 1022 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES 1023 select NF_DUP_IPV4 1024 select NF_DUP_IPV6 if IP6_NF_IPTABLES 1025 help 1026 This option adds a "TEE" target with which a packet can be cloned and 1027 this clone be rerouted to another nexthop. 1028 1029config NETFILTER_XT_TARGET_TPROXY 1030 tristate '"TPROXY" target transparent proxying support' 1031 depends on NETFILTER_XTABLES 1032 depends on NETFILTER_ADVANCED 1033 depends on IPV6 || IPV6=n 1034 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1035 depends on IP_NF_MANGLE 1036 select NF_DEFRAG_IPV4 1037 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1038 select NF_TPROXY_IPV4 1039 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES 1040 help 1041 This option adds a `TPROXY' target, which is somewhat similar to 1042 REDIRECT. It can only be used in the mangle table and is useful 1043 to redirect traffic to a transparent proxy. It does _not_ depend 1044 on Netfilter connection tracking and NAT, unlike REDIRECT. 1045 For it to work you will have to configure certain iptables rules 1046 and use policy routing. For more information on how to set it up 1047 see Documentation/networking/tproxy.rst. 1048 1049 To compile it as a module, choose M here. If unsure, say N. 1050 1051config NETFILTER_XT_TARGET_TRACE 1052 tristate '"TRACE" target support' 1053 depends on IP_NF_RAW || IP6_NF_RAW 1054 depends on NETFILTER_ADVANCED 1055 help 1056 The TRACE target allows you to mark packets so that the kernel 1057 will log every rule which match the packets as those traverse 1058 the tables, chains, rules. 1059 1060 If you want to compile it as a module, say M here and read 1061 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1062 1063config NETFILTER_XT_TARGET_SECMARK 1064 tristate '"SECMARK" target support' 1065 depends on NETWORK_SECMARK 1066 default m if NETFILTER_ADVANCED=n 1067 help 1068 The SECMARK target allows security marking of network 1069 packets, for use with security subsystems. 1070 1071 To compile it as a module, choose M here. If unsure, say N. 1072 1073config NETFILTER_XT_TARGET_TCPMSS 1074 tristate '"TCPMSS" target support' 1075 depends on IPV6 || IPV6=n 1076 default m if NETFILTER_ADVANCED=n 1077 help 1078 This option adds a `TCPMSS' target, which allows you to alter the 1079 MSS value of TCP SYN packets, to control the maximum size for that 1080 connection (usually limiting it to your outgoing interface's MTU 1081 minus 40). 1082 1083 This is used to overcome criminally braindead ISPs or servers which 1084 block ICMP Fragmentation Needed packets. The symptoms of this 1085 problem are that everything works fine from your Linux 1086 firewall/router, but machines behind it can never exchange large 1087 packets: 1088 1) Web browsers connect, then hang with no data received. 1089 2) Small mail works fine, but large emails hang. 1090 3) ssh works fine, but scp hangs after initial handshaking. 1091 1092 Workaround: activate this option and add a rule to your firewall 1093 configuration like: 1094 1095 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1096 -j TCPMSS --clamp-mss-to-pmtu 1097 1098 To compile it as a module, choose M here. If unsure, say N. 1099 1100config NETFILTER_XT_TARGET_TCPOPTSTRIP 1101 tristate '"TCPOPTSTRIP" target support' 1102 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1103 depends on NETFILTER_ADVANCED 1104 help 1105 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1106 TCP options from TCP packets. 1107 1108# alphabetically ordered list of matches 1109 1110comment "Xtables matches" 1111 1112config NETFILTER_XT_MATCH_ADDRTYPE 1113 tristate '"addrtype" address type match support' 1114 default m if NETFILTER_ADVANCED=n 1115 help 1116 This option allows you to match what routing thinks of an address, 1117 eg. UNICAST, LOCAL, BROADCAST, ... 1118 1119 If you want to compile it as a module, say M here and read 1120 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1121 1122config NETFILTER_XT_MATCH_BPF 1123 tristate '"bpf" match support' 1124 depends on NETFILTER_ADVANCED 1125 help 1126 BPF matching applies a linux socket filter to each packet and 1127 accepts those for which the filter returns non-zero. 1128 1129 To compile it as a module, choose M here. If unsure, say N. 1130 1131config NETFILTER_XT_MATCH_CGROUP 1132 tristate '"control group" match support' 1133 depends on NETFILTER_ADVANCED 1134 depends on CGROUPS 1135 select CGROUP_NET_CLASSID 1136 help 1137 Socket/process control group matching allows you to match locally 1138 generated packets based on which net_cls control group processes 1139 belong to. 1140 1141config NETFILTER_XT_MATCH_CLUSTER 1142 tristate '"cluster" match support' 1143 depends on NF_CONNTRACK 1144 depends on NETFILTER_ADVANCED 1145 help 1146 This option allows you to build work-load-sharing clusters of 1147 network servers/stateful firewalls without having a dedicated 1148 load-balancing router/server/switch. Basically, this match returns 1149 true when the packet must be handled by this cluster node. Thus, 1150 all nodes see all packets and this match decides which node handles 1151 what packets. The work-load sharing algorithm is based on source 1152 address hashing. 1153 1154 If you say Y or M here, try `iptables -m cluster --help` for 1155 more information. 1156 1157config NETFILTER_XT_MATCH_COMMENT 1158 tristate '"comment" match support' 1159 depends on NETFILTER_ADVANCED 1160 help 1161 This option adds a `comment' dummy-match, which allows you to put 1162 comments in your iptables ruleset. 1163 1164 If you want to compile it as a module, say M here and read 1165 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1166 1167config NETFILTER_XT_MATCH_CONNBYTES 1168 tristate '"connbytes" per-connection counter match support' 1169 depends on NF_CONNTRACK 1170 depends on NETFILTER_ADVANCED 1171 help 1172 This option adds a `connbytes' match, which allows you to match the 1173 number of bytes and/or packets for each direction within a connection. 1174 1175 If you want to compile it as a module, say M here and read 1176 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1177 1178config NETFILTER_XT_MATCH_CONNLABEL 1179 tristate '"connlabel" match support' 1180 select NF_CONNTRACK_LABELS 1181 depends on NF_CONNTRACK 1182 depends on NETFILTER_ADVANCED 1183 help 1184 This match allows you to test and assign userspace-defined labels names 1185 to a connection. The kernel only stores bit values - mapping 1186 names to bits is done by userspace. 1187 1188 Unlike connmark, more than 32 flag bits may be assigned to a 1189 connection simultaneously. 1190 1191config NETFILTER_XT_MATCH_CONNLIMIT 1192 tristate '"connlimit" match support' 1193 depends on NF_CONNTRACK 1194 depends on NETFILTER_ADVANCED 1195 select NETFILTER_CONNCOUNT 1196 help 1197 This match allows you to match against the number of parallel 1198 connections to a server per client IP address (or address block). 1199 1200config NETFILTER_XT_MATCH_CONNMARK 1201 tristate '"connmark" connection mark match support' 1202 depends on NF_CONNTRACK 1203 depends on NETFILTER_ADVANCED 1204 select NETFILTER_XT_CONNMARK 1205 help 1206 This is a backwards-compat option for the user's convenience 1207 (e.g. when running oldconfig). It selects 1208 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1209 1210config NETFILTER_XT_MATCH_CONNTRACK 1211 tristate '"conntrack" connection tracking match support' 1212 depends on NF_CONNTRACK 1213 default m if NETFILTER_ADVANCED=n 1214 help 1215 This is a general conntrack match module, a superset of the state match. 1216 1217 It allows matching on additional conntrack information, which is 1218 useful in complex configurations, such as NAT gateways with multiple 1219 internet links or tunnels. 1220 1221 To compile it as a module, choose M here. If unsure, say N. 1222 1223config NETFILTER_XT_MATCH_CPU 1224 tristate '"cpu" match support' 1225 depends on NETFILTER_ADVANCED 1226 help 1227 CPU matching allows you to match packets based on the CPU 1228 currently handling the packet. 1229 1230 To compile it as a module, choose M here. If unsure, say N. 1231 1232config NETFILTER_XT_MATCH_DCCP 1233 tristate '"dccp" protocol match support' 1234 depends on NETFILTER_ADVANCED 1235 default IP_DCCP 1236 help 1237 With this option enabled, you will be able to use the iptables 1238 `dccp' match in order to match on DCCP source/destination ports 1239 and DCCP flags. 1240 1241 If you want to compile it as a module, say M here and read 1242 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1243 1244config NETFILTER_XT_MATCH_DEVGROUP 1245 tristate '"devgroup" match support' 1246 depends on NETFILTER_ADVANCED 1247 help 1248 This options adds a `devgroup' match, which allows to match on the 1249 device group a network device is assigned to. 1250 1251 To compile it as a module, choose M here. If unsure, say N. 1252 1253config NETFILTER_XT_MATCH_DSCP 1254 tristate '"dscp" and "tos" match support' 1255 depends on NETFILTER_ADVANCED 1256 help 1257 This option adds a `DSCP' match, which allows you to match against 1258 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1259 1260 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1261 1262 It will also add a "tos" match, which allows you to match packets 1263 based on the Type Of Service fields of the IPv4 packet (which share 1264 the same bits as DSCP). 1265 1266 To compile it as a module, choose M here. If unsure, say N. 1267 1268config NETFILTER_XT_MATCH_ECN 1269 tristate '"ecn" match support' 1270 depends on NETFILTER_ADVANCED 1271 help 1272 This option adds an "ECN" match, which allows you to match against 1273 the IPv4 and TCP header ECN fields. 1274 1275 To compile it as a module, choose M here. If unsure, say N. 1276 1277config NETFILTER_XT_MATCH_ESP 1278 tristate '"esp" match support' 1279 depends on NETFILTER_ADVANCED 1280 help 1281 This match extension allows you to match a range of SPIs 1282 inside ESP header of IPSec packets. 1283 1284 To compile it as a module, choose M here. If unsure, say N. 1285 1286config NETFILTER_XT_MATCH_HASHLIMIT 1287 tristate '"hashlimit" match support' 1288 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1289 depends on NETFILTER_ADVANCED 1290 help 1291 This option adds a `hashlimit' match. 1292 1293 As opposed to `limit', this match dynamically creates a hash table 1294 of limit buckets, based on your selection of source/destination 1295 addresses and/or ports. 1296 1297 It enables you to express policies like `10kpps for any given 1298 destination address' or `500pps from any given source address' 1299 with a single rule. 1300 1301config NETFILTER_XT_MATCH_HELPER 1302 tristate '"helper" match support' 1303 depends on NF_CONNTRACK 1304 depends on NETFILTER_ADVANCED 1305 help 1306 Helper matching allows you to match packets in dynamic connections 1307 tracked by a conntrack-helper, ie. nf_conntrack_ftp 1308 1309 To compile it as a module, choose M here. If unsure, say Y. 1310 1311config NETFILTER_XT_MATCH_HL 1312 tristate '"hl" hoplimit/TTL match support' 1313 depends on NETFILTER_ADVANCED 1314 help 1315 HL matching allows you to match packets based on the hoplimit 1316 in the IPv6 header, or the time-to-live field in the IPv4 1317 header of the packet. 1318 1319config NETFILTER_XT_MATCH_IPCOMP 1320 tristate '"ipcomp" match support' 1321 depends on NETFILTER_ADVANCED 1322 help 1323 This match extension allows you to match a range of CPIs(16 bits) 1324 inside IPComp header of IPSec packets. 1325 1326 To compile it as a module, choose M here. If unsure, say N. 1327 1328config NETFILTER_XT_MATCH_IPRANGE 1329 tristate '"iprange" address range match support' 1330 depends on NETFILTER_ADVANCED 1331 help 1332 This option adds a "iprange" match, which allows you to match based on 1333 an IP address range. (Normal iptables only matches on single addresses 1334 with an optional mask.) 1335 1336 If unsure, say M. 1337 1338config NETFILTER_XT_MATCH_IPVS 1339 tristate '"ipvs" match support' 1340 depends on IP_VS 1341 depends on NETFILTER_ADVANCED 1342 depends on NF_CONNTRACK 1343 help 1344 This option allows you to match against IPVS properties of a packet. 1345 1346 If unsure, say N. 1347 1348config NETFILTER_XT_MATCH_L2TP 1349 tristate '"l2tp" match support' 1350 depends on NETFILTER_ADVANCED 1351 default L2TP 1352 help 1353 This option adds an "L2TP" match, which allows you to match against 1354 L2TP protocol header fields. 1355 1356 To compile it as a module, choose M here. If unsure, say N. 1357 1358config NETFILTER_XT_MATCH_LENGTH 1359 tristate '"length" match support' 1360 depends on NETFILTER_ADVANCED 1361 help 1362 This option allows you to match the length of a packet against a 1363 specific value or range of values. 1364 1365 To compile it as a module, choose M here. If unsure, say N. 1366 1367config NETFILTER_XT_MATCH_LIMIT 1368 tristate '"limit" match support' 1369 depends on NETFILTER_ADVANCED 1370 help 1371 limit matching allows you to control the rate at which a rule can be 1372 matched: mainly useful in combination with the LOG target ("LOG 1373 target support", below) and to avoid some Denial of Service attacks. 1374 1375 To compile it as a module, choose M here. If unsure, say N. 1376 1377config NETFILTER_XT_MATCH_MAC 1378 tristate '"mac" address match support' 1379 depends on NETFILTER_ADVANCED 1380 help 1381 MAC matching allows you to match packets based on the source 1382 Ethernet address of the packet. 1383 1384 To compile it as a module, choose M here. If unsure, say N. 1385 1386config NETFILTER_XT_MATCH_MARK 1387 tristate '"mark" match support' 1388 depends on NETFILTER_ADVANCED 1389 select NETFILTER_XT_MARK 1390 help 1391 This is a backwards-compat option for the user's convenience 1392 (e.g. when running oldconfig). It selects 1393 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1394 1395config NETFILTER_XT_MATCH_MULTIPORT 1396 tristate '"multiport" Multiple port match support' 1397 depends on NETFILTER_ADVANCED 1398 help 1399 Multiport matching allows you to match TCP or UDP packets based on 1400 a series of source or destination ports: normally a rule can only 1401 match a single range of ports. 1402 1403 To compile it as a module, choose M here. If unsure, say N. 1404 1405config NETFILTER_XT_MATCH_NFACCT 1406 tristate '"nfacct" match support' 1407 depends on NETFILTER_ADVANCED 1408 select NETFILTER_NETLINK_ACCT 1409 help 1410 This option allows you to use the extended accounting through 1411 nfnetlink_acct. 1412 1413 To compile it as a module, choose M here. If unsure, say N. 1414 1415config NETFILTER_XT_MATCH_OSF 1416 tristate '"osf" Passive OS fingerprint match' 1417 depends on NETFILTER_ADVANCED 1418 select NETFILTER_NETLINK_OSF 1419 help 1420 This option selects the Passive OS Fingerprinting match module 1421 that allows to passively match the remote operating system by 1422 analyzing incoming TCP SYN packets. 1423 1424 Rules and loading software can be downloaded from 1425 http://www.ioremap.net/projects/osf 1426 1427 To compile it as a module, choose M here. If unsure, say N. 1428 1429config NETFILTER_XT_MATCH_OWNER 1430 tristate '"owner" match support' 1431 depends on NETFILTER_ADVANCED 1432 help 1433 Socket owner matching allows you to match locally-generated packets 1434 based on who created the socket: the user or group. It is also 1435 possible to check whether a socket actually exists. 1436 1437config NETFILTER_XT_MATCH_POLICY 1438 tristate 'IPsec "policy" match support' 1439 depends on XFRM 1440 default m if NETFILTER_ADVANCED=n 1441 help 1442 Policy matching allows you to match packets based on the 1443 IPsec policy that was used during decapsulation/will 1444 be used during encapsulation. 1445 1446 To compile it as a module, choose M here. If unsure, say N. 1447 1448config NETFILTER_XT_MATCH_PHYSDEV 1449 tristate '"physdev" match support' 1450 depends on BRIDGE && BRIDGE_NETFILTER 1451 depends on NETFILTER_ADVANCED 1452 help 1453 Physdev packet matching matches against the physical bridge ports 1454 the IP packet arrived on or will leave by. 1455 1456 To compile it as a module, choose M here. If unsure, say N. 1457 1458config NETFILTER_XT_MATCH_PKTTYPE 1459 tristate '"pkttype" packet type match support' 1460 depends on NETFILTER_ADVANCED 1461 help 1462 Packet type matching allows you to match a packet by 1463 its "class", eg. BROADCAST, MULTICAST, ... 1464 1465 Typical usage: 1466 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1467 1468 To compile it as a module, choose M here. If unsure, say N. 1469 1470config NETFILTER_XT_MATCH_QUOTA 1471 tristate '"quota" match support' 1472 depends on NETFILTER_ADVANCED 1473 help 1474 This option adds a `quota' match, which allows to match on a 1475 byte counter. 1476 1477 If you want to compile it as a module, say M here and read 1478 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1479 1480config NETFILTER_XT_MATCH_RATEEST 1481 tristate '"rateest" match support' 1482 depends on NETFILTER_ADVANCED 1483 select NETFILTER_XT_TARGET_RATEEST 1484 help 1485 This option adds a `rateest' match, which allows to match on the 1486 rate estimated by the RATEEST target. 1487 1488 To compile it as a module, choose M here. If unsure, say N. 1489 1490config NETFILTER_XT_MATCH_REALM 1491 tristate '"realm" match support' 1492 depends on NETFILTER_ADVANCED 1493 select IP_ROUTE_CLASSID 1494 help 1495 This option adds a `realm' match, which allows you to use the realm 1496 key from the routing subsystem inside iptables. 1497 1498 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1499 in tc world. 1500 1501 If you want to compile it as a module, say M here and read 1502 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1503 1504config NETFILTER_XT_MATCH_RECENT 1505 tristate '"recent" match support' 1506 depends on NETFILTER_ADVANCED 1507 help 1508 This match is used for creating one or many lists of recently 1509 used addresses and then matching against that/those list(s). 1510 1511 Short options are available by using 'iptables -m recent -h' 1512 Official Website: <http://snowman.net/projects/ipt_recent/> 1513 1514config NETFILTER_XT_MATCH_SCTP 1515 tristate '"sctp" protocol match support' 1516 depends on NETFILTER_ADVANCED 1517 default IP_SCTP 1518 help 1519 With this option enabled, you will be able to use the 1520 `sctp' match in order to match on SCTP source/destination ports 1521 and SCTP chunk types. 1522 1523 If you want to compile it as a module, say M here and read 1524 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1525 1526config NETFILTER_XT_MATCH_SOCKET 1527 tristate '"socket" match support' 1528 depends on NETFILTER_XTABLES 1529 depends on NETFILTER_ADVANCED 1530 depends on IPV6 || IPV6=n 1531 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1532 select NF_SOCKET_IPV4 1533 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES 1534 select NF_DEFRAG_IPV4 1535 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1536 help 1537 This option adds a `socket' match, which can be used to match 1538 packets for which a TCP or UDP socket lookup finds a valid socket. 1539 It can be used in combination with the MARK target and policy 1540 routing to implement full featured non-locally bound sockets. 1541 1542 To compile it as a module, choose M here. If unsure, say N. 1543 1544config NETFILTER_XT_MATCH_STATE 1545 tristate '"state" match support' 1546 depends on NF_CONNTRACK 1547 default m if NETFILTER_ADVANCED=n 1548 help 1549 Connection state matching allows you to match packets based on their 1550 relationship to a tracked connection (ie. previous packets). This 1551 is a powerful tool for packet classification. 1552 1553 To compile it as a module, choose M here. If unsure, say N. 1554 1555config NETFILTER_XT_MATCH_STATISTIC 1556 tristate '"statistic" match support' 1557 depends on NETFILTER_ADVANCED 1558 help 1559 This option adds a `statistic' match, which allows you to match 1560 on packets periodically or randomly with a given percentage. 1561 1562 To compile it as a module, choose M here. If unsure, say N. 1563 1564config NETFILTER_XT_MATCH_STRING 1565 tristate '"string" match support' 1566 depends on NETFILTER_ADVANCED 1567 select TEXTSEARCH 1568 select TEXTSEARCH_KMP 1569 select TEXTSEARCH_BM 1570 select TEXTSEARCH_FSM 1571 help 1572 This option adds a `string' match, which allows you to look for 1573 pattern matchings in packets. 1574 1575 To compile it as a module, choose M here. If unsure, say N. 1576 1577config NETFILTER_XT_MATCH_TCPMSS 1578 tristate '"tcpmss" match support' 1579 depends on NETFILTER_ADVANCED 1580 help 1581 This option adds a `tcpmss' match, which allows you to examine the 1582 MSS value of TCP SYN packets, which control the maximum packet size 1583 for that connection. 1584 1585 To compile it as a module, choose M here. If unsure, say N. 1586 1587config NETFILTER_XT_MATCH_TIME 1588 tristate '"time" match support' 1589 depends on NETFILTER_ADVANCED 1590 help 1591 This option adds a "time" match, which allows you to match based on 1592 the packet arrival time (at the machine which netfilter is running) 1593 on) or departure time/date (for locally generated packets). 1594 1595 If you say Y here, try `iptables -m time --help` for 1596 more information. 1597 1598 If you want to compile it as a module, say M here. 1599 If unsure, say N. 1600 1601config NETFILTER_XT_MATCH_U32 1602 tristate '"u32" match support' 1603 depends on NETFILTER_ADVANCED 1604 help 1605 u32 allows you to extract quantities of up to 4 bytes from a packet, 1606 AND them with specified masks, shift them by specified amounts and 1607 test whether the results are in any of a set of specified ranges. 1608 The specification of what to extract is general enough to skip over 1609 headers with lengths stored in the packet, as in IP or TCP header 1610 lengths. 1611 1612 Details and examples are in the kernel module source. 1613 1614endif # NETFILTER_XTABLES 1615 1616endmenu 1617 1618source "net/netfilter/ipset/Kconfig" 1619 1620source "net/netfilter/ipvs/Kconfig" 1621
