Kconfig (54508B)
1# SPDX-License-Identifier: GPL-2.0-only 2menu "Core Netfilter Configuration" 3 depends on INET && NETFILTER 4 5config NETFILTER_INGRESS 6 bool "Netfilter ingress support" 7 default y 8 select NET_INGRESS 9 help 10 This allows you to classify packets from ingress using the Netfilter 11 infrastructure. 12 13config NETFILTER_EGRESS 14 bool "Netfilter egress support" 15 default y 16 select NET_EGRESS 17 help 18 This allows you to classify packets before transmission using the 19 Netfilter infrastructure. 20 21config NETFILTER_SKIP_EGRESS 22 def_bool NETFILTER_EGRESS && (NET_CLS_ACT || IFB) 23 24config NETFILTER_NETLINK 25 tristate 26 27config NETFILTER_FAMILY_BRIDGE 28 bool 29 30config NETFILTER_FAMILY_ARP 31 bool 32 33config NETFILTER_NETLINK_HOOK 34 tristate "Netfilter base hook dump support" 35 depends on NETFILTER_ADVANCED 36 depends on NF_TABLES 37 select NETFILTER_NETLINK 38 help 39 If this option is enabled, the kernel will include support 40 to list the base netfilter hooks via NFNETLINK. 41 This is helpful for debugging. 42 43config NETFILTER_NETLINK_ACCT 44 tristate "Netfilter NFACCT over NFNETLINK interface" 45 depends on NETFILTER_ADVANCED 46 select NETFILTER_NETLINK 47 help 48 If this option is enabled, the kernel will include support 49 for extended accounting via NFNETLINK. 50 51config NETFILTER_NETLINK_QUEUE 52 tristate "Netfilter NFQUEUE over NFNETLINK interface" 53 depends on NETFILTER_ADVANCED 54 select NETFILTER_NETLINK 55 help 56 If this option is enabled, the kernel will include support 57 for queueing packets via NFNETLINK. 58 59config NETFILTER_NETLINK_LOG 60 tristate "Netfilter LOG over NFNETLINK interface" 61 default m if NETFILTER_ADVANCED=n 62 select NETFILTER_NETLINK 63 help 64 If this option is enabled, the kernel will include support 65 for logging packets via NFNETLINK. 66 67 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 68 and is also scheduled to replace the old syslog-based ipt_LOG 69 and ip6t_LOG modules. 70 71config NETFILTER_NETLINK_OSF 72 tristate "Netfilter OSF over NFNETLINK interface" 73 depends on NETFILTER_ADVANCED 74 select NETFILTER_NETLINK 75 help 76 If this option is enabled, the kernel will include support 77 for passive OS fingerprint via NFNETLINK. 78 79config NF_CONNTRACK 80 tristate "Netfilter connection tracking support" 81 default m if NETFILTER_ADVANCED=n 82 select NF_DEFRAG_IPV4 83 select NF_DEFRAG_IPV6 if IPV6 != n 84 help 85 Connection tracking keeps a record of what packets have passed 86 through your machine, in order to figure out how they are related 87 into connections. 88 89 This is required to do Masquerading or other kinds of Network 90 Address Translation. It can also be used to enhance packet 91 filtering (see `Connection state match support' below). 92 93 To compile it as a module, choose M here. If unsure, say N. 94 95config NF_LOG_SYSLOG 96 tristate "Syslog packet logging" 97 default m if NETFILTER_ADVANCED=n 98 help 99 This option enable support for packet logging via syslog. 100 It supports IPv4, IPV6, ARP and common transport protocols such 101 as TCP and UDP. 102 This is a simpler but less flexible logging method compared to 103 CONFIG_NETFILTER_NETLINK_LOG. 104 If both are enabled the backend to use can be configured at run-time 105 by means of per-address-family sysctl tunables. 106 107if NF_CONNTRACK 108config NETFILTER_CONNCOUNT 109 tristate 110 111config NF_CONNTRACK_MARK 112 bool 'Connection mark tracking support' 113 depends on NETFILTER_ADVANCED 114 help 115 This option enables support for connection marks, used by the 116 `CONNMARK' target and `connmark' match. Similar to the mark value 117 of packets, but this mark value is kept in the conntrack session 118 instead of the individual packets. 119 120config NF_CONNTRACK_SECMARK 121 bool 'Connection tracking security mark support' 122 depends on NETWORK_SECMARK 123 default y if NETFILTER_ADVANCED=n 124 help 125 This option enables security markings to be applied to 126 connections. Typically they are copied to connections from 127 packets using the CONNSECMARK target and copied back from 128 connections to packets with the same target, with the packets 129 being originally labeled via SECMARK. 130 131 If unsure, say 'N'. 132 133config NF_CONNTRACK_ZONES 134 bool 'Connection tracking zones' 135 depends on NETFILTER_ADVANCED 136 help 137 This option enables support for connection tracking zones. 138 Normally, each connection needs to have a unique system wide 139 identity. Connection tracking zones allow to have multiple 140 connections using the same identity, as long as they are 141 contained in different zones. 142 143 If unsure, say `N'. 144 145config NF_CONNTRACK_PROCFS 146 bool "Supply CT list in procfs (OBSOLETE)" 147 default y 148 depends on PROC_FS 149 help 150 This option enables for the list of known conntrack entries 151 to be shown in procfs under net/netfilter/nf_conntrack. This 152 is considered obsolete in favor of using the conntrack(8) 153 tool which uses Netlink. 154 155config NF_CONNTRACK_EVENTS 156 bool "Connection tracking events" 157 depends on NETFILTER_ADVANCED 158 help 159 If this option is enabled, the connection tracking code will 160 provide a notifier chain that can be used by other kernel code 161 to get notified about changes in the connection tracking state. 162 163 If unsure, say `N'. 164 165config NF_CONNTRACK_TIMEOUT 166 bool 'Connection tracking timeout' 167 depends on NETFILTER_ADVANCED 168 help 169 This option enables support for connection tracking timeout 170 extension. This allows you to attach timeout policies to flow 171 via the CT target. 172 173 If unsure, say `N'. 174 175config NF_CONNTRACK_TIMESTAMP 176 bool 'Connection tracking timestamping' 177 depends on NETFILTER_ADVANCED 178 help 179 This option enables support for connection tracking timestamping. 180 This allows you to store the flow start-time and to obtain 181 the flow-stop time (once it has been destroyed) via Connection 182 tracking events. 183 184 If unsure, say `N'. 185 186config NF_CONNTRACK_LABELS 187 bool "Connection tracking labels" 188 help 189 This option enables support for assigning user-defined flag bits 190 to connection tracking entries. It can be used with xtables connlabel 191 match and the nftables ct expression. 192 193config NF_CT_PROTO_DCCP 194 bool 'DCCP protocol connection tracking support' 195 depends on NETFILTER_ADVANCED 196 default y 197 help 198 With this option enabled, the layer 3 independent connection 199 tracking code will be able to do state tracking on DCCP connections. 200 201 If unsure, say Y. 202 203config NF_CT_PROTO_GRE 204 bool 205 206config NF_CT_PROTO_SCTP 207 bool 'SCTP protocol connection tracking support' 208 depends on NETFILTER_ADVANCED 209 default y 210 select LIBCRC32C 211 help 212 With this option enabled, the layer 3 independent connection 213 tracking code will be able to do state tracking on SCTP connections. 214 215 If unsure, say Y. 216 217config NF_CT_PROTO_UDPLITE 218 bool 'UDP-Lite protocol connection tracking support' 219 depends on NETFILTER_ADVANCED 220 default y 221 help 222 With this option enabled, the layer 3 independent connection 223 tracking code will be able to do state tracking on UDP-Lite 224 connections. 225 226 If unsure, say Y. 227 228config NF_CONNTRACK_AMANDA 229 tristate "Amanda backup protocol support" 230 depends on NETFILTER_ADVANCED 231 select TEXTSEARCH 232 select TEXTSEARCH_KMP 233 help 234 If you are running the Amanda backup package <http://www.amanda.org/> 235 on this machine or machines that will be MASQUERADED through this 236 machine, then you may want to enable this feature. This allows the 237 connection tracking and natting code to allow the sub-channels that 238 Amanda requires for communication of the backup data, messages and 239 index. 240 241 To compile it as a module, choose M here. If unsure, say N. 242 243config NF_CONNTRACK_FTP 244 tristate "FTP protocol support" 245 default m if NETFILTER_ADVANCED=n 246 help 247 Tracking FTP connections is problematic: special helpers are 248 required for tracking them, and doing masquerading and other forms 249 of Network Address Translation on them. 250 251 This is FTP support on Layer 3 independent connection tracking. 252 253 To compile it as a module, choose M here. If unsure, say N. 254 255config NF_CONNTRACK_H323 256 tristate "H.323 protocol support" 257 depends on IPV6 || IPV6=n 258 depends on NETFILTER_ADVANCED 259 help 260 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 261 important VoIP protocols, it is widely used by voice hardware and 262 software including voice gateways, IP phones, Netmeeting, OpenPhone, 263 Gnomemeeting, etc. 264 265 With this module you can support H.323 on a connection tracking/NAT 266 firewall. 267 268 This module supports RAS, Fast Start, H.245 Tunnelling, Call 269 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 270 whiteboard, file transfer, etc. For more information, please 271 visit http://nath323.sourceforge.net/. 272 273 To compile it as a module, choose M here. If unsure, say N. 274 275config NF_CONNTRACK_IRC 276 tristate "IRC protocol support" 277 default m if NETFILTER_ADVANCED=n 278 help 279 There is a commonly-used extension to IRC called 280 Direct Client-to-Client Protocol (DCC). This enables users to send 281 files to each other, and also chat to each other without the need 282 of a server. DCC Sending is used anywhere you send files over IRC, 283 and DCC Chat is most commonly used by Eggdrop bots. If you are 284 using NAT, this extension will enable you to send files and initiate 285 chats. Note that you do NOT need this extension to get files or 286 have others initiate chats, or everything else in IRC. 287 288 To compile it as a module, choose M here. If unsure, say N. 289 290config NF_CONNTRACK_BROADCAST 291 tristate 292 293config NF_CONNTRACK_NETBIOS_NS 294 tristate "NetBIOS name service protocol support" 295 select NF_CONNTRACK_BROADCAST 296 help 297 NetBIOS name service requests are sent as broadcast messages from an 298 unprivileged port and responded to with unicast messages to the 299 same port. This make them hard to firewall properly because connection 300 tracking doesn't deal with broadcasts. This helper tracks locally 301 originating NetBIOS name service requests and the corresponding 302 responses. It relies on correct IP address configuration, specifically 303 netmask and broadcast address. When properly configured, the output 304 of "ip address show" should look similar to this: 305 306 $ ip -4 address show eth0 307 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 308 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 309 310 To compile it as a module, choose M here. If unsure, say N. 311 312config NF_CONNTRACK_SNMP 313 tristate "SNMP service protocol support" 314 depends on NETFILTER_ADVANCED 315 select NF_CONNTRACK_BROADCAST 316 help 317 SNMP service requests are sent as broadcast messages from an 318 unprivileged port and responded to with unicast messages to the 319 same port. This make them hard to firewall properly because connection 320 tracking doesn't deal with broadcasts. This helper tracks locally 321 originating SNMP service requests and the corresponding 322 responses. It relies on correct IP address configuration, specifically 323 netmask and broadcast address. 324 325 To compile it as a module, choose M here. If unsure, say N. 326 327config NF_CONNTRACK_PPTP 328 tristate "PPtP protocol support" 329 depends on NETFILTER_ADVANCED 330 select NF_CT_PROTO_GRE 331 help 332 This module adds support for PPTP (Point to Point Tunnelling 333 Protocol, RFC2637) connection tracking and NAT. 334 335 If you are running PPTP sessions over a stateful firewall or NAT 336 box, you may want to enable this feature. 337 338 Please note that not all PPTP modes of operation are supported yet. 339 Specifically these limitations exist: 340 - Blindly assumes that control connections are always established 341 in PNS->PAC direction. This is a violation of RFC2637. 342 - Only supports a single call within each session 343 344 To compile it as a module, choose M here. If unsure, say N. 345 346config NF_CONNTRACK_SANE 347 tristate "SANE protocol support" 348 depends on NETFILTER_ADVANCED 349 help 350 SANE is a protocol for remote access to scanners as implemented 351 by the 'saned' daemon. Like FTP, it uses separate control and 352 data connections. 353 354 With this module you can support SANE on a connection tracking 355 firewall. 356 357 To compile it as a module, choose M here. If unsure, say N. 358 359config NF_CONNTRACK_SIP 360 tristate "SIP protocol support" 361 default m if NETFILTER_ADVANCED=n 362 help 363 SIP is an application-layer control protocol that can establish, 364 modify, and terminate multimedia sessions (conferences) such as 365 Internet telephony calls. With the nf_conntrack_sip and 366 the nf_nat_sip modules you can support the protocol on a connection 367 tracking/NATing firewall. 368 369 To compile it as a module, choose M here. If unsure, say N. 370 371config NF_CONNTRACK_TFTP 372 tristate "TFTP protocol support" 373 depends on NETFILTER_ADVANCED 374 help 375 TFTP connection tracking helper, this is required depending 376 on how restrictive your ruleset is. 377 If you are using a tftp client behind -j SNAT or -j MASQUERADING 378 you will need this. 379 380 To compile it as a module, choose M here. If unsure, say N. 381 382config NF_CT_NETLINK 383 tristate 'Connection tracking netlink interface' 384 select NETFILTER_NETLINK 385 default m if NETFILTER_ADVANCED=n 386 help 387 This option enables support for a netlink-based userspace interface 388 389config NF_CT_NETLINK_TIMEOUT 390 tristate 'Connection tracking timeout tuning via Netlink' 391 select NETFILTER_NETLINK 392 depends on NETFILTER_ADVANCED 393 depends on NF_CONNTRACK_TIMEOUT 394 help 395 This option enables support for connection tracking timeout 396 fine-grain tuning. This allows you to attach specific timeout 397 policies to flows, instead of using the global timeout policy. 398 399 If unsure, say `N'. 400 401config NF_CT_NETLINK_HELPER 402 tristate 'Connection tracking helpers in user-space via Netlink' 403 select NETFILTER_NETLINK 404 depends on NF_CT_NETLINK 405 depends on NETFILTER_NETLINK_QUEUE 406 depends on NETFILTER_NETLINK_GLUE_CT 407 depends on NETFILTER_ADVANCED 408 help 409 This option enables the user-space connection tracking helpers 410 infrastructure. 411 412 If unsure, say `N'. 413 414config NETFILTER_NETLINK_GLUE_CT 415 bool "NFQUEUE and NFLOG integration with Connection Tracking" 416 default n 417 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK 418 help 419 If this option is enabled, NFQUEUE and NFLOG can include 420 Connection Tracking information together with the packet is 421 the enqueued via NFNETLINK. 422 423config NF_NAT 424 tristate "Network Address Translation support" 425 depends on NF_CONNTRACK 426 default m if NETFILTER_ADVANCED=n 427 help 428 The NAT option allows masquerading, port forwarding and other 429 forms of full Network Address Port Translation. This can be 430 controlled by iptables, ip6tables or nft. 431 432config NF_NAT_AMANDA 433 tristate 434 depends on NF_CONNTRACK && NF_NAT 435 default NF_NAT && NF_CONNTRACK_AMANDA 436 437config NF_NAT_FTP 438 tristate 439 depends on NF_CONNTRACK && NF_NAT 440 default NF_NAT && NF_CONNTRACK_FTP 441 442config NF_NAT_IRC 443 tristate 444 depends on NF_CONNTRACK && NF_NAT 445 default NF_NAT && NF_CONNTRACK_IRC 446 447config NF_NAT_SIP 448 tristate 449 depends on NF_CONNTRACK && NF_NAT 450 default NF_NAT && NF_CONNTRACK_SIP 451 452config NF_NAT_TFTP 453 tristate 454 depends on NF_CONNTRACK && NF_NAT 455 default NF_NAT && NF_CONNTRACK_TFTP 456 457config NF_NAT_REDIRECT 458 bool 459 460config NF_NAT_MASQUERADE 461 bool 462 463config NETFILTER_SYNPROXY 464 tristate 465 466endif # NF_CONNTRACK 467 468config NF_TABLES 469 select NETFILTER_NETLINK 470 select LIBCRC32C 471 tristate "Netfilter nf_tables support" 472 help 473 nftables is the new packet classification framework that intends to 474 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It 475 provides a pseudo-state machine with an extensible instruction-set 476 (also known as expressions) that the userspace 'nft' utility 477 (https://www.netfilter.org/projects/nftables) uses to build the 478 rule-set. It also comes with the generic set infrastructure that 479 allows you to construct mappings between matchings and actions 480 for performance lookups. 481 482 To compile it as a module, choose M here. 483 484if NF_TABLES 485config NF_TABLES_INET 486 depends on IPV6 487 select NF_TABLES_IPV4 488 select NF_TABLES_IPV6 489 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support" 490 help 491 This option enables support for a mixed IPv4/IPv6 "inet" table. 492 493config NF_TABLES_NETDEV 494 bool "Netfilter nf_tables netdev tables support" 495 help 496 This option enables support for the "netdev" table. 497 498config NFT_NUMGEN 499 tristate "Netfilter nf_tables number generator module" 500 help 501 This option adds the number generator expression used to perform 502 incremental counting and random numbers bound to a upper limit. 503 504config NFT_CT 505 depends on NF_CONNTRACK 506 tristate "Netfilter nf_tables conntrack module" 507 help 508 This option adds the "ct" expression that you can use to match 509 connection tracking information such as the flow state. 510 511config NFT_FLOW_OFFLOAD 512 depends on NF_CONNTRACK && NF_FLOW_TABLE 513 tristate "Netfilter nf_tables hardware flow offload module" 514 help 515 This option adds the "flow_offload" expression that you can use to 516 choose what flows are placed into the hardware. 517 518config NFT_CONNLIMIT 519 tristate "Netfilter nf_tables connlimit module" 520 depends on NF_CONNTRACK 521 depends on NETFILTER_ADVANCED 522 select NETFILTER_CONNCOUNT 523 help 524 This option adds the "connlimit" expression that you can use to 525 ratelimit rule matchings per connections. 526 527config NFT_LOG 528 tristate "Netfilter nf_tables log module" 529 help 530 This option adds the "log" expression that you can use to log 531 packets matching some criteria. 532 533config NFT_LIMIT 534 tristate "Netfilter nf_tables limit module" 535 help 536 This option adds the "limit" expression that you can use to 537 ratelimit rule matchings. 538 539config NFT_MASQ 540 depends on NF_CONNTRACK 541 depends on NF_NAT 542 select NF_NAT_MASQUERADE 543 tristate "Netfilter nf_tables masquerade support" 544 help 545 This option adds the "masquerade" expression that you can use 546 to perform NAT in the masquerade flavour. 547 548config NFT_REDIR 549 depends on NF_CONNTRACK 550 depends on NF_NAT 551 tristate "Netfilter nf_tables redirect support" 552 select NF_NAT_REDIRECT 553 help 554 This options adds the "redirect" expression that you can use 555 to perform NAT in the redirect flavour. 556 557config NFT_NAT 558 depends on NF_CONNTRACK 559 select NF_NAT 560 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6 561 tristate "Netfilter nf_tables nat module" 562 help 563 This option adds the "nat" expression that you can use to perform 564 typical Network Address Translation (NAT) packet transformations. 565 566config NFT_TUNNEL 567 tristate "Netfilter nf_tables tunnel module" 568 help 569 This option adds the "tunnel" expression that you can use to set 570 tunneling policies. 571 572config NFT_OBJREF 573 tristate "Netfilter nf_tables stateful object reference module" 574 help 575 This option adds the "objref" expression that allows you to refer to 576 stateful objects, such as counters and quotas. 577 578config NFT_QUEUE 579 depends on NETFILTER_NETLINK_QUEUE 580 tristate "Netfilter nf_tables queue module" 581 help 582 This is required if you intend to use the userspace queueing 583 infrastructure (also known as NFQUEUE) from nftables. 584 585config NFT_QUOTA 586 tristate "Netfilter nf_tables quota module" 587 help 588 This option adds the "quota" expression that you can use to match 589 enforce bytes quotas. 590 591config NFT_REJECT 592 default m if NETFILTER_ADVANCED=n 593 tristate "Netfilter nf_tables reject support" 594 depends on !NF_TABLES_INET || (IPV6!=m || m) 595 help 596 This option adds the "reject" expression that you can use to 597 explicitly deny and notify via TCP reset/ICMP informational errors 598 unallowed traffic. 599 600config NFT_REJECT_INET 601 depends on NF_TABLES_INET 602 default NFT_REJECT 603 tristate 604 605config NFT_COMPAT 606 depends on NETFILTER_XTABLES 607 tristate "Netfilter x_tables over nf_tables module" 608 help 609 This is required if you intend to use any of existing 610 x_tables match/target extensions over the nf_tables 611 framework. 612 613config NFT_HASH 614 tristate "Netfilter nf_tables hash module" 615 help 616 This option adds the "hash" expression that you can use to perform 617 a hash operation on registers. 618 619config NFT_FIB 620 tristate 621 622config NFT_FIB_INET 623 depends on NF_TABLES_INET 624 depends on NFT_FIB_IPV4 625 depends on NFT_FIB_IPV6 626 tristate "Netfilter nf_tables fib inet support" 627 help 628 This option allows using the FIB expression from the inet table. 629 The lookup will be delegated to the IPv4 or IPv6 FIB depending 630 on the protocol of the packet. 631 632config NFT_XFRM 633 tristate "Netfilter nf_tables xfrm/IPSec security association matching" 634 depends on XFRM 635 help 636 This option adds an expression that you can use to extract properties 637 of a packets security association. 638 639config NFT_SOCKET 640 tristate "Netfilter nf_tables socket match support" 641 depends on IPV6 || IPV6=n 642 select NF_SOCKET_IPV4 643 select NF_SOCKET_IPV6 if NF_TABLES_IPV6 644 help 645 This option allows matching for the presence or absence of a 646 corresponding socket and its attributes. 647 648config NFT_OSF 649 tristate "Netfilter nf_tables passive OS fingerprint support" 650 depends on NETFILTER_ADVANCED 651 select NETFILTER_NETLINK_OSF 652 help 653 This option allows matching packets from an specific OS. 654 655config NFT_TPROXY 656 tristate "Netfilter nf_tables tproxy support" 657 depends on IPV6 || IPV6=n 658 select NF_DEFRAG_IPV4 659 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6 660 select NF_TPROXY_IPV4 661 select NF_TPROXY_IPV6 if NF_TABLES_IPV6 662 help 663 This makes transparent proxy support available in nftables. 664 665config NFT_SYNPROXY 666 tristate "Netfilter nf_tables SYNPROXY expression support" 667 depends on NF_CONNTRACK && NETFILTER_ADVANCED 668 select NETFILTER_SYNPROXY 669 select SYN_COOKIES 670 help 671 The SYNPROXY expression allows you to intercept TCP connections and 672 establish them using syncookies before they are passed on to the 673 server. This allows to avoid conntrack and server resource usage 674 during SYN-flood attacks. 675 676if NF_TABLES_NETDEV 677 678config NF_DUP_NETDEV 679 tristate "Netfilter packet duplication support" 680 help 681 This option enables the generic packet duplication infrastructure 682 for Netfilter. 683 684config NFT_DUP_NETDEV 685 tristate "Netfilter nf_tables netdev packet duplication support" 686 select NF_DUP_NETDEV 687 help 688 This option enables packet duplication for the "netdev" family. 689 690config NFT_FWD_NETDEV 691 tristate "Netfilter nf_tables netdev packet forwarding support" 692 select NF_DUP_NETDEV 693 help 694 This option enables packet forwarding for the "netdev" family. 695 696config NFT_FIB_NETDEV 697 depends on NFT_FIB_IPV4 698 depends on NFT_FIB_IPV6 699 tristate "Netfilter nf_tables netdev fib lookups support" 700 help 701 This option allows using the FIB expression from the netdev table. 702 The lookup will be delegated to the IPv4 or IPv6 FIB depending 703 on the protocol of the packet. 704 705config NFT_REJECT_NETDEV 706 depends on NFT_REJECT_IPV4 707 depends on NFT_REJECT_IPV6 708 tristate "Netfilter nf_tables netdev REJECT support" 709 help 710 This option enables the REJECT support from the netdev table. 711 The return packet generation will be delegated to the IPv4 712 or IPv6 ICMP or TCP RST implementation depending on the 713 protocol of the packet. 714 715endif # NF_TABLES_NETDEV 716 717endif # NF_TABLES 718 719config NF_FLOW_TABLE_INET 720 tristate "Netfilter flow table mixed IPv4/IPv6 module" 721 depends on NF_FLOW_TABLE 722 help 723 This option adds the flow table mixed IPv4/IPv6 support. 724 725 To compile it as a module, choose M here. 726 727config NF_FLOW_TABLE 728 tristate "Netfilter flow table module" 729 depends on NETFILTER_INGRESS 730 depends on NF_CONNTRACK 731 depends on NF_TABLES 732 help 733 This option adds the flow table core infrastructure. 734 735 To compile it as a module, choose M here. 736 737config NETFILTER_XTABLES 738 tristate "Netfilter Xtables support (required for ip_tables)" 739 default m if NETFILTER_ADVANCED=n 740 help 741 This is required if you intend to use any of ip_tables, 742 ip6_tables or arp_tables. 743 744if NETFILTER_XTABLES 745 746config NETFILTER_XTABLES_COMPAT 747 bool "Netfilter Xtables 32bit support" 748 depends on COMPAT 749 default y 750 help 751 This option provides a translation layer to run 32bit arp,ip(6),ebtables 752 binaries on 64bit kernels. 753 754 If unsure, say N. 755 756comment "Xtables combined modules" 757 758config NETFILTER_XT_MARK 759 tristate 'nfmark target and match support' 760 default m if NETFILTER_ADVANCED=n 761 help 762 This option adds the "MARK" target and "mark" match. 763 764 Netfilter mark matching allows you to match packets based on the 765 "nfmark" value in the packet. 766 The target allows you to create rules in the "mangle" table which alter 767 the netfilter mark (nfmark) field associated with the packet. 768 769 Prior to routing, the nfmark can influence the routing method and can 770 also be used by other subsystems to change their behavior. 771 772config NETFILTER_XT_CONNMARK 773 tristate 'ctmark target and match support' 774 depends on NF_CONNTRACK 775 depends on NETFILTER_ADVANCED 776 select NF_CONNTRACK_MARK 777 help 778 This option adds the "CONNMARK" target and "connmark" match. 779 780 Netfilter allows you to store a mark value per connection (a.k.a. 781 ctmark), similarly to the packet mark (nfmark). Using this 782 target and match, you can set and match on this mark. 783 784config NETFILTER_XT_SET 785 tristate 'set target and match support' 786 depends on IP_SET 787 depends on NETFILTER_ADVANCED 788 help 789 This option adds the "SET" target and "set" match. 790 791 Using this target and match, you can add/delete and match 792 elements in the sets created by ipset(8). 793 794 To compile it as a module, choose M here. If unsure, say N. 795 796# alphabetically ordered list of targets 797 798comment "Xtables targets" 799 800config NETFILTER_XT_TARGET_AUDIT 801 tristate "AUDIT target support" 802 depends on AUDIT 803 depends on NETFILTER_ADVANCED 804 help 805 This option adds a 'AUDIT' target, which can be used to create 806 audit records for packets dropped/accepted. 807 808 To compileit as a module, choose M here. If unsure, say N. 809 810config NETFILTER_XT_TARGET_CHECKSUM 811 tristate "CHECKSUM target support" 812 depends on IP_NF_MANGLE || IP6_NF_MANGLE 813 depends on NETFILTER_ADVANCED 814 help 815 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 816 table to work around buggy DHCP clients in virtualized environments. 817 818 Some old DHCP clients drop packets because they are not aware 819 that the checksum would normally be offloaded to hardware and 820 thus should be considered valid. 821 This target can be used to fill in the checksum using iptables 822 when such packets are sent via a virtual network device. 823 824 To compile it as a module, choose M here. If unsure, say N. 825 826config NETFILTER_XT_TARGET_CLASSIFY 827 tristate '"CLASSIFY" target support' 828 depends on NETFILTER_ADVANCED 829 help 830 This option adds a `CLASSIFY' target, which enables the user to set 831 the priority of a packet. Some qdiscs can use this value for 832 classification, among these are: 833 834 atm, cbq, dsmark, pfifo_fast, htb, prio 835 836 To compile it as a module, choose M here. If unsure, say N. 837 838config NETFILTER_XT_TARGET_CONNMARK 839 tristate '"CONNMARK" target support' 840 depends on NF_CONNTRACK 841 depends on NETFILTER_ADVANCED 842 select NETFILTER_XT_CONNMARK 843 help 844 This is a backwards-compat option for the user's convenience 845 (e.g. when running oldconfig). It selects 846 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 847 848config NETFILTER_XT_TARGET_CONNSECMARK 849 tristate '"CONNSECMARK" target support' 850 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 851 default m if NETFILTER_ADVANCED=n 852 help 853 The CONNSECMARK target copies security markings from packets 854 to connections, and restores security markings from connections 855 to packets (if the packets are not already marked). This would 856 normally be used in conjunction with the SECMARK target. 857 858 To compile it as a module, choose M here. If unsure, say N. 859 860config NETFILTER_XT_TARGET_CT 861 tristate '"CT" target support' 862 depends on NF_CONNTRACK 863 depends on IP_NF_RAW || IP6_NF_RAW 864 depends on NETFILTER_ADVANCED 865 help 866 This options adds a `CT' target, which allows to specify initial 867 connection tracking parameters like events to be delivered and 868 the helper to be used. 869 870 To compile it as a module, choose M here. If unsure, say N. 871 872config NETFILTER_XT_TARGET_DSCP 873 tristate '"DSCP" and "TOS" target support' 874 depends on IP_NF_MANGLE || IP6_NF_MANGLE 875 depends on NETFILTER_ADVANCED 876 help 877 This option adds a `DSCP' target, which allows you to manipulate 878 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 879 880 The DSCP field can have any value between 0x0 and 0x3f inclusive. 881 882 It also adds the "TOS" target, which allows you to create rules in 883 the "mangle" table which alter the Type Of Service field of an IPv4 884 or the Priority field of an IPv6 packet, prior to routing. 885 886 To compile it as a module, choose M here. If unsure, say N. 887 888config NETFILTER_XT_TARGET_HL 889 tristate '"HL" hoplimit target support' 890 depends on IP_NF_MANGLE || IP6_NF_MANGLE 891 depends on NETFILTER_ADVANCED 892 help 893 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 894 targets, which enable the user to change the 895 hoplimit/time-to-live value of the IP header. 896 897 While it is safe to decrement the hoplimit/TTL value, the 898 modules also allow to increment and set the hoplimit value of 899 the header to arbitrary values. This is EXTREMELY DANGEROUS 900 since you can easily create immortal packets that loop 901 forever on the network. 902 903config NETFILTER_XT_TARGET_HMARK 904 tristate '"HMARK" target support' 905 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 906 depends on NETFILTER_ADVANCED 907 help 908 This option adds the "HMARK" target. 909 910 The target allows you to create rules in the "raw" and "mangle" tables 911 which set the skbuff mark by means of hash calculation within a given 912 range. The nfmark can influence the routing method and can also be used 913 by other subsystems to change their behaviour. 914 915 To compile it as a module, choose M here. If unsure, say N. 916 917config NETFILTER_XT_TARGET_IDLETIMER 918 tristate "IDLETIMER target support" 919 depends on NETFILTER_ADVANCED 920 help 921 922 This option adds the `IDLETIMER' target. Each matching packet 923 resets the timer associated with label specified when the rule is 924 added. When the timer expires, it triggers a sysfs notification. 925 The remaining time for expiration can be read via sysfs. 926 927 To compile it as a module, choose M here. If unsure, say N. 928 929config NETFILTER_XT_TARGET_LED 930 tristate '"LED" target support' 931 depends on LEDS_CLASS && LEDS_TRIGGERS 932 depends on NETFILTER_ADVANCED 933 help 934 This option adds a `LED' target, which allows you to blink LEDs in 935 response to particular packets passing through your machine. 936 937 This can be used to turn a spare LED into a network activity LED, 938 which only flashes in response to FTP transfers, for example. Or 939 you could have an LED which lights up for a minute or two every time 940 somebody connects to your machine via SSH. 941 942 You will need support for the "led" class to make this work. 943 944 To create an LED trigger for incoming SSH traffic: 945 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 946 947 Then attach the new trigger to an LED on your system: 948 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 949 950 For more information on the LEDs available on your system, see 951 Documentation/leds/leds-class.rst 952 953config NETFILTER_XT_TARGET_LOG 954 tristate "LOG target support" 955 select NF_LOG_SYSLOG 956 select NF_LOG_IPV6 if IP6_NF_IPTABLES 957 default m if NETFILTER_ADVANCED=n 958 help 959 This option adds a `LOG' target, which allows you to create rules in 960 any iptables table which records the packet header to the syslog. 961 962 To compile it as a module, choose M here. If unsure, say N. 963 964config NETFILTER_XT_TARGET_MARK 965 tristate '"MARK" target support' 966 depends on NETFILTER_ADVANCED 967 select NETFILTER_XT_MARK 968 help 969 This is a backwards-compat option for the user's convenience 970 (e.g. when running oldconfig). It selects 971 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 972 973config NETFILTER_XT_NAT 974 tristate '"SNAT and DNAT" targets support' 975 depends on NF_NAT 976 help 977 This option enables the SNAT and DNAT targets. 978 979 To compile it as a module, choose M here. If unsure, say N. 980 981config NETFILTER_XT_TARGET_NETMAP 982 tristate '"NETMAP" target support' 983 depends on NF_NAT 984 help 985 NETMAP is an implementation of static 1:1 NAT mapping of network 986 addresses. It maps the network address part, while keeping the host 987 address part intact. 988 989 To compile it as a module, choose M here. If unsure, say N. 990 991config NETFILTER_XT_TARGET_NFLOG 992 tristate '"NFLOG" target support' 993 default m if NETFILTER_ADVANCED=n 994 select NETFILTER_NETLINK_LOG 995 help 996 This option enables the NFLOG target, which allows to LOG 997 messages through nfnetlink_log. 998 999 To compile it as a module, choose M here. If unsure, say N. 1000 1001config NETFILTER_XT_TARGET_NFQUEUE 1002 tristate '"NFQUEUE" target Support' 1003 depends on NETFILTER_ADVANCED 1004 select NETFILTER_NETLINK_QUEUE 1005 help 1006 This target replaced the old obsolete QUEUE target. 1007 1008 As opposed to QUEUE, it supports 65535 different queues, 1009 not just one. 1010 1011 To compile it as a module, choose M here. If unsure, say N. 1012 1013config NETFILTER_XT_TARGET_NOTRACK 1014 tristate '"NOTRACK" target support (DEPRECATED)' 1015 depends on NF_CONNTRACK 1016 depends on IP_NF_RAW || IP6_NF_RAW 1017 depends on NETFILTER_ADVANCED 1018 select NETFILTER_XT_TARGET_CT 1019 1020config NETFILTER_XT_TARGET_RATEEST 1021 tristate '"RATEEST" target support' 1022 depends on NETFILTER_ADVANCED 1023 help 1024 This option adds a `RATEEST' target, which allows to measure 1025 rates similar to TC estimators. The `rateest' match can be 1026 used to match on the measured rates. 1027 1028 To compile it as a module, choose M here. If unsure, say N. 1029 1030config NETFILTER_XT_TARGET_REDIRECT 1031 tristate "REDIRECT target support" 1032 depends on NF_NAT 1033 select NF_NAT_REDIRECT 1034 help 1035 REDIRECT is a special case of NAT: all incoming connections are 1036 mapped onto the incoming interface's address, causing the packets to 1037 come to the local machine instead of passing through. This is 1038 useful for transparent proxies. 1039 1040 To compile it as a module, choose M here. If unsure, say N. 1041 1042config NETFILTER_XT_TARGET_MASQUERADE 1043 tristate "MASQUERADE target support" 1044 depends on NF_NAT 1045 default m if NETFILTER_ADVANCED=n 1046 select NF_NAT_MASQUERADE 1047 help 1048 Masquerading is a special case of NAT: all outgoing connections are 1049 changed to seem to come from a particular interface's address, and 1050 if the interface goes down, those connections are lost. This is 1051 only useful for dialup accounts with dynamic IP address (ie. your IP 1052 address will be different on next dialup). 1053 1054 To compile it as a module, choose M here. If unsure, say N. 1055 1056config NETFILTER_XT_TARGET_TEE 1057 tristate '"TEE" - packet cloning to alternate destination' 1058 depends on NETFILTER_ADVANCED 1059 depends on IPV6 || IPV6=n 1060 depends on !NF_CONNTRACK || NF_CONNTRACK 1061 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES 1062 select NF_DUP_IPV4 1063 select NF_DUP_IPV6 if IP6_NF_IPTABLES 1064 help 1065 This option adds a "TEE" target with which a packet can be cloned and 1066 this clone be rerouted to another nexthop. 1067 1068config NETFILTER_XT_TARGET_TPROXY 1069 tristate '"TPROXY" target transparent proxying support' 1070 depends on NETFILTER_XTABLES 1071 depends on NETFILTER_ADVANCED 1072 depends on IPV6 || IPV6=n 1073 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1074 depends on IP_NF_MANGLE 1075 select NF_DEFRAG_IPV4 1076 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1077 select NF_TPROXY_IPV4 1078 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES 1079 help 1080 This option adds a `TPROXY' target, which is somewhat similar to 1081 REDIRECT. It can only be used in the mangle table and is useful 1082 to redirect traffic to a transparent proxy. It does _not_ depend 1083 on Netfilter connection tracking and NAT, unlike REDIRECT. 1084 For it to work you will have to configure certain iptables rules 1085 and use policy routing. For more information on how to set it up 1086 see Documentation/networking/tproxy.rst. 1087 1088 To compile it as a module, choose M here. If unsure, say N. 1089 1090config NETFILTER_XT_TARGET_TRACE 1091 tristate '"TRACE" target support' 1092 depends on IP_NF_RAW || IP6_NF_RAW 1093 depends on NETFILTER_ADVANCED 1094 help 1095 The TRACE target allows you to mark packets so that the kernel 1096 will log every rule which match the packets as those traverse 1097 the tables, chains, rules. 1098 1099 If you want to compile it as a module, say M here and read 1100 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1101 1102config NETFILTER_XT_TARGET_SECMARK 1103 tristate '"SECMARK" target support' 1104 depends on NETWORK_SECMARK 1105 default m if NETFILTER_ADVANCED=n 1106 help 1107 The SECMARK target allows security marking of network 1108 packets, for use with security subsystems. 1109 1110 To compile it as a module, choose M here. If unsure, say N. 1111 1112config NETFILTER_XT_TARGET_TCPMSS 1113 tristate '"TCPMSS" target support' 1114 depends on IPV6 || IPV6=n 1115 default m if NETFILTER_ADVANCED=n 1116 help 1117 This option adds a `TCPMSS' target, which allows you to alter the 1118 MSS value of TCP SYN packets, to control the maximum size for that 1119 connection (usually limiting it to your outgoing interface's MTU 1120 minus 40). 1121 1122 This is used to overcome criminally braindead ISPs or servers which 1123 block ICMP Fragmentation Needed packets. The symptoms of this 1124 problem are that everything works fine from your Linux 1125 firewall/router, but machines behind it can never exchange large 1126 packets: 1127 1) Web browsers connect, then hang with no data received. 1128 2) Small mail works fine, but large emails hang. 1129 3) ssh works fine, but scp hangs after initial handshaking. 1130 1131 Workaround: activate this option and add a rule to your firewall 1132 configuration like: 1133 1134 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 1135 -j TCPMSS --clamp-mss-to-pmtu 1136 1137 To compile it as a module, choose M here. If unsure, say N. 1138 1139config NETFILTER_XT_TARGET_TCPOPTSTRIP 1140 tristate '"TCPOPTSTRIP" target support' 1141 depends on IP_NF_MANGLE || IP6_NF_MANGLE 1142 depends on NETFILTER_ADVANCED 1143 help 1144 This option adds a "TCPOPTSTRIP" target, which allows you to strip 1145 TCP options from TCP packets. 1146 1147# alphabetically ordered list of matches 1148 1149comment "Xtables matches" 1150 1151config NETFILTER_XT_MATCH_ADDRTYPE 1152 tristate '"addrtype" address type match support' 1153 default m if NETFILTER_ADVANCED=n 1154 help 1155 This option allows you to match what routing thinks of an address, 1156 eg. UNICAST, LOCAL, BROADCAST, ... 1157 1158 If you want to compile it as a module, say M here and read 1159 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1160 1161config NETFILTER_XT_MATCH_BPF 1162 tristate '"bpf" match support' 1163 depends on NETFILTER_ADVANCED 1164 help 1165 BPF matching applies a linux socket filter to each packet and 1166 accepts those for which the filter returns non-zero. 1167 1168 To compile it as a module, choose M here. If unsure, say N. 1169 1170config NETFILTER_XT_MATCH_CGROUP 1171 tristate '"control group" match support' 1172 depends on NETFILTER_ADVANCED 1173 depends on CGROUPS 1174 select CGROUP_NET_CLASSID 1175 help 1176 Socket/process control group matching allows you to match locally 1177 generated packets based on which net_cls control group processes 1178 belong to. 1179 1180config NETFILTER_XT_MATCH_CLUSTER 1181 tristate '"cluster" match support' 1182 depends on NF_CONNTRACK 1183 depends on NETFILTER_ADVANCED 1184 help 1185 This option allows you to build work-load-sharing clusters of 1186 network servers/stateful firewalls without having a dedicated 1187 load-balancing router/server/switch. Basically, this match returns 1188 true when the packet must be handled by this cluster node. Thus, 1189 all nodes see all packets and this match decides which node handles 1190 what packets. The work-load sharing algorithm is based on source 1191 address hashing. 1192 1193 If you say Y or M here, try `iptables -m cluster --help` for 1194 more information. 1195 1196config NETFILTER_XT_MATCH_COMMENT 1197 tristate '"comment" match support' 1198 depends on NETFILTER_ADVANCED 1199 help 1200 This option adds a `comment' dummy-match, which allows you to put 1201 comments in your iptables ruleset. 1202 1203 If you want to compile it as a module, say M here and read 1204 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1205 1206config NETFILTER_XT_MATCH_CONNBYTES 1207 tristate '"connbytes" per-connection counter match support' 1208 depends on NF_CONNTRACK 1209 depends on NETFILTER_ADVANCED 1210 help 1211 This option adds a `connbytes' match, which allows you to match the 1212 number of bytes and/or packets for each direction within a connection. 1213 1214 If you want to compile it as a module, say M here and read 1215 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1216 1217config NETFILTER_XT_MATCH_CONNLABEL 1218 tristate '"connlabel" match support' 1219 select NF_CONNTRACK_LABELS 1220 depends on NF_CONNTRACK 1221 depends on NETFILTER_ADVANCED 1222 help 1223 This match allows you to test and assign userspace-defined labels names 1224 to a connection. The kernel only stores bit values - mapping 1225 names to bits is done by userspace. 1226 1227 Unlike connmark, more than 32 flag bits may be assigned to a 1228 connection simultaneously. 1229 1230config NETFILTER_XT_MATCH_CONNLIMIT 1231 tristate '"connlimit" match support' 1232 depends on NF_CONNTRACK 1233 depends on NETFILTER_ADVANCED 1234 select NETFILTER_CONNCOUNT 1235 help 1236 This match allows you to match against the number of parallel 1237 connections to a server per client IP address (or address block). 1238 1239config NETFILTER_XT_MATCH_CONNMARK 1240 tristate '"connmark" connection mark match support' 1241 depends on NF_CONNTRACK 1242 depends on NETFILTER_ADVANCED 1243 select NETFILTER_XT_CONNMARK 1244 help 1245 This is a backwards-compat option for the user's convenience 1246 (e.g. when running oldconfig). It selects 1247 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 1248 1249config NETFILTER_XT_MATCH_CONNTRACK 1250 tristate '"conntrack" connection tracking match support' 1251 depends on NF_CONNTRACK 1252 default m if NETFILTER_ADVANCED=n 1253 help 1254 This is a general conntrack match module, a superset of the state match. 1255 1256 It allows matching on additional conntrack information, which is 1257 useful in complex configurations, such as NAT gateways with multiple 1258 internet links or tunnels. 1259 1260 To compile it as a module, choose M here. If unsure, say N. 1261 1262config NETFILTER_XT_MATCH_CPU 1263 tristate '"cpu" match support' 1264 depends on NETFILTER_ADVANCED 1265 help 1266 CPU matching allows you to match packets based on the CPU 1267 currently handling the packet. 1268 1269 To compile it as a module, choose M here. If unsure, say N. 1270 1271config NETFILTER_XT_MATCH_DCCP 1272 tristate '"dccp" protocol match support' 1273 depends on NETFILTER_ADVANCED 1274 default IP_DCCP 1275 help 1276 With this option enabled, you will be able to use the iptables 1277 `dccp' match in order to match on DCCP source/destination ports 1278 and DCCP flags. 1279 1280 If you want to compile it as a module, say M here and read 1281 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1282 1283config NETFILTER_XT_MATCH_DEVGROUP 1284 tristate '"devgroup" match support' 1285 depends on NETFILTER_ADVANCED 1286 help 1287 This options adds a `devgroup' match, which allows to match on the 1288 device group a network device is assigned to. 1289 1290 To compile it as a module, choose M here. If unsure, say N. 1291 1292config NETFILTER_XT_MATCH_DSCP 1293 tristate '"dscp" and "tos" match support' 1294 depends on NETFILTER_ADVANCED 1295 help 1296 This option adds a `DSCP' match, which allows you to match against 1297 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 1298 1299 The DSCP field can have any value between 0x0 and 0x3f inclusive. 1300 1301 It will also add a "tos" match, which allows you to match packets 1302 based on the Type Of Service fields of the IPv4 packet (which share 1303 the same bits as DSCP). 1304 1305 To compile it as a module, choose M here. If unsure, say N. 1306 1307config NETFILTER_XT_MATCH_ECN 1308 tristate '"ecn" match support' 1309 depends on NETFILTER_ADVANCED 1310 help 1311 This option adds an "ECN" match, which allows you to match against 1312 the IPv4 and TCP header ECN fields. 1313 1314 To compile it as a module, choose M here. If unsure, say N. 1315 1316config NETFILTER_XT_MATCH_ESP 1317 tristate '"esp" match support' 1318 depends on NETFILTER_ADVANCED 1319 help 1320 This match extension allows you to match a range of SPIs 1321 inside ESP header of IPSec packets. 1322 1323 To compile it as a module, choose M here. If unsure, say N. 1324 1325config NETFILTER_XT_MATCH_HASHLIMIT 1326 tristate '"hashlimit" match support' 1327 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1328 depends on NETFILTER_ADVANCED 1329 help 1330 This option adds a `hashlimit' match. 1331 1332 As opposed to `limit', this match dynamically creates a hash table 1333 of limit buckets, based on your selection of source/destination 1334 addresses and/or ports. 1335 1336 It enables you to express policies like `10kpps for any given 1337 destination address' or `500pps from any given source address' 1338 with a single rule. 1339 1340config NETFILTER_XT_MATCH_HELPER 1341 tristate '"helper" match support' 1342 depends on NF_CONNTRACK 1343 depends on NETFILTER_ADVANCED 1344 help 1345 Helper matching allows you to match packets in dynamic connections 1346 tracked by a conntrack-helper, ie. nf_conntrack_ftp 1347 1348 To compile it as a module, choose M here. If unsure, say Y. 1349 1350config NETFILTER_XT_MATCH_HL 1351 tristate '"hl" hoplimit/TTL match support' 1352 depends on NETFILTER_ADVANCED 1353 help 1354 HL matching allows you to match packets based on the hoplimit 1355 in the IPv6 header, or the time-to-live field in the IPv4 1356 header of the packet. 1357 1358config NETFILTER_XT_MATCH_IPCOMP 1359 tristate '"ipcomp" match support' 1360 depends on NETFILTER_ADVANCED 1361 help 1362 This match extension allows you to match a range of CPIs(16 bits) 1363 inside IPComp header of IPSec packets. 1364 1365 To compile it as a module, choose M here. If unsure, say N. 1366 1367config NETFILTER_XT_MATCH_IPRANGE 1368 tristate '"iprange" address range match support' 1369 depends on NETFILTER_ADVANCED 1370 help 1371 This option adds a "iprange" match, which allows you to match based on 1372 an IP address range. (Normal iptables only matches on single addresses 1373 with an optional mask.) 1374 1375 If unsure, say M. 1376 1377config NETFILTER_XT_MATCH_IPVS 1378 tristate '"ipvs" match support' 1379 depends on IP_VS 1380 depends on NETFILTER_ADVANCED 1381 depends on NF_CONNTRACK 1382 help 1383 This option allows you to match against IPVS properties of a packet. 1384 1385 If unsure, say N. 1386 1387config NETFILTER_XT_MATCH_L2TP 1388 tristate '"l2tp" match support' 1389 depends on NETFILTER_ADVANCED 1390 default L2TP 1391 help 1392 This option adds an "L2TP" match, which allows you to match against 1393 L2TP protocol header fields. 1394 1395 To compile it as a module, choose M here. If unsure, say N. 1396 1397config NETFILTER_XT_MATCH_LENGTH 1398 tristate '"length" match support' 1399 depends on NETFILTER_ADVANCED 1400 help 1401 This option allows you to match the length of a packet against a 1402 specific value or range of values. 1403 1404 To compile it as a module, choose M here. If unsure, say N. 1405 1406config NETFILTER_XT_MATCH_LIMIT 1407 tristate '"limit" match support' 1408 depends on NETFILTER_ADVANCED 1409 help 1410 limit matching allows you to control the rate at which a rule can be 1411 matched: mainly useful in combination with the LOG target ("LOG 1412 target support", below) and to avoid some Denial of Service attacks. 1413 1414 To compile it as a module, choose M here. If unsure, say N. 1415 1416config NETFILTER_XT_MATCH_MAC 1417 tristate '"mac" address match support' 1418 depends on NETFILTER_ADVANCED 1419 help 1420 MAC matching allows you to match packets based on the source 1421 Ethernet address of the packet. 1422 1423 To compile it as a module, choose M here. If unsure, say N. 1424 1425config NETFILTER_XT_MATCH_MARK 1426 tristate '"mark" match support' 1427 depends on NETFILTER_ADVANCED 1428 select NETFILTER_XT_MARK 1429 help 1430 This is a backwards-compat option for the user's convenience 1431 (e.g. when running oldconfig). It selects 1432 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1433 1434config NETFILTER_XT_MATCH_MULTIPORT 1435 tristate '"multiport" Multiple port match support' 1436 depends on NETFILTER_ADVANCED 1437 help 1438 Multiport matching allows you to match TCP or UDP packets based on 1439 a series of source or destination ports: normally a rule can only 1440 match a single range of ports. 1441 1442 To compile it as a module, choose M here. If unsure, say N. 1443 1444config NETFILTER_XT_MATCH_NFACCT 1445 tristate '"nfacct" match support' 1446 depends on NETFILTER_ADVANCED 1447 select NETFILTER_NETLINK_ACCT 1448 help 1449 This option allows you to use the extended accounting through 1450 nfnetlink_acct. 1451 1452 To compile it as a module, choose M here. If unsure, say N. 1453 1454config NETFILTER_XT_MATCH_OSF 1455 tristate '"osf" Passive OS fingerprint match' 1456 depends on NETFILTER_ADVANCED 1457 select NETFILTER_NETLINK_OSF 1458 help 1459 This option selects the Passive OS Fingerprinting match module 1460 that allows to passively match the remote operating system by 1461 analyzing incoming TCP SYN packets. 1462 1463 Rules and loading software can be downloaded from 1464 http://www.ioremap.net/projects/osf 1465 1466 To compile it as a module, choose M here. If unsure, say N. 1467 1468config NETFILTER_XT_MATCH_OWNER 1469 tristate '"owner" match support' 1470 depends on NETFILTER_ADVANCED 1471 help 1472 Socket owner matching allows you to match locally-generated packets 1473 based on who created the socket: the user or group. It is also 1474 possible to check whether a socket actually exists. 1475 1476config NETFILTER_XT_MATCH_POLICY 1477 tristate 'IPsec "policy" match support' 1478 depends on XFRM 1479 default m if NETFILTER_ADVANCED=n 1480 help 1481 Policy matching allows you to match packets based on the 1482 IPsec policy that was used during decapsulation/will 1483 be used during encapsulation. 1484 1485 To compile it as a module, choose M here. If unsure, say N. 1486 1487config NETFILTER_XT_MATCH_PHYSDEV 1488 tristate '"physdev" match support' 1489 depends on BRIDGE && BRIDGE_NETFILTER 1490 depends on NETFILTER_ADVANCED 1491 help 1492 Physdev packet matching matches against the physical bridge ports 1493 the IP packet arrived on or will leave by. 1494 1495 To compile it as a module, choose M here. If unsure, say N. 1496 1497config NETFILTER_XT_MATCH_PKTTYPE 1498 tristate '"pkttype" packet type match support' 1499 depends on NETFILTER_ADVANCED 1500 help 1501 Packet type matching allows you to match a packet by 1502 its "class", eg. BROADCAST, MULTICAST, ... 1503 1504 Typical usage: 1505 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1506 1507 To compile it as a module, choose M here. If unsure, say N. 1508 1509config NETFILTER_XT_MATCH_QUOTA 1510 tristate '"quota" match support' 1511 depends on NETFILTER_ADVANCED 1512 help 1513 This option adds a `quota' match, which allows to match on a 1514 byte counter. 1515 1516 If you want to compile it as a module, say M here and read 1517 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1518 1519config NETFILTER_XT_MATCH_RATEEST 1520 tristate '"rateest" match support' 1521 depends on NETFILTER_ADVANCED 1522 select NETFILTER_XT_TARGET_RATEEST 1523 help 1524 This option adds a `rateest' match, which allows to match on the 1525 rate estimated by the RATEEST target. 1526 1527 To compile it as a module, choose M here. If unsure, say N. 1528 1529config NETFILTER_XT_MATCH_REALM 1530 tristate '"realm" match support' 1531 depends on NETFILTER_ADVANCED 1532 select IP_ROUTE_CLASSID 1533 help 1534 This option adds a `realm' match, which allows you to use the realm 1535 key from the routing subsystem inside iptables. 1536 1537 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1538 in tc world. 1539 1540 If you want to compile it as a module, say M here and read 1541 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1542 1543config NETFILTER_XT_MATCH_RECENT 1544 tristate '"recent" match support' 1545 depends on NETFILTER_ADVANCED 1546 help 1547 This match is used for creating one or many lists of recently 1548 used addresses and then matching against that/those list(s). 1549 1550 Short options are available by using 'iptables -m recent -h' 1551 Official Website: <http://snowman.net/projects/ipt_recent/> 1552 1553config NETFILTER_XT_MATCH_SCTP 1554 tristate '"sctp" protocol match support' 1555 depends on NETFILTER_ADVANCED 1556 default IP_SCTP 1557 help 1558 With this option enabled, you will be able to use the 1559 `sctp' match in order to match on SCTP source/destination ports 1560 and SCTP chunk types. 1561 1562 If you want to compile it as a module, say M here and read 1563 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'. 1564 1565config NETFILTER_XT_MATCH_SOCKET 1566 tristate '"socket" match support' 1567 depends on NETFILTER_XTABLES 1568 depends on NETFILTER_ADVANCED 1569 depends on IPV6 || IPV6=n 1570 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 1571 select NF_SOCKET_IPV4 1572 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES 1573 select NF_DEFRAG_IPV4 1574 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n 1575 help 1576 This option adds a `socket' match, which can be used to match 1577 packets for which a TCP or UDP socket lookup finds a valid socket. 1578 It can be used in combination with the MARK target and policy 1579 routing to implement full featured non-locally bound sockets. 1580 1581 To compile it as a module, choose M here. If unsure, say N. 1582 1583config NETFILTER_XT_MATCH_STATE 1584 tristate '"state" match support' 1585 depends on NF_CONNTRACK 1586 default m if NETFILTER_ADVANCED=n 1587 help 1588 Connection state matching allows you to match packets based on their 1589 relationship to a tracked connection (ie. previous packets). This 1590 is a powerful tool for packet classification. 1591 1592 To compile it as a module, choose M here. If unsure, say N. 1593 1594config NETFILTER_XT_MATCH_STATISTIC 1595 tristate '"statistic" match support' 1596 depends on NETFILTER_ADVANCED 1597 help 1598 This option adds a `statistic' match, which allows you to match 1599 on packets periodically or randomly with a given percentage. 1600 1601 To compile it as a module, choose M here. If unsure, say N. 1602 1603config NETFILTER_XT_MATCH_STRING 1604 tristate '"string" match support' 1605 depends on NETFILTER_ADVANCED 1606 select TEXTSEARCH 1607 select TEXTSEARCH_KMP 1608 select TEXTSEARCH_BM 1609 select TEXTSEARCH_FSM 1610 help 1611 This option adds a `string' match, which allows you to look for 1612 pattern matchings in packets. 1613 1614 To compile it as a module, choose M here. If unsure, say N. 1615 1616config NETFILTER_XT_MATCH_TCPMSS 1617 tristate '"tcpmss" match support' 1618 depends on NETFILTER_ADVANCED 1619 help 1620 This option adds a `tcpmss' match, which allows you to examine the 1621 MSS value of TCP SYN packets, which control the maximum packet size 1622 for that connection. 1623 1624 To compile it as a module, choose M here. If unsure, say N. 1625 1626config NETFILTER_XT_MATCH_TIME 1627 tristate '"time" match support' 1628 depends on NETFILTER_ADVANCED 1629 help 1630 This option adds a "time" match, which allows you to match based on 1631 the packet arrival time (at the machine which netfilter is running) 1632 on) or departure time/date (for locally generated packets). 1633 1634 If you say Y here, try `iptables -m time --help` for 1635 more information. 1636 1637 If you want to compile it as a module, say M here. 1638 If unsure, say N. 1639 1640config NETFILTER_XT_MATCH_U32 1641 tristate '"u32" match support' 1642 depends on NETFILTER_ADVANCED 1643 help 1644 u32 allows you to extract quantities of up to 4 bytes from a packet, 1645 AND them with specified masks, shift them by specified amounts and 1646 test whether the results are in any of a set of specified ranges. 1647 The specification of what to extract is general enough to skip over 1648 headers with lengths stored in the packet, as in IP or TCP header 1649 lengths. 1650 1651 Details and examples are in the kernel module source. 1652 1653endif # NETFILTER_XTABLES 1654 1655endmenu 1656 1657source "net/netfilter/ipset/Kconfig" 1658 1659source "net/netfilter/ipvs/Kconfig"