blob: fefa514b99170aae55620e4007565b0ad3e814b4 [file] [log] [blame]
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001menu "Core Netfilter Configuration"
Patrick McHardy3a411352006-12-12 00:27:46 -08002 depends on NET && INET && NETFILTER
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08003
Harald Weltef9e815b2005-08-09 19:30:24 -07004config NETFILTER_NETLINK
Patrick McHardy2eeeba32007-12-05 01:31:52 -08005 tristate
Harald Welte7af4cc32005-08-09 19:44:15 -07006
Pablo Neira Ayuso94139022011-12-23 14:19:50 +01007config NETFILTER_NETLINK_ACCT
8tristate "Netfilter NFACCT over NFNETLINK interface"
9 depends on NETFILTER_ADVANCED
10 select NETFILTER_NETLINK
11 help
12 If this option is enabled, the kernel will include support
13 for extended accounting via NFNETLINK.
14
Harald Welte7af4cc32005-08-09 19:44:15 -070015config NETFILTER_NETLINK_QUEUE
16 tristate "Netfilter NFQUEUE over NFNETLINK interface"
Patrick McHardy33b8e772007-12-17 22:47:05 -080017 depends on NETFILTER_ADVANCED
Patrick McHardy2eeeba32007-12-05 01:31:52 -080018 select NETFILTER_NETLINK
Harald Welte7af4cc32005-08-09 19:44:15 -070019 help
Thomas Vögtle50b521a2006-03-22 13:53:48 -080020 If this option is enabled, the kernel will include support
Harald Welte7af4cc32005-08-09 19:44:15 -070021 for queueing packets via NFNETLINK.
22
Harald Welte0597f262005-08-09 19:58:39 -070023config NETFILTER_NETLINK_LOG
24 tristate "Netfilter LOG over NFNETLINK interface"
Patrick McHardy33b8e772007-12-17 22:47:05 -080025 default m if NETFILTER_ADVANCED=n
Patrick McHardy2eeeba32007-12-05 01:31:52 -080026 select NETFILTER_NETLINK
Harald Welte0597f262005-08-09 19:58:39 -070027 help
28 If this option is enabled, the kernel will include support
29 for logging packets via NFNETLINK.
30
31 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
32 and is also scheduled to replace the old syslog-based ipt_LOG
33 and ip6t_LOG modules.
34
Patrick McHardyab4f58c2007-12-05 01:31:37 -080035config NF_CONNTRACK
Patrick McHardyb321e142006-12-02 22:05:46 -080036 tristate "Netfilter connection tracking support"
Patrick McHardy33b8e772007-12-17 22:47:05 -080037 default m if NETFILTER_ADVANCED=n
Patrick McHardyb321e142006-12-02 22:05:46 -080038 help
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080039 Connection tracking keeps a record of what packets have passed
40 through your machine, in order to figure out how they are related
41 into connections.
42
Patrick McHardyb321e142006-12-02 22:05:46 -080043 This is required to do Masquerading or other kinds of Network
Russ Dillb11c16b2008-07-08 02:35:27 -070044 Address Translation. It can also be used to enhance packet
45 filtering (see `Connection state match support' below).
Patrick McHardyb321e142006-12-02 22:05:46 -080046
47 To compile it as a module, choose M here. If unsure, say N.
48
Jan Engelhardtc2df73d2008-10-08 11:35:18 +020049if NF_CONNTRACK
50
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080051config NF_CONNTRACK_MARK
52 bool 'Connection mark tracking support'
Patrick McHardy33b8e772007-12-17 22:47:05 -080053 depends on NETFILTER_ADVANCED
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080054 help
55 This option enables support for connection marks, used by the
56 `CONNMARK' target and `connmark' match. Similar to the mark value
57 of packets, but this mark value is kept in the conntrack session
58 instead of the individual packets.
59
James Morris7c9728c2006-06-09 00:31:46 -070060config NF_CONNTRACK_SECMARK
61 bool 'Connection tracking security mark support'
Jan Engelhardtc2df73d2008-10-08 11:35:18 +020062 depends on NETWORK_SECMARK
Patrick McHardy33b8e772007-12-17 22:47:05 -080063 default m if NETFILTER_ADVANCED=n
James Morris7c9728c2006-06-09 00:31:46 -070064 help
65 This option enables security markings to be applied to
66 connections. Typically they are copied to connections from
67 packets using the CONNSECMARK target and copied back from
68 connections to packets with the same target, with the packets
69 being originally labeled via SECMARK.
70
71 If unsure, say 'N'.
72
Patrick McHardy5d0aa2c2010-02-15 18:13:33 +010073config NF_CONNTRACK_ZONES
74 bool 'Connection tracking zones'
75 depends on NETFILTER_ADVANCED
76 depends on NETFILTER_XT_TARGET_CT
77 help
78 This option enables support for connection tracking zones.
79 Normally, each connection needs to have a unique system wide
80 identity. Connection tracking zones allow to have multiple
81 connections using the same identity, as long as they are
82 contained in different zones.
83
84 If unsure, say `N'.
85
Jan Engelhardt54b07dc2011-04-21 09:32:45 +020086config NF_CONNTRACK_PROCFS
87 bool "Supply CT list in procfs (OBSOLETE)"
88 default y
89 depends on PROC_FS
90 ---help---
91 This option enables for the list of known conntrack entries
92 to be shown in procfs under net/netfilter/nf_conntrack. This
93 is considered obsolete in favor of using the conntrack(8)
94 tool which uses Netlink.
95
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080096config NF_CONNTRACK_EVENTS
Patrick McHardy8ce22fc2008-01-14 23:31:36 -080097 bool "Connection tracking events"
Patrick McHardy33b8e772007-12-17 22:47:05 -080098 depends on NETFILTER_ADVANCED
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080099 help
100 If this option is enabled, the connection tracking code will
101 provide a notifier chain that can be used by other kernel code
Thomas Vögtle50b521a2006-03-22 13:53:48 -0800102 to get notified about changes in the connection tracking state.
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800103
104 If unsure, say `N'.
105
Pablo Neira Ayusodd705072012-02-28 23:36:48 +0100106config NF_CONNTRACK_TIMEOUT
107 bool 'Connection tracking timeout'
108 depends on NETFILTER_ADVANCED
109 help
110 This option enables support for connection tracking timeout
111 extension. This allows you to attach timeout policies to flow
112 via the CT target.
113
114 If unsure, say `N'.
115
Pablo Neira Ayusoa992ca22011-01-19 16:00:07 +0100116config NF_CONNTRACK_TIMESTAMP
117 bool 'Connection tracking timestamping'
118 depends on NETFILTER_ADVANCED
119 help
120 This option enables support for connection tracking timestamping.
121 This allows you to store the flow start-time and to obtain
122 the flow-stop time (once it has been destroyed) via Connection
123 tracking events.
124
125 If unsure, say `N'.
126
Patrick McHardy2bc78042008-03-20 15:15:55 +0100127config NF_CT_PROTO_DCCP
128 tristate 'DCCP protocol connection tracking support (EXPERIMENTAL)'
Jan Engelhardtc2df73d2008-10-08 11:35:18 +0200129 depends on EXPERIMENTAL
Patrick McHardy2bc78042008-03-20 15:15:55 +0100130 depends on NETFILTER_ADVANCED
Patrick McHardyf3261af2008-05-08 01:16:04 -0700131 default IP_DCCP
Patrick McHardy2bc78042008-03-20 15:15:55 +0100132 help
133 With this option enabled, the layer 3 independent connection
134 tracking code will be able to do state tracking on DCCP connections.
135
136 If unsure, say 'N'.
137
Patrick McHardyf09943f2006-12-02 22:09:41 -0800138config NF_CT_PROTO_GRE
139 tristate
Patrick McHardyf09943f2006-12-02 22:09:41 -0800140
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800141config NF_CT_PROTO_SCTP
Patrick McHardya3c47972006-12-02 22:11:01 -0800142 tristate 'SCTP protocol connection tracking support (EXPERIMENTAL)'
Jan Engelhardtc2df73d2008-10-08 11:35:18 +0200143 depends on EXPERIMENTAL
Patrick McHardy33b8e772007-12-17 22:47:05 -0800144 depends on NETFILTER_ADVANCED
Patrick McHardyf3261af2008-05-08 01:16:04 -0700145 default IP_SCTP
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800146 help
147 With this option enabled, the layer 3 independent connection
148 tracking code will be able to do state tracking on SCTP connections.
149
150 If you want to compile it as a module, say M here and read
Alexander E. Patrakov39f5fb32007-03-16 18:28:43 +0500151 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800152
Patrick McHardy59eecdf2007-07-14 20:48:44 -0700153config NF_CT_PROTO_UDPLITE
Patrick McHardy8ce22fc2008-01-14 23:31:36 -0800154 tristate 'UDP-Lite protocol connection tracking support'
Patrick McHardy33b8e772007-12-17 22:47:05 -0800155 depends on NETFILTER_ADVANCED
Patrick McHardy59eecdf2007-07-14 20:48:44 -0700156 help
157 With this option enabled, the layer 3 independent connection
158 tracking code will be able to do state tracking on UDP-Lite
159 connections.
160
161 To compile it as a module, choose M here. If unsure, say N.
162
Patrick McHardy16958902006-12-02 22:08:26 -0800163config NF_CONNTRACK_AMANDA
Patrick McHardyc9386cf2007-01-04 12:16:06 -0800164 tristate "Amanda backup protocol support"
Patrick McHardy33b8e772007-12-17 22:47:05 -0800165 depends on NETFILTER_ADVANCED
Patrick McHardy16958902006-12-02 22:08:26 -0800166 select TEXTSEARCH
167 select TEXTSEARCH_KMP
168 help
169 If you are running the Amanda backup package <http://www.amanda.org/>
170 on this machine or machines that will be MASQUERADED through this
171 machine, then you may want to enable this feature. This allows the
172 connection tracking and natting code to allow the sub-channels that
173 Amanda requires for communication of the backup data, messages and
174 index.
175
176 To compile it as a module, choose M here. If unsure, say N.
177
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800178config NF_CONNTRACK_FTP
Patrick McHardyc9386cf2007-01-04 12:16:06 -0800179 tristate "FTP protocol support"
Patrick McHardy33b8e772007-12-17 22:47:05 -0800180 default m if NETFILTER_ADVANCED=n
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800181 help
182 Tracking FTP connections is problematic: special helpers are
183 required for tracking them, and doing masquerading and other forms
184 of Network Address Translation on them.
185
186 This is FTP support on Layer 3 independent connection tracking.
187 Layer 3 independent connection tracking is experimental scheme
188 which generalize ip_conntrack to support other layer 3 protocols.
189
190 To compile it as a module, choose M here. If unsure, say N.
191
Patrick McHardyf587de02006-12-02 22:08:46 -0800192config NF_CONNTRACK_H323
Patrick McHardy8ce22fc2008-01-14 23:31:36 -0800193 tristate "H.323 protocol support"
Jan Engelhardtc2df73d2008-10-08 11:35:18 +0200194 depends on (IPV6 || IPV6=n)
Patrick McHardy33b8e772007-12-17 22:47:05 -0800195 depends on NETFILTER_ADVANCED
Patrick McHardyf587de02006-12-02 22:08:46 -0800196 help
197 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
198 important VoIP protocols, it is widely used by voice hardware and
199 software including voice gateways, IP phones, Netmeeting, OpenPhone,
200 Gnomemeeting, etc.
201
202 With this module you can support H.323 on a connection tracking/NAT
203 firewall.
204
205 This module supports RAS, Fast Start, H.245 Tunnelling, Call
206 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
207 whiteboard, file transfer, etc. For more information, please
208 visit http://nath323.sourceforge.net/.
209
210 To compile it as a module, choose M here. If unsure, say N.
211
Patrick McHardy869f37d82006-12-02 22:09:06 -0800212config NF_CONNTRACK_IRC
Patrick McHardyc9386cf2007-01-04 12:16:06 -0800213 tristate "IRC protocol support"
Patrick McHardy33b8e772007-12-17 22:47:05 -0800214 default m if NETFILTER_ADVANCED=n
Patrick McHardy869f37d82006-12-02 22:09:06 -0800215 help
216 There is a commonly-used extension to IRC called
217 Direct Client-to-Client Protocol (DCC). This enables users to send
218 files to each other, and also chat to each other without the need
219 of a server. DCC Sending is used anywhere you send files over IRC,
220 and DCC Chat is most commonly used by Eggdrop bots. If you are
221 using NAT, this extension will enable you to send files and initiate
222 chats. Note that you do NOT need this extension to get files or
223 have others initiate chats, or everything else in IRC.
224
225 To compile it as a module, choose M here. If unsure, say N.
226
Jiri Olsa93557f52011-01-18 18:12:24 +0100227config NF_CONNTRACK_BROADCAST
228 tristate
229
Patrick McHardy92703ee2006-12-02 22:09:24 -0800230config NF_CONNTRACK_NETBIOS_NS
Patrick McHardy8ce22fc2008-01-14 23:31:36 -0800231 tristate "NetBIOS name service protocol support"
Jiri Olsa93557f52011-01-18 18:12:24 +0100232 select NF_CONNTRACK_BROADCAST
Patrick McHardy92703ee2006-12-02 22:09:24 -0800233 help
234 NetBIOS name service requests are sent as broadcast messages from an
235 unprivileged port and responded to with unicast messages to the
236 same port. This make them hard to firewall properly because connection
237 tracking doesn't deal with broadcasts. This helper tracks locally
238 originating NetBIOS name service requests and the corresponding
239 responses. It relies on correct IP address configuration, specifically
240 netmask and broadcast address. When properly configured, the output
241 of "ip address show" should look similar to this:
242
243 $ ip -4 address show eth0
244 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
245 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
246
247 To compile it as a module, choose M here. If unsure, say N.
248
Jiri Olsa93557f52011-01-18 18:12:24 +0100249config NF_CONNTRACK_SNMP
250 tristate "SNMP service protocol support"
251 depends on NETFILTER_ADVANCED
252 select NF_CONNTRACK_BROADCAST
253 help
254 SNMP service requests are sent as broadcast messages from an
255 unprivileged port and responded to with unicast messages to the
256 same port. This make them hard to firewall properly because connection
257 tracking doesn't deal with broadcasts. This helper tracks locally
258 originating SNMP service requests and the corresponding
259 responses. It relies on correct IP address configuration, specifically
260 netmask and broadcast address.
261
262 To compile it as a module, choose M here. If unsure, say N.
263
Patrick McHardyf09943f2006-12-02 22:09:41 -0800264config NF_CONNTRACK_PPTP
Patrick McHardyc9386cf2007-01-04 12:16:06 -0800265 tristate "PPtP protocol support"
Patrick McHardy33b8e772007-12-17 22:47:05 -0800266 depends on NETFILTER_ADVANCED
Patrick McHardyf09943f2006-12-02 22:09:41 -0800267 select NF_CT_PROTO_GRE
268 help
269 This module adds support for PPTP (Point to Point Tunnelling
270 Protocol, RFC2637) connection tracking and NAT.
271
272 If you are running PPTP sessions over a stateful firewall or NAT
273 box, you may want to enable this feature.
274
275 Please note that not all PPTP modes of operation are supported yet.
276 Specifically these limitations exist:
David Sterba3dde6ad2007-05-09 07:12:20 +0200277 - Blindly assumes that control connections are always established
Patrick McHardyf09943f2006-12-02 22:09:41 -0800278 in PNS->PAC direction. This is a violation of RFC2637.
279 - Only supports a single call within each session
280
281 To compile it as a module, choose M here. If unsure, say N.
282
Michal Schmidt6fecd192007-02-07 15:05:12 -0800283config NF_CONNTRACK_SANE
284 tristate "SANE protocol support (EXPERIMENTAL)"
Jan Engelhardtc2df73d2008-10-08 11:35:18 +0200285 depends on EXPERIMENTAL
Patrick McHardy33b8e772007-12-17 22:47:05 -0800286 depends on NETFILTER_ADVANCED
Michal Schmidt6fecd192007-02-07 15:05:12 -0800287 help
288 SANE is a protocol for remote access to scanners as implemented
289 by the 'saned' daemon. Like FTP, it uses separate control and
290 data connections.
291
292 With this module you can support SANE on a connection tracking
293 firewall.
294
295 To compile it as a module, choose M here. If unsure, say N.
296
Patrick McHardy9fafcd72006-12-02 22:09:57 -0800297config NF_CONNTRACK_SIP
Patrick McHardy8ce22fc2008-01-14 23:31:36 -0800298 tristate "SIP protocol support"
Patrick McHardy33b8e772007-12-17 22:47:05 -0800299 default m if NETFILTER_ADVANCED=n
Patrick McHardy9fafcd72006-12-02 22:09:57 -0800300 help
301 SIP is an application-layer control protocol that can establish,
302 modify, and terminate multimedia sessions (conferences) such as
303 Internet telephony calls. With the ip_conntrack_sip and
304 the nf_nat_sip modules you can support the protocol on a connection
305 tracking/NATing firewall.
306
307 To compile it as a module, choose M here. If unsure, say N.
308
Patrick McHardya536df32006-12-02 22:10:18 -0800309config NF_CONNTRACK_TFTP
Patrick McHardyc9386cf2007-01-04 12:16:06 -0800310 tristate "TFTP protocol support"
Patrick McHardy33b8e772007-12-17 22:47:05 -0800311 depends on NETFILTER_ADVANCED
Patrick McHardya536df32006-12-02 22:10:18 -0800312 help
313 TFTP connection tracking helper, this is required depending
314 on how restrictive your ruleset is.
315 If you are using a tftp client behind -j SNAT or -j MASQUERADING
316 you will need this.
317
318 To compile it as a module, choose M here. If unsure, say N.
319
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800320config NF_CT_NETLINK
Patrick McHardy8ce22fc2008-01-14 23:31:36 -0800321 tristate 'Connection tracking netlink interface'
Patrick McHardy2eeeba32007-12-05 01:31:52 -0800322 select NETFILTER_NETLINK
Patrick McHardy33b8e772007-12-17 22:47:05 -0800323 default m if NETFILTER_ADVANCED=n
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800324 help
325 This option enables support for a netlink-based userspace interface
326
Pablo Neira Ayuso50978462012-02-28 19:13:48 +0100327config NF_CT_NETLINK_TIMEOUT
328 tristate 'Connection tracking timeout tuning via Netlink'
329 select NETFILTER_NETLINK
330 depends on NETFILTER_ADVANCED
331 help
332 This option enables support for connection tracking timeout
333 fine-grain tuning. This allows you to attach specific timeout
334 policies to flows, instead of using the global timeout policy.
335
336 If unsure, say `N'.
337
Pablo Neira Ayuso6e9c2db2012-06-18 21:14:30 +0200338config NF_CT_NETLINK_HELPER
339 tristate 'Connection tracking helpers in user-space via Netlink'
340 select NETFILTER_NETLINK
341 depends on NF_CT_NETLINK
342 depends on NETFILTER_NETLINK_QUEUE
Pablo Neira Ayuso7c622342012-06-19 02:10:57 +0200343 depends on NETFILTER_NETLINK_QUEUE_CT
Pablo Neira Ayuso6e9c2db2012-06-18 21:14:30 +0200344 depends on NETFILTER_ADVANCED
345 help
346 This option enables the user-space connection tracking helpers
347 infrastructure.
348
349 If unsure, say `N'.
350
Pablo Neira Ayuso7c622342012-06-19 02:10:57 +0200351config NETFILTER_NETLINK_QUEUE_CT
352 bool "NFQUEUE integration with Connection Tracking"
353 default n
354 depends on NETFILTER_NETLINK_QUEUE
355 help
356 If this option is enabled, NFQUEUE can include Connection Tracking
357 information together with the packet is the enqueued via NFNETLINK.
358
Patrick McHardyc7232c92012-08-26 19:14:06 +0200359config NF_NAT
360 tristate
361
362config NF_NAT_NEEDED
363 bool
364 depends on NF_NAT
365 default y
366
367config NF_NAT_PROTO_DCCP
368 tristate
369 depends on NF_NAT && NF_CT_PROTO_DCCP
370 default NF_NAT && NF_CT_PROTO_DCCP
371
372config NF_NAT_PROTO_UDPLITE
373 tristate
374 depends on NF_NAT && NF_CT_PROTO_UDPLITE
375 default NF_NAT && NF_CT_PROTO_UDPLITE
376
377config NF_NAT_PROTO_SCTP
378 tristate
379 default NF_NAT && NF_CT_PROTO_SCTP
380 depends on NF_NAT && NF_CT_PROTO_SCTP
381 select LIBCRC32C
382
Patrick McHardyee6eb962012-08-26 19:14:22 +0200383config NF_NAT_AMANDA
384 tristate
385 depends on NF_CONNTRACK && NF_NAT
386 default NF_NAT && NF_CONNTRACK_AMANDA
387
Patrick McHardyd33cbee2012-08-26 19:14:20 +0200388config NF_NAT_FTP
389 tristate
390 depends on NF_CONNTRACK && NF_NAT
391 default NF_NAT && NF_CONNTRACK_FTP
392
Pablo Neira Ayuso5901b6b2012-08-26 19:14:27 +0200393config NF_NAT_IRC
394 tristate
395 depends on NF_CONNTRACK && NF_NAT
396 default NF_NAT && NF_CONNTRACK_IRC
397
Patrick McHardy9a664822012-08-26 19:14:25 +0200398config NF_NAT_SIP
399 tristate
400 depends on NF_CONNTRACK && NF_NAT
401 default NF_NAT && NF_CONNTRACK_SIP
402
Pablo Neira Ayuso320ff562012-08-26 19:14:29 +0200403config NF_NAT_TFTP
404 tristate
405 depends on NF_CONNTRACK && NF_NAT
406 default NF_NAT && NF_CONNTRACK_TFTP
407
Laszlo Attila Toth4b070662009-04-24 16:55:25 +0200408endif # NF_CONNTRACK
409
KOVACS Krisztian9ad2d742008-10-08 11:35:12 +0200410# transparent proxy support
411config NETFILTER_TPROXY
412 tristate "Transparent proxying support (EXPERIMENTAL)"
413 depends on EXPERIMENTAL
414 depends on IP_NF_MANGLE
415 depends on NETFILTER_ADVANCED
416 help
417 This option enables transparent proxying support, that is,
418 support for handling non-locally bound IPv4 TCP and UDP sockets.
419 For it to work you will have to configure certain iptables rules
420 and use policy routing. For more information on how to set it up
421 see Documentation/networking/tproxy.txt.
422
423 To compile it as a module, choose M here. If unsure, say N.
424
Harald Welte2e4e6a12006-01-12 13:30:04 -0800425config NETFILTER_XTABLES
426 tristate "Netfilter Xtables support (required for ip_tables)"
Patrick McHardy33b8e772007-12-17 22:47:05 -0800427 default m if NETFILTER_ADVANCED=n
Harald Welte2e4e6a12006-01-12 13:30:04 -0800428 help
429 This is required if you intend to use any of ip_tables,
430 ip6_tables or arp_tables.
431
Jan Engelhardtc2df73d2008-10-08 11:35:18 +0200432if NETFILTER_XTABLES
433
Jan Engelhardt28b94982009-02-28 03:23:57 +0100434comment "Xtables combined modules"
435
436config NETFILTER_XT_MARK
437 tristate 'nfmark target and match support'
438 default m if NETFILTER_ADVANCED=n
439 ---help---
440 This option adds the "MARK" target and "mark" match.
441
442 Netfilter mark matching allows you to match packets based on the
443 "nfmark" value in the packet.
444 The target allows you to create rules in the "mangle" table which alter
445 the netfilter mark (nfmark) field associated with the packet.
446
447 Prior to routing, the nfmark can influence the routing method (see
448 "Use netfilter MARK value as routing key") and can also be used by
449 other subsystems to change their behavior.
450
Jan Engelhardtb8f00ba2010-02-26 14:20:32 +0100451config NETFILTER_XT_CONNMARK
452 tristate 'ctmark target and match support'
453 depends on NF_CONNTRACK
454 depends on NETFILTER_ADVANCED
455 select NF_CONNTRACK_MARK
456 ---help---
457 This option adds the "CONNMARK" target and "connmark" match.
458
459 Netfilter allows you to store a mark value per connection (a.k.a.
460 ctmark), similarly to the packet mark (nfmark). Using this
461 target and match, you can set and match on this mark.
462
Jozsef Kadlecsikd9567982011-02-01 15:56:00 +0100463config NETFILTER_XT_SET
464 tristate 'set target and match support'
465 depends on IP_SET
466 depends on NETFILTER_ADVANCED
467 help
468 This option adds the "SET" target and "set" match.
469
470 Using this target and match, you can add/delete and match
471 elements in the sets created by ipset(8).
472
473 To compile it as a module, choose M here. If unsure, say N.
474
Harald Welte2e4e6a12006-01-12 13:30:04 -0800475# alphabetically ordered list of targets
476
Jan Engelhardt44c58732010-02-26 14:14:22 +0100477comment "Xtables targets"
478
Thomas Graf43f393c2011-01-16 18:10:28 +0100479config NETFILTER_XT_TARGET_AUDIT
480 tristate "AUDIT target support"
481 depends on AUDIT
482 depends on NETFILTER_ADVANCED
483 ---help---
484 This option adds a 'AUDIT' target, which can be used to create
485 audit records for packets dropped/accepted.
486
487 To compileit as a module, choose M here. If unsure, say N.
488
Michael S. Tsirkinedf0e1f2010-07-15 17:20:46 +0200489config NETFILTER_XT_TARGET_CHECKSUM
490 tristate "CHECKSUM target support"
491 depends on IP_NF_MANGLE || IP6_NF_MANGLE
492 depends on NETFILTER_ADVANCED
493 ---help---
494 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
495 table.
496
497 You can use this target to compute and fill in the checksum in
498 a packet that lacks a checksum. This is particularly useful,
499 if you need to work around old applications such as dhcp clients,
500 that do not work well with checksum offloads, but don't want to disable
501 checksum offload in your device.
502
503 To compile it as a module, choose M here. If unsure, say N.
504
Harald Welte2e4e6a12006-01-12 13:30:04 -0800505config NETFILTER_XT_TARGET_CLASSIFY
506 tristate '"CLASSIFY" target support'
Patrick McHardy33b8e772007-12-17 22:47:05 -0800507 depends on NETFILTER_ADVANCED
Harald Welte2e4e6a12006-01-12 13:30:04 -0800508 help
509 This option adds a `CLASSIFY' target, which enables the user to set
510 the priority of a packet. Some qdiscs can use this value for
511 classification, among these are:
512
513 atm, cbq, dsmark, pfifo_fast, htb, prio
514
515 To compile it as a module, choose M here. If unsure, say N.
516
517config NETFILTER_XT_TARGET_CONNMARK
518 tristate '"CONNMARK" target support'
Patrick McHardy587aa642007-03-14 16:37:25 -0700519 depends on NF_CONNTRACK
Patrick McHardy33b8e772007-12-17 22:47:05 -0800520 depends on NETFILTER_ADVANCED
Jan Engelhardtb8f00ba2010-02-26 14:20:32 +0100521 select NETFILTER_XT_CONNMARK
522 ---help---
523 This is a backwards-compat option for the user's convenience
524 (e.g. when running oldconfig). It selects
525 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
Harald Welte2e4e6a12006-01-12 13:30:04 -0800526
Jan Engelhardtaba0d342008-10-08 11:35:17 +0200527config NETFILTER_XT_TARGET_CONNSECMARK
528 tristate '"CONNSECMARK" target support'
Jan Engelhardtc2df73d2008-10-08 11:35:18 +0200529 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
Jan Engelhardtaba0d342008-10-08 11:35:17 +0200530 default m if NETFILTER_ADVANCED=n
531 help
532 The CONNSECMARK target copies security markings from packets
533 to connections, and restores security markings from connections
534 to packets (if the packets are not already marked). This would
535 normally be used in conjunction with the SECMARK target.
536
537 To compile it as a module, choose M here. If unsure, say N.
538
Patrick McHardy84f3bb92010-02-03 17:17:06 +0100539config NETFILTER_XT_TARGET_CT
540 tristate '"CT" target support'
541 depends on NF_CONNTRACK
542 depends on IP_NF_RAW || IP6_NF_RAW
543 depends on NETFILTER_ADVANCED
544 help
545 This options adds a `CT' target, which allows to specify initial
546 connection tracking parameters like events to be delivered and
547 the helper to be used.
548
549 To compile it as a module, choose M here. If unsure, say N.
550
Yasuyuki Kozakaia4687012006-08-22 00:30:26 -0700551config NETFILTER_XT_TARGET_DSCP
Jan Engelhardtc9fd4962007-12-04 23:38:13 -0800552 tristate '"DSCP" and "TOS" target support'
Yasuyuki Kozakaia4687012006-08-22 00:30:26 -0700553 depends on IP_NF_MANGLE || IP6_NF_MANGLE
Patrick McHardy33b8e772007-12-17 22:47:05 -0800554 depends on NETFILTER_ADVANCED
Yasuyuki Kozakaia4687012006-08-22 00:30:26 -0700555 help
556 This option adds a `DSCP' target, which allows you to manipulate
557 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
558
559 The DSCP field can have any value between 0x0 and 0x3f inclusive.
560
Jan Engelhardtc9fd4962007-12-04 23:38:13 -0800561 It also adds the "TOS" target, which allows you to create rules in
562 the "mangle" table which alter the Type Of Service field of an IPv4
Jan Engelhardt5c350e52007-12-04 23:39:09 -0800563 or the Priority field of an IPv6 packet, prior to routing.
Jan Engelhardtc9fd4962007-12-04 23:38:13 -0800564
Yasuyuki Kozakaia4687012006-08-22 00:30:26 -0700565 To compile it as a module, choose M here. If unsure, say N.
566
Jan Engelhardt563d36e2009-02-18 18:38:40 +0100567config NETFILTER_XT_TARGET_HL
568 tristate '"HL" hoplimit target support'
569 depends on IP_NF_MANGLE || IP6_NF_MANGLE
570 depends on NETFILTER_ADVANCED
571 ---help---
572 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
573 targets, which enable the user to change the
574 hoplimit/time-to-live value of the IP header.
575
576 While it is safe to decrement the hoplimit/TTL value, the
577 modules also allow to increment and set the hoplimit value of
578 the header to arbitrary values. This is EXTREMELY DANGEROUS
579 since you can easily create immortal packets that loop
580 forever on the network.
581
Hans Schillstromcf308a12012-05-02 07:49:47 +0000582config NETFILTER_XT_TARGET_HMARK
583 tristate '"HMARK" target support'
584 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
585 depends on NETFILTER_ADVANCED
586 ---help---
587 This option adds the "HMARK" target.
588
589 The target allows you to create rules in the "raw" and "mangle" tables
590 which set the skbuff mark by means of hash calculation within a given
591 range. The nfmark can influence the routing method (see "Use netfilter
592 MARK value as routing key") and can also be used by other subsystems to
593 change their behaviour.
594
595 To compile it as a module, choose M here. If unsure, say N.
596
Luciano Coelho0902b462010-06-15 15:04:00 +0200597config NETFILTER_XT_TARGET_IDLETIMER
598 tristate "IDLETIMER target support"
599 depends on NETFILTER_ADVANCED
600 help
601
602 This option adds the `IDLETIMER' target. Each matching packet
603 resets the timer associated with label specified when the rule is
604 added. When the timer expires, it triggers a sysfs notification.
605 The remaining time for expiration can be read via sysfs.
606
607 To compile it as a module, choose M here. If unsure, say N.
608
Adam Nielsen268cb382009-02-20 10:55:14 +0100609config NETFILTER_XT_TARGET_LED
610 tristate '"LED" target support'
Alex Riesen3ae16f12009-04-06 17:09:43 +0200611 depends on LEDS_CLASS && LEDS_TRIGGERS
Adam Nielsen268cb382009-02-20 10:55:14 +0100612 depends on NETFILTER_ADVANCED
613 help
614 This option adds a `LED' target, which allows you to blink LEDs in
615 response to particular packets passing through your machine.
616
617 This can be used to turn a spare LED into a network activity LED,
618 which only flashes in response to FTP transfers, for example. Or
619 you could have an LED which lights up for a minute or two every time
620 somebody connects to your machine via SSH.
621
622 You will need support for the "led" class to make this work.
623
624 To create an LED trigger for incoming SSH traffic:
625 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
626
627 Then attach the new trigger to an LED on your system:
628 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
629
630 For more information on the LEDs available on your system, see
Paul Bolle395cf962011-08-15 02:02:26 +0200631 Documentation/leds/leds-class.txt
Adam Nielsen268cb382009-02-20 10:55:14 +0100632
Richard Weinberger6939c332012-02-10 23:10:52 +0100633config NETFILTER_XT_TARGET_LOG
634 tristate "LOG target support"
635 default m if NETFILTER_ADVANCED=n
636 help
637 This option adds a `LOG' target, which allows you to create rules in
638 any iptables table which records the packet header to the syslog.
639
640 To compile it as a module, choose M here. If unsure, say N.
641
Harald Welte2e4e6a12006-01-12 13:30:04 -0800642config NETFILTER_XT_TARGET_MARK
643 tristate '"MARK" target support'
Jan Engelhardt28b94982009-02-28 03:23:57 +0100644 depends on NETFILTER_ADVANCED
645 select NETFILTER_XT_MARK
646 ---help---
647 This is a backwards-compat option for the user's convenience
648 (e.g. when running oldconfig). It selects
649 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
Harald Welte2e4e6a12006-01-12 13:30:04 -0800650
Jan Engelhardtb3d54b32012-09-21 11:37:59 +0200651config NETFILTER_XT_TARGET_NETMAP
652 tristate '"NETMAP" target support'
653 depends on NF_NAT
654 ---help---
655 NETMAP is an implementation of static 1:1 NAT mapping of network
656 addresses. It maps the network address part, while keeping the host
657 address part intact.
658
659 To compile it as a module, choose M here. If unsure, say N.
660
Patrick McHardybaf7b1e2006-11-29 02:35:38 +0100661config NETFILTER_XT_TARGET_NFLOG
662 tristate '"NFLOG" target support'
Patrick McHardy33b8e772007-12-17 22:47:05 -0800663 default m if NETFILTER_ADVANCED=n
Eric Leblond293a4f22008-12-10 17:24:33 -0800664 select NETFILTER_NETLINK_LOG
Patrick McHardybaf7b1e2006-11-29 02:35:38 +0100665 help
666 This option enables the NFLOG target, which allows to LOG
Eric Leblond293a4f22008-12-10 17:24:33 -0800667 messages through nfnetlink_log.
Patrick McHardybaf7b1e2006-11-29 02:35:38 +0100668
669 To compile it as a module, choose M here. If unsure, say N.
670
Jan Engelhardtaba0d342008-10-08 11:35:17 +0200671config NETFILTER_XT_TARGET_NFQUEUE
672 tristate '"NFQUEUE" target Support'
Jan Engelhardtaba0d342008-10-08 11:35:17 +0200673 depends on NETFILTER_ADVANCED
Florian Westphal5f2cafe2011-01-18 15:18:08 +0100674 select NETFILTER_NETLINK_QUEUE
Jan Engelhardtaba0d342008-10-08 11:35:17 +0200675 help
676 This target replaced the old obsolete QUEUE target.
677
678 As opposed to QUEUE, it supports 65535 different queues,
679 not just one.
680
681 To compile it as a module, choose M here. If unsure, say N.
682
Patrick McHardy58590342007-12-04 23:40:05 -0800683config NETFILTER_XT_TARGET_RATEEST
684 tristate '"RATEEST" target support'
Patrick McHardyb26e76b2008-01-14 23:30:56 -0800685 depends on NETFILTER_ADVANCED
Patrick McHardy58590342007-12-04 23:40:05 -0800686 help
687 This option adds a `RATEEST' target, which allows to measure
688 rates similar to TC estimators. The `rateest' match can be
689 used to match on the measured rates.
690
691 To compile it as a module, choose M here. If unsure, say N.
692
Jan Engelhardt2cbc78a2012-09-21 11:41:34 +0200693config NETFILTER_XT_TARGET_REDIRECT
694 tristate "REDIRECT target support"
695 depends on NF_NAT
696 ---help---
697 REDIRECT is a special case of NAT: all incoming connections are
698 mapped onto the incoming interface's address, causing the packets to
699 come to the local machine instead of passing through. This is
700 useful for transparent proxies.
701
702 To compile it as a module, choose M here. If unsure, say N.
703
Jan Engelhardte281b192010-04-19 14:17:47 +0200704config NETFILTER_XT_TARGET_TEE
Arnd Hannemannfe6fb552010-06-22 08:22:21 +0200705 tristate '"TEE" - packet cloning to alternate destination'
Jan Engelhardte281b192010-04-19 14:17:47 +0200706 depends on NETFILTER_ADVANCED
Jan Engelhardt9b7ce2b2010-05-12 10:11:35 +0000707 depends on (IPV6 || IPV6=n)
Randy Dunlap83827f62010-05-14 13:52:30 -0700708 depends on !NF_CONNTRACK || NF_CONNTRACK
Jan Engelhardte281b192010-04-19 14:17:47 +0200709 ---help---
710 This option adds a "TEE" target with which a packet can be cloned and
711 this clone be rerouted to another nexthop.
712
KOVACS Krisztiane8439272008-10-08 11:35:12 +0200713config NETFILTER_XT_TARGET_TPROXY
714 tristate '"TPROXY" target support (EXPERIMENTAL)'
715 depends on EXPERIMENTAL
716 depends on NETFILTER_TPROXY
717 depends on NETFILTER_XTABLES
718 depends on NETFILTER_ADVANCED
719 select NF_DEFRAG_IPV4
KOVACS Krisztianf6318e52010-10-24 23:38:32 +0000720 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
KOVACS Krisztiane8439272008-10-08 11:35:12 +0200721 help
722 This option adds a `TPROXY' target, which is somewhat similar to
723 REDIRECT. It can only be used in the mangle table and is useful
724 to redirect traffic to a transparent proxy. It does _not_ depend
725 on Netfilter connection tracking and NAT, unlike REDIRECT.
726
727 To compile it as a module, choose M here. If unsure, say N.
728
Jozsef Kadlecsikba9dda32007-07-07 22:21:23 -0700729config NETFILTER_XT_TARGET_TRACE
730 tristate '"TRACE" target support'
Jozsef Kadlecsikba9dda32007-07-07 22:21:23 -0700731 depends on IP_NF_RAW || IP6_NF_RAW
Patrick McHardy33b8e772007-12-17 22:47:05 -0800732 depends on NETFILTER_ADVANCED
Jozsef Kadlecsikba9dda32007-07-07 22:21:23 -0700733 help
734 The TRACE target allows you to mark packets so that the kernel
735 will log every rule which match the packets as those traverse
736 the tables, chains, rules.
737
738 If you want to compile it as a module, say M here and read
Dirk Hohndele4031492007-10-30 13:37:19 -0700739 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
Jozsef Kadlecsikba9dda32007-07-07 22:21:23 -0700740
James Morris5e6874c2006-06-09 00:30:57 -0700741config NETFILTER_XT_TARGET_SECMARK
742 tristate '"SECMARK" target support'
Jan Engelhardtc2df73d2008-10-08 11:35:18 +0200743 depends on NETWORK_SECMARK
Patrick McHardy33b8e772007-12-17 22:47:05 -0800744 default m if NETFILTER_ADVANCED=n
James Morris5e6874c2006-06-09 00:30:57 -0700745 help
746 The SECMARK target allows security marking of network
747 packets, for use with security subsystems.
748
749 To compile it as a module, choose M here. If unsure, say N.
750
Patrick McHardycdd289a2007-02-07 15:09:46 -0800751config NETFILTER_XT_TARGET_TCPMSS
752 tristate '"TCPMSS" target support'
Jan Engelhardtc2df73d2008-10-08 11:35:18 +0200753 depends on (IPV6 || IPV6=n)
Patrick McHardy33b8e772007-12-17 22:47:05 -0800754 default m if NETFILTER_ADVANCED=n
Patrick McHardycdd289a2007-02-07 15:09:46 -0800755 ---help---
756 This option adds a `TCPMSS' target, which allows you to alter the
757 MSS value of TCP SYN packets, to control the maximum size for that
758 connection (usually limiting it to your outgoing interface's MTU
759 minus 40).
760
761 This is used to overcome criminally braindead ISPs or servers which
762 block ICMP Fragmentation Needed packets. The symptoms of this
763 problem are that everything works fine from your Linux
764 firewall/router, but machines behind it can never exchange large
765 packets:
766 1) Web browsers connect, then hang with no data received.
767 2) Small mail works fine, but large emails hang.
768 3) ssh works fine, but scp hangs after initial handshaking.
769
770 Workaround: activate this option and add a rule to your firewall
771 configuration like:
772
773 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
774 -j TCPMSS --clamp-mss-to-pmtu
775
776 To compile it as a module, choose M here. If unsure, say N.
777
Sven Schnelle338e8a72007-12-04 23:21:50 -0800778config NETFILTER_XT_TARGET_TCPOPTSTRIP
779 tristate '"TCPOPTSTRIP" target support (EXPERIMENTAL)'
Jan Engelhardtc2df73d2008-10-08 11:35:18 +0200780 depends on EXPERIMENTAL
Sven Schnelle338e8a72007-12-04 23:21:50 -0800781 depends on IP_NF_MANGLE || IP6_NF_MANGLE
Patrick McHardy33b8e772007-12-17 22:47:05 -0800782 depends on NETFILTER_ADVANCED
Sven Schnelle338e8a72007-12-04 23:21:50 -0800783 help
784 This option adds a "TCPOPTSTRIP" target, which allows you to strip
785 TCP options from TCP packets.
786
Jan Engelhardt44c58732010-02-26 14:14:22 +0100787# alphabetically ordered list of matches
788
789comment "Xtables matches"
790
Florian Westphalde81bbe2011-03-15 20:16:20 +0100791config NETFILTER_XT_MATCH_ADDRTYPE
792 tristate '"addrtype" address type match support'
793 depends on NETFILTER_ADVANCED
794 ---help---
795 This option allows you to match what routing thinks of an address,
796 eg. UNICAST, LOCAL, BROADCAST, ...
797
798 If you want to compile it as a module, say M here and read
799 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
800
Pablo Neira Ayuso0269ea42009-03-16 17:10:36 +0100801config NETFILTER_XT_MATCH_CLUSTER
802 tristate '"cluster" match support'
803 depends on NF_CONNTRACK
804 depends on NETFILTER_ADVANCED
805 ---help---
806 This option allows you to build work-load-sharing clusters of
807 network servers/stateful firewalls without having a dedicated
808 load-balancing router/server/switch. Basically, this match returns
809 true when the packet must be handled by this cluster node. Thus,
810 all nodes see all packets and this match decides which node handles
811 what packets. The work-load sharing algorithm is based on source
812 address hashing.
813
814 If you say Y or M here, try `iptables -m cluster --help` for
815 more information.
816
Harald Welte2e4e6a12006-01-12 13:30:04 -0800817config NETFILTER_XT_MATCH_COMMENT
818 tristate '"comment" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -0800819 depends on NETFILTER_ADVANCED
Harald Welte2e4e6a12006-01-12 13:30:04 -0800820 help
821 This option adds a `comment' dummy-match, which allows you to put
822 comments in your iptables ruleset.
823
824 If you want to compile it as a module, say M here and read
Alexander E. Patrakov39f5fb32007-03-16 18:28:43 +0500825 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
Harald Welte2e4e6a12006-01-12 13:30:04 -0800826
827config NETFILTER_XT_MATCH_CONNBYTES
828 tristate '"connbytes" per-connection counter match support'
Patrick McHardy587aa642007-03-14 16:37:25 -0700829 depends on NF_CONNTRACK
Patrick McHardy33b8e772007-12-17 22:47:05 -0800830 depends on NETFILTER_ADVANCED
Harald Welte2e4e6a12006-01-12 13:30:04 -0800831 help
832 This option adds a `connbytes' match, which allows you to match the
833 number of bytes and/or packets for each direction within a connection.
834
835 If you want to compile it as a module, say M here and read
Alexander E. Patrakov39f5fb32007-03-16 18:28:43 +0500836 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
Harald Welte2e4e6a12006-01-12 13:30:04 -0800837
Jan Engelhardt370786f2007-07-14 20:47:26 -0700838config NETFILTER_XT_MATCH_CONNLIMIT
839 tristate '"connlimit" match support"'
Cornelia Huck3fd8f9e2007-07-18 02:38:32 -0700840 depends on NF_CONNTRACK
Patrick McHardy33b8e772007-12-17 22:47:05 -0800841 depends on NETFILTER_ADVANCED
Jan Engelhardt370786f2007-07-14 20:47:26 -0700842 ---help---
843 This match allows you to match against the number of parallel
844 connections to a server per client IP address (or address block).
845
Harald Welte2e4e6a12006-01-12 13:30:04 -0800846config NETFILTER_XT_MATCH_CONNMARK
847 tristate '"connmark" connection mark match support'
Patrick McHardy587aa642007-03-14 16:37:25 -0700848 depends on NF_CONNTRACK
Patrick McHardy33b8e772007-12-17 22:47:05 -0800849 depends on NETFILTER_ADVANCED
Jan Engelhardtb8f00ba2010-02-26 14:20:32 +0100850 select NETFILTER_XT_CONNMARK
851 ---help---
852 This is a backwards-compat option for the user's convenience
853 (e.g. when running oldconfig). It selects
854 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
Harald Welte2e4e6a12006-01-12 13:30:04 -0800855
856config NETFILTER_XT_MATCH_CONNTRACK
857 tristate '"conntrack" connection tracking match support'
Patrick McHardy587aa642007-03-14 16:37:25 -0700858 depends on NF_CONNTRACK
Patrick McHardy33b8e772007-12-17 22:47:05 -0800859 default m if NETFILTER_ADVANCED=n
Harald Welte2e4e6a12006-01-12 13:30:04 -0800860 help
861 This is a general conntrack match module, a superset of the state match.
862
863 It allows matching on additional conntrack information, which is
864 useful in complex configurations, such as NAT gateways with multiple
865 internet links or tunnels.
866
867 To compile it as a module, choose M here. If unsure, say N.
868
Eric Dumazete8648a12010-07-23 12:59:36 +0200869config NETFILTER_XT_MATCH_CPU
870 tristate '"cpu" match support'
871 depends on NETFILTER_ADVANCED
872 help
873 CPU matching allows you to match packets based on the CPU
874 currently handling the packet.
875
876 To compile it as a module, choose M here. If unsure, say N.
877
Harald Welte2e4e6a12006-01-12 13:30:04 -0800878config NETFILTER_XT_MATCH_DCCP
Jan Engelhardt4c377992007-12-04 23:31:59 -0800879 tristate '"dccp" protocol match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -0800880 depends on NETFILTER_ADVANCED
Patrick McHardyf3261af2008-05-08 01:16:04 -0700881 default IP_DCCP
Harald Welte2e4e6a12006-01-12 13:30:04 -0800882 help
883 With this option enabled, you will be able to use the iptables
884 `dccp' match in order to match on DCCP source/destination ports
885 and DCCP flags.
886
887 If you want to compile it as a module, say M here and read
Alexander E. Patrakov39f5fb32007-03-16 18:28:43 +0500888 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
Harald Welte2e4e6a12006-01-12 13:30:04 -0800889
Patrick McHardy92917472011-02-03 00:05:43 +0100890config NETFILTER_XT_MATCH_DEVGROUP
891 tristate '"devgroup" match support'
892 depends on NETFILTER_ADVANCED
893 help
894 This options adds a `devgroup' match, which allows to match on the
895 device group a network device is assigned to.
896
897 To compile it as a module, choose M here. If unsure, say N.
898
Yasuyuki Kozakai9ba16272006-08-22 00:29:37 -0700899config NETFILTER_XT_MATCH_DSCP
Jan Engelhardtc3b33e62007-12-04 23:37:54 -0800900 tristate '"dscp" and "tos" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -0800901 depends on NETFILTER_ADVANCED
Yasuyuki Kozakai9ba16272006-08-22 00:29:37 -0700902 help
903 This option adds a `DSCP' match, which allows you to match against
904 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
905
906 The DSCP field can have any value between 0x0 and 0x3f inclusive.
907
Jan Engelhardtc3b33e62007-12-04 23:37:54 -0800908 It will also add a "tos" match, which allows you to match packets
909 based on the Type Of Service fields of the IPv4 packet (which share
910 the same bits as DSCP).
911
Yasuyuki Kozakai9ba16272006-08-22 00:29:37 -0700912 To compile it as a module, choose M here. If unsure, say N.
913
Jan Engelhardtd446a8202011-06-09 21:03:07 +0200914config NETFILTER_XT_MATCH_ECN
915 tristate '"ecn" match support'
916 depends on NETFILTER_ADVANCED
917 ---help---
918 This option adds an "ECN" match, which allows you to match against
919 the IPv4 and TCP header ECN fields.
920
921 To compile it as a module, choose M here. If unsure, say N.
922
Yasuyuki Kozakaidc5ab2f2006-04-01 02:22:30 -0800923config NETFILTER_XT_MATCH_ESP
Jan Engelhardt4c377992007-12-04 23:31:59 -0800924 tristate '"esp" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -0800925 depends on NETFILTER_ADVANCED
Yasuyuki Kozakaidc5ab2f2006-04-01 02:22:30 -0800926 help
927 This match extension allows you to match a range of SPIs
928 inside ESP header of IPSec packets.
929
930 To compile it as a module, choose M here. If unsure, say N.
931
Jan Engelhardtaba0d342008-10-08 11:35:17 +0200932config NETFILTER_XT_MATCH_HASHLIMIT
933 tristate '"hashlimit" match support'
Jan Engelhardtc2df73d2008-10-08 11:35:18 +0200934 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
Jan Engelhardtaba0d342008-10-08 11:35:17 +0200935 depends on NETFILTER_ADVANCED
936 help
937 This option adds a `hashlimit' match.
938
939 As opposed to `limit', this match dynamically creates a hash table
940 of limit buckets, based on your selection of source/destination
941 addresses and/or ports.
942
943 It enables you to express policies like `10kpps for any given
944 destination address' or `500pps from any given source address'
945 with a single rule.
946
Harald Welte2e4e6a12006-01-12 13:30:04 -0800947config NETFILTER_XT_MATCH_HELPER
948 tristate '"helper" match support'
Patrick McHardy587aa642007-03-14 16:37:25 -0700949 depends on NF_CONNTRACK
Patrick McHardy33b8e772007-12-17 22:47:05 -0800950 depends on NETFILTER_ADVANCED
Harald Welte2e4e6a12006-01-12 13:30:04 -0800951 help
952 Helper matching allows you to match packets in dynamic connections
953 tracked by a conntrack-helper, ie. ip_conntrack_ftp
954
955 To compile it as a module, choose M here. If unsure, say Y.
956
Jan Engelhardtcfac5ef2009-02-18 18:39:31 +0100957config NETFILTER_XT_MATCH_HL
958 tristate '"hl" hoplimit/TTL match support'
959 depends on NETFILTER_ADVANCED
960 ---help---
961 HL matching allows you to match packets based on the hoplimit
962 in the IPv6 header, or the time-to-live field in the IPv4
963 header of the packet.
964
Jan Engelhardtf72e25a2008-01-14 23:42:47 -0800965config NETFILTER_XT_MATCH_IPRANGE
966 tristate '"iprange" address range match support'
Jan Engelhardtf72e25a2008-01-14 23:42:47 -0800967 depends on NETFILTER_ADVANCED
968 ---help---
969 This option adds a "iprange" match, which allows you to match based on
970 an IP address range. (Normal iptables only matches on single addresses
971 with an optional mask.)
972
973 If unsure, say M.
974
Hannes Eder9c3e1c32010-07-23 12:42:58 +0200975config NETFILTER_XT_MATCH_IPVS
976 tristate '"ipvs" match support'
977 depends on IP_VS
978 depends on NETFILTER_ADVANCED
979 depends on NF_CONNTRACK
980 help
981 This option allows you to match against IPVS properties of a packet.
982
983 If unsure, say N.
984
Harald Welte2e4e6a12006-01-12 13:30:04 -0800985config NETFILTER_XT_MATCH_LENGTH
986 tristate '"length" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -0800987 depends on NETFILTER_ADVANCED
Harald Welte2e4e6a12006-01-12 13:30:04 -0800988 help
989 This option allows you to match the length of a packet against a
990 specific value or range of values.
991
992 To compile it as a module, choose M here. If unsure, say N.
993
994config NETFILTER_XT_MATCH_LIMIT
995 tristate '"limit" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -0800996 depends on NETFILTER_ADVANCED
Harald Welte2e4e6a12006-01-12 13:30:04 -0800997 help
998 limit matching allows you to control the rate at which a rule can be
999 matched: mainly useful in combination with the LOG target ("LOG
1000 target support", below) and to avoid some Denial of Service attacks.
1001
1002 To compile it as a module, choose M here. If unsure, say N.
1003
1004config NETFILTER_XT_MATCH_MAC
1005 tristate '"mac" address match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -08001006 depends on NETFILTER_ADVANCED
Harald Welte2e4e6a12006-01-12 13:30:04 -08001007 help
1008 MAC matching allows you to match packets based on the source
1009 Ethernet address of the packet.
1010
1011 To compile it as a module, choose M here. If unsure, say N.
1012
1013config NETFILTER_XT_MATCH_MARK
1014 tristate '"mark" match support'
Jan Engelhardt28b94982009-02-28 03:23:57 +01001015 depends on NETFILTER_ADVANCED
1016 select NETFILTER_XT_MARK
1017 ---help---
1018 This is a backwards-compat option for the user's convenience
1019 (e.g. when running oldconfig). It selects
1020 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
Harald Welte2e4e6a12006-01-12 13:30:04 -08001021
Jan Engelhardtaba0d342008-10-08 11:35:17 +02001022config NETFILTER_XT_MATCH_MULTIPORT
1023 tristate '"multiport" Multiple port match support'
Jan Engelhardtaba0d342008-10-08 11:35:17 +02001024 depends on NETFILTER_ADVANCED
1025 help
1026 Multiport matching allows you to match TCP or UDP packets based on
1027 a series of source or destination ports: normally a rule can only
1028 match a single range of ports.
1029
1030 To compile it as a module, choose M here. If unsure, say N.
1031
Pablo Neira Ayusoceb98d02011-12-23 14:28:59 +01001032config NETFILTER_XT_MATCH_NFACCT
1033 tristate '"nfacct" match support'
Pablo Neira Ayusobc94b522011-12-28 15:03:30 +00001034 depends on NETFILTER_ADVANCED
Pablo Neira Ayusoceb98d02011-12-23 14:28:59 +01001035 select NETFILTER_NETLINK_ACCT
1036 help
1037 This option allows you to use the extended accounting through
1038 nfnetlink_acct.
1039
1040 To compile it as a module, choose M here. If unsure, say N.
1041
Jan Engelhardt115bc8f2010-03-16 20:06:55 +01001042config NETFILTER_XT_MATCH_OSF
1043 tristate '"osf" Passive OS fingerprint match'
1044 depends on NETFILTER_ADVANCED && NETFILTER_NETLINK
1045 help
1046 This option selects the Passive OS Fingerprinting match module
1047 that allows to passively match the remote operating system by
1048 analyzing incoming TCP SYN packets.
1049
1050 Rules and loading software can be downloaded from
1051 http://www.ioremap.net/projects/osf
1052
1053 To compile it as a module, choose M here. If unsure, say N.
1054
Jan Engelhardt0265ab42007-12-04 23:27:38 -08001055config NETFILTER_XT_MATCH_OWNER
1056 tristate '"owner" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -08001057 depends on NETFILTER_ADVANCED
Jan Engelhardt0265ab42007-12-04 23:27:38 -08001058 ---help---
1059 Socket owner matching allows you to match locally-generated packets
1060 based on who created the socket: the user or group. It is also
1061 possible to check whether a socket actually exists.
1062
Patrick McHardyc4b88512006-03-20 18:03:40 -08001063config NETFILTER_XT_MATCH_POLICY
1064 tristate 'IPsec "policy" match support'
Jan Engelhardtc2df73d2008-10-08 11:35:18 +02001065 depends on XFRM
Patrick McHardy33b8e772007-12-17 22:47:05 -08001066 default m if NETFILTER_ADVANCED=n
Patrick McHardyc4b88512006-03-20 18:03:40 -08001067 help
1068 Policy matching allows you to match packets based on the
1069 IPsec policy that was used during decapsulation/will
1070 be used during encapsulation.
1071
1072 To compile it as a module, choose M here. If unsure, say N.
1073
Harald Welte2e4e6a12006-01-12 13:30:04 -08001074config NETFILTER_XT_MATCH_PHYSDEV
1075 tristate '"physdev" match support'
Jan Engelhardtc2df73d2008-10-08 11:35:18 +02001076 depends on BRIDGE && BRIDGE_NETFILTER
Patrick McHardy33b8e772007-12-17 22:47:05 -08001077 depends on NETFILTER_ADVANCED
Harald Welte2e4e6a12006-01-12 13:30:04 -08001078 help
1079 Physdev packet matching matches against the physical bridge ports
1080 the IP packet arrived on or will leave by.
1081
1082 To compile it as a module, choose M here. If unsure, say N.
1083
1084config NETFILTER_XT_MATCH_PKTTYPE
1085 tristate '"pkttype" packet type match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -08001086 depends on NETFILTER_ADVANCED
Harald Welte2e4e6a12006-01-12 13:30:04 -08001087 help
1088 Packet type matching allows you to match a packet by
1089 its "class", eg. BROADCAST, MULTICAST, ...
1090
1091 Typical usage:
1092 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1093
1094 To compile it as a module, choose M here. If unsure, say N.
1095
Patrick McHardy62b77432006-05-29 18:20:32 -07001096config NETFILTER_XT_MATCH_QUOTA
1097 tristate '"quota" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -08001098 depends on NETFILTER_ADVANCED
Patrick McHardy62b77432006-05-29 18:20:32 -07001099 help
1100 This option adds a `quota' match, which allows to match on a
1101 byte counter.
1102
1103 If you want to compile it as a module, say M here and read
Alexander E. Patrakov39f5fb32007-03-16 18:28:43 +05001104 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
Patrick McHardy62b77432006-05-29 18:20:32 -07001105
Patrick McHardy50c164a2007-12-04 13:02:19 +01001106config NETFILTER_XT_MATCH_RATEEST
1107 tristate '"rateest" match support'
Patrick McHardyb26e76b2008-01-14 23:30:56 -08001108 depends on NETFILTER_ADVANCED
Patrick McHardy50c164a2007-12-04 13:02:19 +01001109 select NETFILTER_XT_TARGET_RATEEST
1110 help
1111 This option adds a `rateest' match, which allows to match on the
1112 rate estimated by the RATEEST target.
1113
1114 To compile it as a module, choose M here. If unsure, say N.
1115
Harald Welte2e4e6a12006-01-12 13:30:04 -08001116config NETFILTER_XT_MATCH_REALM
1117 tristate '"realm" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -08001118 depends on NETFILTER_ADVANCED
Patrick McHardyc7066f72011-01-14 13:36:42 +01001119 select IP_ROUTE_CLASSID
Harald Welte2e4e6a12006-01-12 13:30:04 -08001120 help
1121 This option adds a `realm' match, which allows you to use the realm
1122 key from the routing subsystem inside iptables.
Patrick McHardy33b8e772007-12-17 22:47:05 -08001123
Harald Welte2e4e6a12006-01-12 13:30:04 -08001124 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1125 in tc world.
Patrick McHardy33b8e772007-12-17 22:47:05 -08001126
Harald Welte2e4e6a12006-01-12 13:30:04 -08001127 If you want to compile it as a module, say M here and read
Alexander E. Patrakov39f5fb32007-03-16 18:28:43 +05001128 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
Harald Welte2e4e6a12006-01-12 13:30:04 -08001129
Jan Engelhardte948b202008-10-08 11:35:00 +02001130config NETFILTER_XT_MATCH_RECENT
1131 tristate '"recent" match support'
Jan Engelhardte948b202008-10-08 11:35:00 +02001132 depends on NETFILTER_ADVANCED
1133 ---help---
1134 This match is used for creating one or many lists of recently
1135 used addresses and then matching against that/those list(s).
1136
1137 Short options are available by using 'iptables -m recent -h'
1138 Official Website: <http://snowman.net/projects/ipt_recent/>
1139
Harald Welte2e4e6a12006-01-12 13:30:04 -08001140config NETFILTER_XT_MATCH_SCTP
Patrick McHardyd5af981e2006-07-24 22:55:29 -07001141 tristate '"sctp" protocol match support (EXPERIMENTAL)'
Jan Engelhardtc2df73d2008-10-08 11:35:18 +02001142 depends on EXPERIMENTAL
Patrick McHardy33b8e772007-12-17 22:47:05 -08001143 depends on NETFILTER_ADVANCED
Patrick McHardyf3261af2008-05-08 01:16:04 -07001144 default IP_SCTP
Harald Welte2e4e6a12006-01-12 13:30:04 -08001145 help
1146 With this option enabled, you will be able to use the
1147 `sctp' match in order to match on SCTP source/destination ports
1148 and SCTP chunk types.
1149
1150 If you want to compile it as a module, say M here and read
Alexander E. Patrakov39f5fb32007-03-16 18:28:43 +05001151 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
Harald Welte2e4e6a12006-01-12 13:30:04 -08001152
KOVACS Krisztian136cdc72008-10-08 11:35:12 +02001153config NETFILTER_XT_MATCH_SOCKET
1154 tristate '"socket" match support (EXPERIMENTAL)'
1155 depends on EXPERIMENTAL
1156 depends on NETFILTER_TPROXY
1157 depends on NETFILTER_XTABLES
1158 depends on NETFILTER_ADVANCED
Laszlo Attila Tothacda0742009-05-01 15:23:10 -07001159 depends on !NF_CONNTRACK || NF_CONNTRACK
KOVACS Krisztian136cdc72008-10-08 11:35:12 +02001160 select NF_DEFRAG_IPV4
KOVACS Krisztianf6318e52010-10-24 23:38:32 +00001161 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
KOVACS Krisztian136cdc72008-10-08 11:35:12 +02001162 help
1163 This option adds a `socket' match, which can be used to match
1164 packets for which a TCP or UDP socket lookup finds a valid socket.
1165 It can be used in combination with the MARK target and policy
1166 routing to implement full featured non-locally bound sockets.
1167
1168 To compile it as a module, choose M here. If unsure, say N.
1169
Harald Welte2e4e6a12006-01-12 13:30:04 -08001170config NETFILTER_XT_MATCH_STATE
1171 tristate '"state" match support'
Patrick McHardy587aa642007-03-14 16:37:25 -07001172 depends on NF_CONNTRACK
Patrick McHardy33b8e772007-12-17 22:47:05 -08001173 default m if NETFILTER_ADVANCED=n
Harald Welte2e4e6a12006-01-12 13:30:04 -08001174 help
1175 Connection state matching allows you to match packets based on their
1176 relationship to a tracked connection (ie. previous packets). This
1177 is a powerful tool for packet classification.
1178
1179 To compile it as a module, choose M here. If unsure, say N.
1180
Patrick McHardyf3389802006-05-29 18:21:00 -07001181config NETFILTER_XT_MATCH_STATISTIC
1182 tristate '"statistic" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -08001183 depends on NETFILTER_ADVANCED
Patrick McHardyf3389802006-05-29 18:21:00 -07001184 help
Patrick McHardy68c16922006-06-27 03:02:14 -07001185 This option adds a `statistic' match, which allows you to match
1186 on packets periodically or randomly with a given percentage.
1187
1188 To compile it as a module, choose M here. If unsure, say N.
Patrick McHardyf3389802006-05-29 18:21:00 -07001189
Harald Welte2e4e6a12006-01-12 13:30:04 -08001190config NETFILTER_XT_MATCH_STRING
1191 tristate '"string" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -08001192 depends on NETFILTER_ADVANCED
Harald Welte2e4e6a12006-01-12 13:30:04 -08001193 select TEXTSEARCH
1194 select TEXTSEARCH_KMP
1195 select TEXTSEARCH_BM
1196 select TEXTSEARCH_FSM
1197 help
1198 This option adds a `string' match, which allows you to look for
1199 pattern matchings in packets.
1200
1201 To compile it as a module, choose M here. If unsure, say N.
1202
1203config NETFILTER_XT_MATCH_TCPMSS
1204 tristate '"tcpmss" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -08001205 depends on NETFILTER_ADVANCED
Harald Welte2e4e6a12006-01-12 13:30:04 -08001206 help
1207 This option adds a `tcpmss' match, which allows you to examine the
1208 MSS value of TCP SYN packets, which control the maximum packet size
1209 for that connection.
1210
1211 To compile it as a module, choose M here. If unsure, say N.
1212
Jan Engelhardtee4411a2007-09-28 14:46:43 -07001213config NETFILTER_XT_MATCH_TIME
1214 tristate '"time" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -08001215 depends on NETFILTER_ADVANCED
Jan Engelhardtee4411a2007-09-28 14:46:43 -07001216 ---help---
1217 This option adds a "time" match, which allows you to match based on
1218 the packet arrival time (at the machine which netfilter is running)
1219 on) or departure time/date (for locally generated packets).
1220
1221 If you say Y here, try `iptables -m time --help` for
1222 more information.
1223
1224 If you want to compile it as a module, say M here.
1225 If unsure, say N.
1226
Jan Engelhardt1b50b8a2007-07-07 22:20:36 -07001227config NETFILTER_XT_MATCH_U32
1228 tristate '"u32" match support'
Patrick McHardy33b8e772007-12-17 22:47:05 -08001229 depends on NETFILTER_ADVANCED
Jan Engelhardt1b50b8a2007-07-07 22:20:36 -07001230 ---help---
1231 u32 allows you to extract quantities of up to 4 bytes from a packet,
1232 AND them with specified masks, shift them by specified amounts and
1233 test whether the results are in any of a set of specified ranges.
1234 The specification of what to extract is general enough to skip over
1235 headers with lengths stored in the packet, as in IP or TCP header
1236 lengths.
1237
1238 Details and examples are in the kernel module source.
1239
Jan Engelhardtc2df73d2008-10-08 11:35:18 +02001240endif # NETFILTER_XTABLES
Harald Weltea6c1cd572006-02-13 15:42:48 -08001241
Jan Engelhardtc2df73d2008-10-08 11:35:18 +02001242endmenu
Harald Weltef9e815b2005-08-09 19:30:24 -07001243
Jozsef Kadlecsika7b4f982011-02-01 15:28:35 +01001244source "net/netfilter/ipset/Kconfig"
1245
Julius Volzcb7f6a72008-09-19 12:32:57 +02001246source "net/netfilter/ipvs/Kconfig"