1 menu "Core Netfilter Configuration"
2 depends on NET && INET && NETFILTER
4 config NETFILTER_INGRESS
5 bool "Netfilter ingress support"
9 This allows you to classify packets from ingress using the Netfilter
12 config NETFILTER_NETLINK
15 config NETFILTER_FAMILY_BRIDGE
18 config NETFILTER_FAMILY_ARP
21 config NETFILTER_NETLINK_ACCT
22 tristate "Netfilter NFACCT over NFNETLINK interface"
23 depends on NETFILTER_ADVANCED
24 select NETFILTER_NETLINK
26 If this option is enabled, the kernel will include support
27 for extended accounting via NFNETLINK.
29 config NETFILTER_NETLINK_QUEUE
30 tristate "Netfilter NFQUEUE over NFNETLINK interface"
31 depends on NETFILTER_ADVANCED
32 select NETFILTER_NETLINK
34 If this option is enabled, the kernel will include support
35 for queueing packets via NFNETLINK.
37 config NETFILTER_NETLINK_LOG
38 tristate "Netfilter LOG over NFNETLINK interface"
39 default m if NETFILTER_ADVANCED=n
40 select NETFILTER_NETLINK
42 If this option is enabled, the kernel will include support
43 for logging packets via NFNETLINK.
45 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
46 and is also scheduled to replace the old syslog-based ipt_LOG
49 config NETFILTER_NETLINK_OSF
50 tristate "Netfilter OSF over NFNETLINK interface"
51 depends on NETFILTER_ADVANCED
52 select NETFILTER_NETLINK
54 If this option is enabled, the kernel will include support
55 for passive OS fingerprint via NFNETLINK.
58 tristate "Netfilter connection tracking support"
59 default m if NETFILTER_ADVANCED=n
61 select NF_DEFRAG_IPV6 if IPV6 != n
63 Connection tracking keeps a record of what packets have passed
64 through your machine, in order to figure out how they are related
67 This is required to do Masquerading or other kinds of Network
68 Address Translation. It can also be used to enhance packet
69 filtering (see `Connection state match support' below).
71 To compile it as a module, choose M here. If unsure, say N.
77 tristate "Netdev packet logging"
81 config NETFILTER_CONNCOUNT
84 config NF_CONNTRACK_MARK
85 bool 'Connection mark tracking support'
86 depends on NETFILTER_ADVANCED
88 This option enables support for connection marks, used by the
89 `CONNMARK' target and `connmark' match. Similar to the mark value
90 of packets, but this mark value is kept in the conntrack session
91 instead of the individual packets.
93 config NF_CONNTRACK_SECMARK
94 bool 'Connection tracking security mark support'
95 depends on NETWORK_SECMARK
96 default m if NETFILTER_ADVANCED=n
98 This option enables security markings to be applied to
99 connections. Typically they are copied to connections from
100 packets using the CONNSECMARK target and copied back from
101 connections to packets with the same target, with the packets
102 being originally labeled via SECMARK.
106 config NF_CONNTRACK_ZONES
107 bool 'Connection tracking zones'
108 depends on NETFILTER_ADVANCED
110 This option enables support for connection tracking zones.
111 Normally, each connection needs to have a unique system wide
112 identity. Connection tracking zones allow to have multiple
113 connections using the same identity, as long as they are
114 contained in different zones.
118 config NF_CONNTRACK_PROCFS
119 bool "Supply CT list in procfs (OBSOLETE)"
123 This option enables for the list of known conntrack entries
124 to be shown in procfs under net/netfilter/nf_conntrack. This
125 is considered obsolete in favor of using the conntrack(8)
126 tool which uses Netlink.
128 config NF_CONNTRACK_EVENTS
129 bool "Connection tracking events"
130 depends on NETFILTER_ADVANCED
132 If this option is enabled, the connection tracking code will
133 provide a notifier chain that can be used by other kernel code
134 to get notified about changes in the connection tracking state.
138 config NF_CONNTRACK_TIMEOUT
139 bool 'Connection tracking timeout'
140 depends on NETFILTER_ADVANCED
142 This option enables support for connection tracking timeout
143 extension. This allows you to attach timeout policies to flow
148 config NF_CONNTRACK_TIMESTAMP
149 bool 'Connection tracking timestamping'
150 depends on NETFILTER_ADVANCED
152 This option enables support for connection tracking timestamping.
153 This allows you to store the flow start-time and to obtain
154 the flow-stop time (once it has been destroyed) via Connection
159 config NF_CONNTRACK_LABELS
160 bool "Connection tracking labels"
162 This option enables support for assigning user-defined flag bits
163 to connection tracking entries. It can be used with xtables connlabel
164 match and the nftables ct expression.
166 config NF_CT_PROTO_DCCP
167 bool 'DCCP protocol connection tracking support'
168 depends on NETFILTER_ADVANCED
171 With this option enabled, the layer 3 independent connection
172 tracking code will be able to do state tracking on DCCP connections.
176 config NF_CT_PROTO_GRE
179 config NF_CT_PROTO_SCTP
180 bool 'SCTP protocol connection tracking support'
181 depends on NETFILTER_ADVANCED
185 With this option enabled, the layer 3 independent connection
186 tracking code will be able to do state tracking on SCTP connections.
190 config NF_CT_PROTO_UDPLITE
191 bool 'UDP-Lite protocol connection tracking support'
192 depends on NETFILTER_ADVANCED
195 With this option enabled, the layer 3 independent connection
196 tracking code will be able to do state tracking on UDP-Lite
201 config NF_CONNTRACK_AMANDA
202 tristate "Amanda backup protocol support"
203 depends on NETFILTER_ADVANCED
205 select TEXTSEARCH_KMP
207 If you are running the Amanda backup package <http://www.amanda.org/>
208 on this machine or machines that will be MASQUERADED through this
209 machine, then you may want to enable this feature. This allows the
210 connection tracking and natting code to allow the sub-channels that
211 Amanda requires for communication of the backup data, messages and
214 To compile it as a module, choose M here. If unsure, say N.
216 config NF_CONNTRACK_FTP
217 tristate "FTP protocol support"
218 default m if NETFILTER_ADVANCED=n
220 Tracking FTP connections is problematic: special helpers are
221 required for tracking them, and doing masquerading and other forms
222 of Network Address Translation on them.
224 This is FTP support on Layer 3 independent connection tracking.
225 Layer 3 independent connection tracking is experimental scheme
226 which generalize ip_conntrack to support other layer 3 protocols.
228 To compile it as a module, choose M here. If unsure, say N.
230 config NF_CONNTRACK_H323
231 tristate "H.323 protocol support"
232 depends on IPV6 || IPV6=n
233 depends on NETFILTER_ADVANCED
235 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
236 important VoIP protocols, it is widely used by voice hardware and
237 software including voice gateways, IP phones, Netmeeting, OpenPhone,
240 With this module you can support H.323 on a connection tracking/NAT
243 This module supports RAS, Fast Start, H.245 Tunnelling, Call
244 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
245 whiteboard, file transfer, etc. For more information, please
246 visit http://nath323.sourceforge.net/.
248 To compile it as a module, choose M here. If unsure, say N.
250 config NF_CONNTRACK_IRC
251 tristate "IRC protocol support"
252 default m if NETFILTER_ADVANCED=n
254 There is a commonly-used extension to IRC called
255 Direct Client-to-Client Protocol (DCC). This enables users to send
256 files to each other, and also chat to each other without the need
257 of a server. DCC Sending is used anywhere you send files over IRC,
258 and DCC Chat is most commonly used by Eggdrop bots. If you are
259 using NAT, this extension will enable you to send files and initiate
260 chats. Note that you do NOT need this extension to get files or
261 have others initiate chats, or everything else in IRC.
263 To compile it as a module, choose M here. If unsure, say N.
265 config NF_CONNTRACK_BROADCAST
268 config NF_CONNTRACK_NETBIOS_NS
269 tristate "NetBIOS name service protocol support"
270 select NF_CONNTRACK_BROADCAST
272 NetBIOS name service requests are sent as broadcast messages from an
273 unprivileged port and responded to with unicast messages to the
274 same port. This make them hard to firewall properly because connection
275 tracking doesn't deal with broadcasts. This helper tracks locally
276 originating NetBIOS name service requests and the corresponding
277 responses. It relies on correct IP address configuration, specifically
278 netmask and broadcast address. When properly configured, the output
279 of "ip address show" should look similar to this:
281 $ ip -4 address show eth0
282 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
283 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
285 To compile it as a module, choose M here. If unsure, say N.
287 config NF_CONNTRACK_SNMP
288 tristate "SNMP service protocol support"
289 depends on NETFILTER_ADVANCED
290 select NF_CONNTRACK_BROADCAST
292 SNMP service requests are sent as broadcast messages from an
293 unprivileged port and responded to with unicast messages to the
294 same port. This make them hard to firewall properly because connection
295 tracking doesn't deal with broadcasts. This helper tracks locally
296 originating SNMP service requests and the corresponding
297 responses. It relies on correct IP address configuration, specifically
298 netmask and broadcast address.
300 To compile it as a module, choose M here. If unsure, say N.
302 config NF_CONNTRACK_PPTP
303 tristate "PPtP protocol support"
304 depends on NETFILTER_ADVANCED
305 select NF_CT_PROTO_GRE
307 This module adds support for PPTP (Point to Point Tunnelling
308 Protocol, RFC2637) connection tracking and NAT.
310 If you are running PPTP sessions over a stateful firewall or NAT
311 box, you may want to enable this feature.
313 Please note that not all PPTP modes of operation are supported yet.
314 Specifically these limitations exist:
315 - Blindly assumes that control connections are always established
316 in PNS->PAC direction. This is a violation of RFC2637.
317 - Only supports a single call within each session
319 To compile it as a module, choose M here. If unsure, say N.
321 config NF_CONNTRACK_SANE
322 tristate "SANE protocol support"
323 depends on NETFILTER_ADVANCED
325 SANE is a protocol for remote access to scanners as implemented
326 by the 'saned' daemon. Like FTP, it uses separate control and
329 With this module you can support SANE on a connection tracking
332 To compile it as a module, choose M here. If unsure, say N.
334 config NF_CONNTRACK_SIP
335 tristate "SIP protocol support"
336 default m if NETFILTER_ADVANCED=n
338 SIP is an application-layer control protocol that can establish,
339 modify, and terminate multimedia sessions (conferences) such as
340 Internet telephony calls. With the ip_conntrack_sip and
341 the nf_nat_sip modules you can support the protocol on a connection
342 tracking/NATing firewall.
344 To compile it as a module, choose M here. If unsure, say N.
346 config NF_CONNTRACK_TFTP
347 tristate "TFTP protocol support"
348 depends on NETFILTER_ADVANCED
350 TFTP connection tracking helper, this is required depending
351 on how restrictive your ruleset is.
352 If you are using a tftp client behind -j SNAT or -j MASQUERADING
355 To compile it as a module, choose M here. If unsure, say N.
358 tristate 'Connection tracking netlink interface'
359 select NETFILTER_NETLINK
360 default m if NETFILTER_ADVANCED=n
362 This option enables support for a netlink-based userspace interface
364 config NF_CT_NETLINK_TIMEOUT
365 tristate 'Connection tracking timeout tuning via Netlink'
366 select NETFILTER_NETLINK
367 depends on NETFILTER_ADVANCED
368 depends on NF_CONNTRACK_TIMEOUT
370 This option enables support for connection tracking timeout
371 fine-grain tuning. This allows you to attach specific timeout
372 policies to flows, instead of using the global timeout policy.
376 config NF_CT_NETLINK_HELPER
377 tristate 'Connection tracking helpers in user-space via Netlink'
378 select NETFILTER_NETLINK
379 depends on NF_CT_NETLINK
380 depends on NETFILTER_NETLINK_QUEUE
381 depends on NETFILTER_NETLINK_GLUE_CT
382 depends on NETFILTER_ADVANCED
384 This option enables the user-space connection tracking helpers
389 config NETFILTER_NETLINK_GLUE_CT
390 bool "NFQUEUE and NFLOG integration with Connection Tracking"
392 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
394 If this option is enabled, NFQUEUE and NFLOG can include
395 Connection Tracking information together with the packet is
396 the enqueued via NFNETLINK.
399 tristate "Network Address Translation support"
400 depends on NF_CONNTRACK
401 default m if NETFILTER_ADVANCED=n
403 The NAT option allows masquerading, port forwarding and other
404 forms of full Network Address Port Translation. This can be
405 controlled by iptables, ip6tables or nft.
409 depends on NF_CONNTRACK && NF_NAT
410 default NF_NAT && NF_CONNTRACK_AMANDA
414 depends on NF_CONNTRACK && NF_NAT
415 default NF_NAT && NF_CONNTRACK_FTP
419 depends on NF_CONNTRACK && NF_NAT
420 default NF_NAT && NF_CONNTRACK_IRC
424 depends on NF_CONNTRACK && NF_NAT
425 default NF_NAT && NF_CONNTRACK_SIP
429 depends on NF_CONNTRACK && NF_NAT
430 default NF_NAT && NF_CONNTRACK_TFTP
432 config NF_NAT_REDIRECT
435 config NF_NAT_MASQUERADE
438 config NETFILTER_SYNPROXY
444 select NETFILTER_NETLINK
445 tristate "Netfilter nf_tables support"
447 nftables is the new packet classification framework that intends to
448 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
449 provides a pseudo-state machine with an extensible instruction-set
450 (also known as expressions) that the userspace 'nft' utility
451 (http://www.netfilter.org/projects/nftables) uses to build the
452 rule-set. It also comes with the generic set infrastructure that
453 allows you to construct mappings between matchings and actions
454 for performance lookups.
456 To compile it as a module, choose M here.
461 tristate "Netfilter nf_tables set infrastructure"
463 This option enables the nf_tables set infrastructure that allows to
464 look up for elements in a set and to build one-way mappings between
465 matchings and actions.
467 config NF_TABLES_INET
469 select NF_TABLES_IPV4
470 select NF_TABLES_IPV6
471 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
473 This option enables support for a mixed IPv4/IPv6 "inet" table.
475 config NF_TABLES_NETDEV
476 bool "Netfilter nf_tables netdev tables support"
478 This option enables support for the "netdev" table.
481 tristate "Netfilter nf_tables number generator module"
483 This option adds the number generator expression used to perform
484 incremental counting and random numbers bound to a upper limit.
487 depends on NF_CONNTRACK
488 tristate "Netfilter nf_tables conntrack module"
490 This option adds the "ct" expression that you can use to match
491 connection tracking information such as the flow state.
493 config NFT_FLOW_OFFLOAD
494 depends on NF_CONNTRACK && NF_FLOW_TABLE
495 tristate "Netfilter nf_tables hardware flow offload module"
497 This option adds the "flow_offload" expression that you can use to
498 choose what flows are placed into the hardware.
501 tristate "Netfilter nf_tables counter module"
503 This option adds the "counter" expression that you can use to
504 include packet and byte counters in a rule.
507 tristate "Netfilter nf_tables connlimit module"
508 depends on NF_CONNTRACK
509 depends on NETFILTER_ADVANCED
510 select NETFILTER_CONNCOUNT
512 This option adds the "connlimit" expression that you can use to
513 ratelimit rule matchings per connections.
516 tristate "Netfilter nf_tables log module"
518 This option adds the "log" expression that you can use to log
519 packets matching some criteria.
522 tristate "Netfilter nf_tables limit module"
524 This option adds the "limit" expression that you can use to
525 ratelimit rule matchings.
528 depends on NF_CONNTRACK
530 select NF_NAT_MASQUERADE
531 tristate "Netfilter nf_tables masquerade support"
533 This option adds the "masquerade" expression that you can use
534 to perform NAT in the masquerade flavour.
537 depends on NF_CONNTRACK
539 tristate "Netfilter nf_tables redirect support"
540 select NF_NAT_REDIRECT
542 This options adds the "redirect" expression that you can use
543 to perform NAT in the redirect flavour.
546 depends on NF_CONNTRACK
548 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
549 tristate "Netfilter nf_tables nat module"
551 This option adds the "nat" expression that you can use to perform
552 typical Network Address Translation (NAT) packet transformations.
555 tristate "Netfilter nf_tables tunnel module"
557 This option adds the "tunnel" expression that you can use to set
561 tristate "Netfilter nf_tables stateful object reference module"
563 This option adds the "objref" expression that allows you to refer to
564 stateful objects, such as counters and quotas.
567 depends on NETFILTER_NETLINK_QUEUE
568 tristate "Netfilter nf_tables queue module"
570 This is required if you intend to use the userspace queueing
571 infrastructure (also known as NFQUEUE) from nftables.
574 tristate "Netfilter nf_tables quota module"
576 This option adds the "quota" expression that you can use to match
577 enforce bytes quotas.
580 default m if NETFILTER_ADVANCED=n
581 tristate "Netfilter nf_tables reject support"
582 depends on !NF_TABLES_INET || (IPV6!=m || m)
584 This option adds the "reject" expression that you can use to
585 explicitly deny and notify via TCP reset/ICMP informational errors
588 config NFT_REJECT_INET
589 depends on NF_TABLES_INET
594 depends on NETFILTER_XTABLES
595 tristate "Netfilter x_tables over nf_tables module"
597 This is required if you intend to use any of existing
598 x_tables match/target extensions over the nf_tables
602 tristate "Netfilter nf_tables hash module"
604 This option adds the "hash" expression that you can use to perform
605 a hash operation on registers.
611 depends on NF_TABLES_INET
612 depends on NFT_FIB_IPV4
613 depends on NFT_FIB_IPV6
614 tristate "Netfilter nf_tables fib inet support"
616 This option allows using the FIB expression from the inet table.
617 The lookup will be delegated to the IPv4 or IPv6 FIB depending
618 on the protocol of the packet.
621 tristate "Netfilter nf_tables xfrm/IPSec security association matching"
624 This option adds an expression that you can use to extract properties
625 of a packets security association.
628 tristate "Netfilter nf_tables socket match support"
629 depends on IPV6 || IPV6=n
630 select NF_SOCKET_IPV4
631 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
633 This option allows matching for the presence or absence of a
634 corresponding socket and its attributes.
637 tristate "Netfilter nf_tables passive OS fingerprint support"
638 depends on NETFILTER_ADVANCED
639 select NETFILTER_NETLINK_OSF
641 This option allows matching packets from an specific OS.
644 tristate "Netfilter nf_tables tproxy support"
645 depends on IPV6 || IPV6=n
646 select NF_DEFRAG_IPV4
647 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
648 select NF_TPROXY_IPV4
649 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
651 This makes transparent proxy support available in nftables.
656 tristate "Netfilter packet duplication support"
658 This option enables the generic packet duplication infrastructure
661 config NFT_DUP_NETDEV
662 tristate "Netfilter nf_tables netdev packet duplication support"
665 This option enables packet duplication for the "netdev" family.
667 config NFT_FWD_NETDEV
668 tristate "Netfilter nf_tables netdev packet forwarding support"
671 This option enables packet forwarding for the "netdev" family.
673 config NFT_FIB_NETDEV
674 depends on NFT_FIB_IPV4
675 depends on NFT_FIB_IPV6
676 tristate "Netfilter nf_tables netdev fib lookups support"
678 This option allows using the FIB expression from the netdev table.
679 The lookup will be delegated to the IPv4 or IPv6 FIB depending
680 on the protocol of the packet.
682 endif # NF_TABLES_NETDEV
686 config NF_FLOW_TABLE_INET
687 tristate "Netfilter flow table mixed IPv4/IPv6 module"
688 depends on NF_FLOW_TABLE
690 This option adds the flow table mixed IPv4/IPv6 support.
692 To compile it as a module, choose M here.
695 tristate "Netfilter flow table module"
696 depends on NETFILTER_INGRESS
697 depends on NF_CONNTRACK
700 This option adds the flow table core infrastructure.
702 To compile it as a module, choose M here.
704 config NETFILTER_XTABLES
705 tristate "Netfilter Xtables support (required for ip_tables)"
706 default m if NETFILTER_ADVANCED=n
708 This is required if you intend to use any of ip_tables,
709 ip6_tables or arp_tables.
713 comment "Xtables combined modules"
715 config NETFILTER_XT_MARK
716 tristate 'nfmark target and match support'
717 default m if NETFILTER_ADVANCED=n
719 This option adds the "MARK" target and "mark" match.
721 Netfilter mark matching allows you to match packets based on the
722 "nfmark" value in the packet.
723 The target allows you to create rules in the "mangle" table which alter
724 the netfilter mark (nfmark) field associated with the packet.
726 Prior to routing, the nfmark can influence the routing method and can
727 also be used by other subsystems to change their behavior.
729 config NETFILTER_XT_CONNMARK
730 tristate 'ctmark target and match support'
731 depends on NF_CONNTRACK
732 depends on NETFILTER_ADVANCED
733 select NF_CONNTRACK_MARK
735 This option adds the "CONNMARK" target and "connmark" match.
737 Netfilter allows you to store a mark value per connection (a.k.a.
738 ctmark), similarly to the packet mark (nfmark). Using this
739 target and match, you can set and match on this mark.
741 config NETFILTER_XT_SET
742 tristate 'set target and match support'
744 depends on NETFILTER_ADVANCED
746 This option adds the "SET" target and "set" match.
748 Using this target and match, you can add/delete and match
749 elements in the sets created by ipset(8).
751 To compile it as a module, choose M here. If unsure, say N.
753 # alphabetically ordered list of targets
755 comment "Xtables targets"
757 config NETFILTER_XT_TARGET_AUDIT
758 tristate "AUDIT target support"
760 depends on NETFILTER_ADVANCED
762 This option adds a 'AUDIT' target, which can be used to create
763 audit records for packets dropped/accepted.
765 To compileit as a module, choose M here. If unsure, say N.
767 config NETFILTER_XT_TARGET_CHECKSUM
768 tristate "CHECKSUM target support"
769 depends on IP_NF_MANGLE || IP6_NF_MANGLE
770 depends on NETFILTER_ADVANCED
772 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
773 table to work around buggy DHCP clients in virtualized environments.
775 Some old DHCP clients drop packets because they are not aware
776 that the checksum would normally be offloaded to hardware and
777 thus should be considered valid.
778 This target can be used to fill in the checksum using iptables
779 when such packets are sent via a virtual network device.
781 To compile it as a module, choose M here. If unsure, say N.
783 config NETFILTER_XT_TARGET_CLASSIFY
784 tristate '"CLASSIFY" target support'
785 depends on NETFILTER_ADVANCED
787 This option adds a `CLASSIFY' target, which enables the user to set
788 the priority of a packet. Some qdiscs can use this value for
789 classification, among these are:
791 atm, cbq, dsmark, pfifo_fast, htb, prio
793 To compile it as a module, choose M here. If unsure, say N.
795 config NETFILTER_XT_TARGET_CONNMARK
796 tristate '"CONNMARK" target support'
797 depends on NF_CONNTRACK
798 depends on NETFILTER_ADVANCED
799 select NETFILTER_XT_CONNMARK
801 This is a backwards-compat option for the user's convenience
802 (e.g. when running oldconfig). It selects
803 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
805 config NETFILTER_XT_TARGET_CONNSECMARK
806 tristate '"CONNSECMARK" target support'
807 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
808 default m if NETFILTER_ADVANCED=n
810 The CONNSECMARK target copies security markings from packets
811 to connections, and restores security markings from connections
812 to packets (if the packets are not already marked). This would
813 normally be used in conjunction with the SECMARK target.
815 To compile it as a module, choose M here. If unsure, say N.
817 config NETFILTER_XT_TARGET_CT
818 tristate '"CT" target support'
819 depends on NF_CONNTRACK
820 depends on IP_NF_RAW || IP6_NF_RAW
821 depends on NETFILTER_ADVANCED
823 This options adds a `CT' target, which allows to specify initial
824 connection tracking parameters like events to be delivered and
825 the helper to be used.
827 To compile it as a module, choose M here. If unsure, say N.
829 config NETFILTER_XT_TARGET_DSCP
830 tristate '"DSCP" and "TOS" target support'
831 depends on IP_NF_MANGLE || IP6_NF_MANGLE
832 depends on NETFILTER_ADVANCED
834 This option adds a `DSCP' target, which allows you to manipulate
835 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
837 The DSCP field can have any value between 0x0 and 0x3f inclusive.
839 It also adds the "TOS" target, which allows you to create rules in
840 the "mangle" table which alter the Type Of Service field of an IPv4
841 or the Priority field of an IPv6 packet, prior to routing.
843 To compile it as a module, choose M here. If unsure, say N.
845 config NETFILTER_XT_TARGET_HL
846 tristate '"HL" hoplimit target support'
847 depends on IP_NF_MANGLE || IP6_NF_MANGLE
848 depends on NETFILTER_ADVANCED
850 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
851 targets, which enable the user to change the
852 hoplimit/time-to-live value of the IP header.
854 While it is safe to decrement the hoplimit/TTL value, the
855 modules also allow to increment and set the hoplimit value of
856 the header to arbitrary values. This is EXTREMELY DANGEROUS
857 since you can easily create immortal packets that loop
858 forever on the network.
860 config NETFILTER_XT_TARGET_HMARK
861 tristate '"HMARK" target support'
862 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
863 depends on NETFILTER_ADVANCED
865 This option adds the "HMARK" target.
867 The target allows you to create rules in the "raw" and "mangle" tables
868 which set the skbuff mark by means of hash calculation within a given
869 range. The nfmark can influence the routing method and can also be used
870 by other subsystems to change their behaviour.
872 To compile it as a module, choose M here. If unsure, say N.
874 config NETFILTER_XT_TARGET_IDLETIMER
875 tristate "IDLETIMER target support"
876 depends on NETFILTER_ADVANCED
879 This option adds the `IDLETIMER' target. Each matching packet
880 resets the timer associated with label specified when the rule is
881 added. When the timer expires, it triggers a sysfs notification.
882 The remaining time for expiration can be read via sysfs.
884 To compile it as a module, choose M here. If unsure, say N.
886 config NETFILTER_XT_TARGET_LED
887 tristate '"LED" target support'
888 depends on LEDS_CLASS && LEDS_TRIGGERS
889 depends on NETFILTER_ADVANCED
891 This option adds a `LED' target, which allows you to blink LEDs in
892 response to particular packets passing through your machine.
894 This can be used to turn a spare LED into a network activity LED,
895 which only flashes in response to FTP transfers, for example. Or
896 you could have an LED which lights up for a minute or two every time
897 somebody connects to your machine via SSH.
899 You will need support for the "led" class to make this work.
901 To create an LED trigger for incoming SSH traffic:
902 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
904 Then attach the new trigger to an LED on your system:
905 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
907 For more information on the LEDs available on your system, see
908 Documentation/leds/leds-class.txt
910 config NETFILTER_XT_TARGET_LOG
911 tristate "LOG target support"
914 select NF_LOG_IPV6 if IP6_NF_IPTABLES
915 default m if NETFILTER_ADVANCED=n
917 This option adds a `LOG' target, which allows you to create rules in
918 any iptables table which records the packet header to the syslog.
920 To compile it as a module, choose M here. If unsure, say N.
922 config NETFILTER_XT_TARGET_MARK
923 tristate '"MARK" target support'
924 depends on NETFILTER_ADVANCED
925 select NETFILTER_XT_MARK
927 This is a backwards-compat option for the user's convenience
928 (e.g. when running oldconfig). It selects
929 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
931 config NETFILTER_XT_NAT
932 tristate '"SNAT and DNAT" targets support'
935 This option enables the SNAT and DNAT targets.
937 To compile it as a module, choose M here. If unsure, say N.
939 config NETFILTER_XT_TARGET_NETMAP
940 tristate '"NETMAP" target support'
943 NETMAP is an implementation of static 1:1 NAT mapping of network
944 addresses. It maps the network address part, while keeping the host
947 To compile it as a module, choose M here. If unsure, say N.
949 config NETFILTER_XT_TARGET_NFLOG
950 tristate '"NFLOG" target support'
951 default m if NETFILTER_ADVANCED=n
952 select NETFILTER_NETLINK_LOG
954 This option enables the NFLOG target, which allows to LOG
955 messages through nfnetlink_log.
957 To compile it as a module, choose M here. If unsure, say N.
959 config NETFILTER_XT_TARGET_NFQUEUE
960 tristate '"NFQUEUE" target Support'
961 depends on NETFILTER_ADVANCED
962 select NETFILTER_NETLINK_QUEUE
964 This target replaced the old obsolete QUEUE target.
966 As opposed to QUEUE, it supports 65535 different queues,
969 To compile it as a module, choose M here. If unsure, say N.
971 config NETFILTER_XT_TARGET_NOTRACK
972 tristate '"NOTRACK" target support (DEPRECATED)'
973 depends on NF_CONNTRACK
974 depends on IP_NF_RAW || IP6_NF_RAW
975 depends on NETFILTER_ADVANCED
976 select NETFILTER_XT_TARGET_CT
978 config NETFILTER_XT_TARGET_RATEEST
979 tristate '"RATEEST" target support'
980 depends on NETFILTER_ADVANCED
982 This option adds a `RATEEST' target, which allows to measure
983 rates similar to TC estimators. The `rateest' match can be
984 used to match on the measured rates.
986 To compile it as a module, choose M here. If unsure, say N.
988 config NETFILTER_XT_TARGET_REDIRECT
989 tristate "REDIRECT target support"
991 select NF_NAT_REDIRECT
993 REDIRECT is a special case of NAT: all incoming connections are
994 mapped onto the incoming interface's address, causing the packets to
995 come to the local machine instead of passing through. This is
996 useful for transparent proxies.
998 To compile it as a module, choose M here. If unsure, say N.
1000 config NETFILTER_XT_TARGET_MASQUERADE
1001 tristate "MASQUERADE target support"
1003 default m if NETFILTER_ADVANCED=n
1004 select NF_NAT_MASQUERADE
1006 Masquerading is a special case of NAT: all outgoing connections are
1007 changed to seem to come from a particular interface's address, and
1008 if the interface goes down, those connections are lost. This is
1009 only useful for dialup accounts with dynamic IP address (ie. your IP
1010 address will be different on next dialup).
1012 To compile it as a module, choose M here. If unsure, say N.
1014 config NETFILTER_XT_TARGET_TEE
1015 tristate '"TEE" - packet cloning to alternate destination'
1016 depends on NETFILTER_ADVANCED
1017 depends on IPV6 || IPV6=n
1018 depends on !NF_CONNTRACK || NF_CONNTRACK
1019 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1021 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1023 This option adds a "TEE" target with which a packet can be cloned and
1024 this clone be rerouted to another nexthop.
1026 config NETFILTER_XT_TARGET_TPROXY
1027 tristate '"TPROXY" target transparent proxying support'
1028 depends on NETFILTER_XTABLES
1029 depends on NETFILTER_ADVANCED
1030 depends on IPV6 || IPV6=n
1031 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1032 depends on IP_NF_MANGLE
1033 select NF_DEFRAG_IPV4
1034 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1035 select NF_TPROXY_IPV4
1036 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1038 This option adds a `TPROXY' target, which is somewhat similar to
1039 REDIRECT. It can only be used in the mangle table and is useful
1040 to redirect traffic to a transparent proxy. It does _not_ depend
1041 on Netfilter connection tracking and NAT, unlike REDIRECT.
1042 For it to work you will have to configure certain iptables rules
1043 and use policy routing. For more information on how to set it up
1044 see Documentation/networking/tproxy.txt.
1046 To compile it as a module, choose M here. If unsure, say N.
1048 config NETFILTER_XT_TARGET_TRACE
1049 tristate '"TRACE" target support'
1050 depends on IP_NF_RAW || IP6_NF_RAW
1051 depends on NETFILTER_ADVANCED
1053 The TRACE target allows you to mark packets so that the kernel
1054 will log every rule which match the packets as those traverse
1055 the tables, chains, rules.
1057 If you want to compile it as a module, say M here and read
1058 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1060 config NETFILTER_XT_TARGET_SECMARK
1061 tristate '"SECMARK" target support'
1062 depends on NETWORK_SECMARK
1063 default m if NETFILTER_ADVANCED=n
1065 The SECMARK target allows security marking of network
1066 packets, for use with security subsystems.
1068 To compile it as a module, choose M here. If unsure, say N.
1070 config NETFILTER_XT_TARGET_TCPMSS
1071 tristate '"TCPMSS" target support'
1072 depends on IPV6 || IPV6=n
1073 default m if NETFILTER_ADVANCED=n
1075 This option adds a `TCPMSS' target, which allows you to alter the
1076 MSS value of TCP SYN packets, to control the maximum size for that
1077 connection (usually limiting it to your outgoing interface's MTU
1080 This is used to overcome criminally braindead ISPs or servers which
1081 block ICMP Fragmentation Needed packets. The symptoms of this
1082 problem are that everything works fine from your Linux
1083 firewall/router, but machines behind it can never exchange large
1085 1) Web browsers connect, then hang with no data received.
1086 2) Small mail works fine, but large emails hang.
1087 3) ssh works fine, but scp hangs after initial handshaking.
1089 Workaround: activate this option and add a rule to your firewall
1092 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1093 -j TCPMSS --clamp-mss-to-pmtu
1095 To compile it as a module, choose M here. If unsure, say N.
1097 config NETFILTER_XT_TARGET_TCPOPTSTRIP
1098 tristate '"TCPOPTSTRIP" target support'
1099 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1100 depends on NETFILTER_ADVANCED
1102 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1103 TCP options from TCP packets.
1105 # alphabetically ordered list of matches
1107 comment "Xtables matches"
1109 config NETFILTER_XT_MATCH_ADDRTYPE
1110 tristate '"addrtype" address type match support'
1111 default m if NETFILTER_ADVANCED=n
1113 This option allows you to match what routing thinks of an address,
1114 eg. UNICAST, LOCAL, BROADCAST, ...
1116 If you want to compile it as a module, say M here and read
1117 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1119 config NETFILTER_XT_MATCH_BPF
1120 tristate '"bpf" match support'
1121 depends on NETFILTER_ADVANCED
1123 BPF matching applies a linux socket filter to each packet and
1124 accepts those for which the filter returns non-zero.
1126 To compile it as a module, choose M here. If unsure, say N.
1128 config NETFILTER_XT_MATCH_CGROUP
1129 tristate '"control group" match support'
1130 depends on NETFILTER_ADVANCED
1132 select CGROUP_NET_CLASSID
1134 Socket/process control group matching allows you to match locally
1135 generated packets based on which net_cls control group processes
1138 config NETFILTER_XT_MATCH_CLUSTER
1139 tristate '"cluster" match support'
1140 depends on NF_CONNTRACK
1141 depends on NETFILTER_ADVANCED
1143 This option allows you to build work-load-sharing clusters of
1144 network servers/stateful firewalls without having a dedicated
1145 load-balancing router/server/switch. Basically, this match returns
1146 true when the packet must be handled by this cluster node. Thus,
1147 all nodes see all packets and this match decides which node handles
1148 what packets. The work-load sharing algorithm is based on source
1151 If you say Y or M here, try `iptables -m cluster --help` for
1154 config NETFILTER_XT_MATCH_COMMENT
1155 tristate '"comment" match support'
1156 depends on NETFILTER_ADVANCED
1158 This option adds a `comment' dummy-match, which allows you to put
1159 comments in your iptables ruleset.
1161 If you want to compile it as a module, say M here and read
1162 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1164 config NETFILTER_XT_MATCH_CONNBYTES
1165 tristate '"connbytes" per-connection counter match support'
1166 depends on NF_CONNTRACK
1167 depends on NETFILTER_ADVANCED
1169 This option adds a `connbytes' match, which allows you to match the
1170 number of bytes and/or packets for each direction within a connection.
1172 If you want to compile it as a module, say M here and read
1173 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1175 config NETFILTER_XT_MATCH_CONNLABEL
1176 tristate '"connlabel" match support'
1177 select NF_CONNTRACK_LABELS
1178 depends on NF_CONNTRACK
1179 depends on NETFILTER_ADVANCED
1181 This match allows you to test and assign userspace-defined labels names
1182 to a connection. The kernel only stores bit values - mapping
1183 names to bits is done by userspace.
1185 Unlike connmark, more than 32 flag bits may be assigned to a
1186 connection simultaneously.
1188 config NETFILTER_XT_MATCH_CONNLIMIT
1189 tristate '"connlimit" match support'
1190 depends on NF_CONNTRACK
1191 depends on NETFILTER_ADVANCED
1192 select NETFILTER_CONNCOUNT
1194 This match allows you to match against the number of parallel
1195 connections to a server per client IP address (or address block).
1197 config NETFILTER_XT_MATCH_CONNMARK
1198 tristate '"connmark" connection mark match support'
1199 depends on NF_CONNTRACK
1200 depends on NETFILTER_ADVANCED
1201 select NETFILTER_XT_CONNMARK
1203 This is a backwards-compat option for the user's convenience
1204 (e.g. when running oldconfig). It selects
1205 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1207 config NETFILTER_XT_MATCH_CONNTRACK
1208 tristate '"conntrack" connection tracking match support'
1209 depends on NF_CONNTRACK
1210 default m if NETFILTER_ADVANCED=n
1212 This is a general conntrack match module, a superset of the state match.
1214 It allows matching on additional conntrack information, which is
1215 useful in complex configurations, such as NAT gateways with multiple
1216 internet links or tunnels.
1218 To compile it as a module, choose M here. If unsure, say N.
1220 config NETFILTER_XT_MATCH_CPU
1221 tristate '"cpu" match support'
1222 depends on NETFILTER_ADVANCED
1224 CPU matching allows you to match packets based on the CPU
1225 currently handling the packet.
1227 To compile it as a module, choose M here. If unsure, say N.
1229 config NETFILTER_XT_MATCH_DCCP
1230 tristate '"dccp" protocol match support'
1231 depends on NETFILTER_ADVANCED
1234 With this option enabled, you will be able to use the iptables
1235 `dccp' match in order to match on DCCP source/destination ports
1238 If you want to compile it as a module, say M here and read
1239 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1241 config NETFILTER_XT_MATCH_DEVGROUP
1242 tristate '"devgroup" match support'
1243 depends on NETFILTER_ADVANCED
1245 This options adds a `devgroup' match, which allows to match on the
1246 device group a network device is assigned to.
1248 To compile it as a module, choose M here. If unsure, say N.
1250 config NETFILTER_XT_MATCH_DSCP
1251 tristate '"dscp" and "tos" match support'
1252 depends on NETFILTER_ADVANCED
1254 This option adds a `DSCP' match, which allows you to match against
1255 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1257 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1259 It will also add a "tos" match, which allows you to match packets
1260 based on the Type Of Service fields of the IPv4 packet (which share
1261 the same bits as DSCP).
1263 To compile it as a module, choose M here. If unsure, say N.
1265 config NETFILTER_XT_MATCH_ECN
1266 tristate '"ecn" match support'
1267 depends on NETFILTER_ADVANCED
1269 This option adds an "ECN" match, which allows you to match against
1270 the IPv4 and TCP header ECN fields.
1272 To compile it as a module, choose M here. If unsure, say N.
1274 config NETFILTER_XT_MATCH_ESP
1275 tristate '"esp" match support'
1276 depends on NETFILTER_ADVANCED
1278 This match extension allows you to match a range of SPIs
1279 inside ESP header of IPSec packets.
1281 To compile it as a module, choose M here. If unsure, say N.
1283 config NETFILTER_XT_MATCH_HASHLIMIT
1284 tristate '"hashlimit" match support'
1285 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1286 depends on NETFILTER_ADVANCED
1288 This option adds a `hashlimit' match.
1290 As opposed to `limit', this match dynamically creates a hash table
1291 of limit buckets, based on your selection of source/destination
1292 addresses and/or ports.
1294 It enables you to express policies like `10kpps for any given
1295 destination address' or `500pps from any given source address'
1298 config NETFILTER_XT_MATCH_HELPER
1299 tristate '"helper" match support'
1300 depends on NF_CONNTRACK
1301 depends on NETFILTER_ADVANCED
1303 Helper matching allows you to match packets in dynamic connections
1304 tracked by a conntrack-helper, ie. ip_conntrack_ftp
1306 To compile it as a module, choose M here. If unsure, say Y.
1308 config NETFILTER_XT_MATCH_HL
1309 tristate '"hl" hoplimit/TTL match support'
1310 depends on NETFILTER_ADVANCED
1312 HL matching allows you to match packets based on the hoplimit
1313 in the IPv6 header, or the time-to-live field in the IPv4
1314 header of the packet.
1316 config NETFILTER_XT_MATCH_IPCOMP
1317 tristate '"ipcomp" match support'
1318 depends on NETFILTER_ADVANCED
1320 This match extension allows you to match a range of CPIs(16 bits)
1321 inside IPComp header of IPSec packets.
1323 To compile it as a module, choose M here. If unsure, say N.
1325 config NETFILTER_XT_MATCH_IPRANGE
1326 tristate '"iprange" address range match support'
1327 depends on NETFILTER_ADVANCED
1329 This option adds a "iprange" match, which allows you to match based on
1330 an IP address range. (Normal iptables only matches on single addresses
1331 with an optional mask.)
1335 config NETFILTER_XT_MATCH_IPVS
1336 tristate '"ipvs" match support'
1338 depends on NETFILTER_ADVANCED
1339 depends on NF_CONNTRACK
1341 This option allows you to match against IPVS properties of a packet.
1345 config NETFILTER_XT_MATCH_L2TP
1346 tristate '"l2tp" match support'
1347 depends on NETFILTER_ADVANCED
1350 This option adds an "L2TP" match, which allows you to match against
1351 L2TP protocol header fields.
1353 To compile it as a module, choose M here. If unsure, say N.
1355 config NETFILTER_XT_MATCH_LENGTH
1356 tristate '"length" match support'
1357 depends on NETFILTER_ADVANCED
1359 This option allows you to match the length of a packet against a
1360 specific value or range of values.
1362 To compile it as a module, choose M here. If unsure, say N.
1364 config NETFILTER_XT_MATCH_LIMIT
1365 tristate '"limit" match support'
1366 depends on NETFILTER_ADVANCED
1368 limit matching allows you to control the rate at which a rule can be
1369 matched: mainly useful in combination with the LOG target ("LOG
1370 target support", below) and to avoid some Denial of Service attacks.
1372 To compile it as a module, choose M here. If unsure, say N.
1374 config NETFILTER_XT_MATCH_MAC
1375 tristate '"mac" address match support'
1376 depends on NETFILTER_ADVANCED
1378 MAC matching allows you to match packets based on the source
1379 Ethernet address of the packet.
1381 To compile it as a module, choose M here. If unsure, say N.
1383 config NETFILTER_XT_MATCH_MARK
1384 tristate '"mark" match support'
1385 depends on NETFILTER_ADVANCED
1386 select NETFILTER_XT_MARK
1388 This is a backwards-compat option for the user's convenience
1389 (e.g. when running oldconfig). It selects
1390 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1392 config NETFILTER_XT_MATCH_MULTIPORT
1393 tristate '"multiport" Multiple port match support'
1394 depends on NETFILTER_ADVANCED
1396 Multiport matching allows you to match TCP or UDP packets based on
1397 a series of source or destination ports: normally a rule can only
1398 match a single range of ports.
1400 To compile it as a module, choose M here. If unsure, say N.
1402 config NETFILTER_XT_MATCH_NFACCT
1403 tristate '"nfacct" match support'
1404 depends on NETFILTER_ADVANCED
1405 select NETFILTER_NETLINK_ACCT
1407 This option allows you to use the extended accounting through
1410 To compile it as a module, choose M here. If unsure, say N.
1412 config NETFILTER_XT_MATCH_OSF
1413 tristate '"osf" Passive OS fingerprint match'
1414 depends on NETFILTER_ADVANCED
1415 select NETFILTER_NETLINK_OSF
1417 This option selects the Passive OS Fingerprinting match module
1418 that allows to passively match the remote operating system by
1419 analyzing incoming TCP SYN packets.
1421 Rules and loading software can be downloaded from
1422 http://www.ioremap.net/projects/osf
1424 To compile it as a module, choose M here. If unsure, say N.
1426 config NETFILTER_XT_MATCH_OWNER
1427 tristate '"owner" match support'
1428 depends on NETFILTER_ADVANCED
1430 Socket owner matching allows you to match locally-generated packets
1431 based on who created the socket: the user or group. It is also
1432 possible to check whether a socket actually exists.
1434 config NETFILTER_XT_MATCH_POLICY
1435 tristate 'IPsec "policy" match support'
1437 default m if NETFILTER_ADVANCED=n
1439 Policy matching allows you to match packets based on the
1440 IPsec policy that was used during decapsulation/will
1441 be used during encapsulation.
1443 To compile it as a module, choose M here. If unsure, say N.
1445 config NETFILTER_XT_MATCH_PHYSDEV
1446 tristate '"physdev" match support'
1447 depends on BRIDGE && BRIDGE_NETFILTER
1448 depends on NETFILTER_ADVANCED
1450 Physdev packet matching matches against the physical bridge ports
1451 the IP packet arrived on or will leave by.
1453 To compile it as a module, choose M here. If unsure, say N.
1455 config NETFILTER_XT_MATCH_PKTTYPE
1456 tristate '"pkttype" packet type match support'
1457 depends on NETFILTER_ADVANCED
1459 Packet type matching allows you to match a packet by
1460 its "class", eg. BROADCAST, MULTICAST, ...
1463 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1465 To compile it as a module, choose M here. If unsure, say N.
1467 config NETFILTER_XT_MATCH_QUOTA
1468 tristate '"quota" match support'
1469 depends on NETFILTER_ADVANCED
1471 This option adds a `quota' match, which allows to match on a
1474 If you want to compile it as a module, say M here and read
1475 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1477 config NETFILTER_XT_MATCH_RATEEST
1478 tristate '"rateest" match support'
1479 depends on NETFILTER_ADVANCED
1480 select NETFILTER_XT_TARGET_RATEEST
1482 This option adds a `rateest' match, which allows to match on the
1483 rate estimated by the RATEEST target.
1485 To compile it as a module, choose M here. If unsure, say N.
1487 config NETFILTER_XT_MATCH_REALM
1488 tristate '"realm" match support'
1489 depends on NETFILTER_ADVANCED
1490 select IP_ROUTE_CLASSID
1492 This option adds a `realm' match, which allows you to use the realm
1493 key from the routing subsystem inside iptables.
1495 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1498 If you want to compile it as a module, say M here and read
1499 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1501 config NETFILTER_XT_MATCH_RECENT
1502 tristate '"recent" match support'
1503 depends on NETFILTER_ADVANCED
1505 This match is used for creating one or many lists of recently
1506 used addresses and then matching against that/those list(s).
1508 Short options are available by using 'iptables -m recent -h'
1509 Official Website: <http://snowman.net/projects/ipt_recent/>
1511 config NETFILTER_XT_MATCH_SCTP
1512 tristate '"sctp" protocol match support'
1513 depends on NETFILTER_ADVANCED
1516 With this option enabled, you will be able to use the
1517 `sctp' match in order to match on SCTP source/destination ports
1518 and SCTP chunk types.
1520 If you want to compile it as a module, say M here and read
1521 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1523 config NETFILTER_XT_MATCH_SOCKET
1524 tristate '"socket" match support'
1525 depends on NETFILTER_XTABLES
1526 depends on NETFILTER_ADVANCED
1527 depends on IPV6 || IPV6=n
1528 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1529 select NF_SOCKET_IPV4
1530 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1531 select NF_DEFRAG_IPV4
1532 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1534 This option adds a `socket' match, which can be used to match
1535 packets for which a TCP or UDP socket lookup finds a valid socket.
1536 It can be used in combination with the MARK target and policy
1537 routing to implement full featured non-locally bound sockets.
1539 To compile it as a module, choose M here. If unsure, say N.
1541 config NETFILTER_XT_MATCH_STATE
1542 tristate '"state" match support'
1543 depends on NF_CONNTRACK
1544 default m if NETFILTER_ADVANCED=n
1546 Connection state matching allows you to match packets based on their
1547 relationship to a tracked connection (ie. previous packets). This
1548 is a powerful tool for packet classification.
1550 To compile it as a module, choose M here. If unsure, say N.
1552 config NETFILTER_XT_MATCH_STATISTIC
1553 tristate '"statistic" match support'
1554 depends on NETFILTER_ADVANCED
1556 This option adds a `statistic' match, which allows you to match
1557 on packets periodically or randomly with a given percentage.
1559 To compile it as a module, choose M here. If unsure, say N.
1561 config NETFILTER_XT_MATCH_STRING
1562 tristate '"string" match support'
1563 depends on NETFILTER_ADVANCED
1565 select TEXTSEARCH_KMP
1566 select TEXTSEARCH_BM
1567 select TEXTSEARCH_FSM
1569 This option adds a `string' match, which allows you to look for
1570 pattern matchings in packets.
1572 To compile it as a module, choose M here. If unsure, say N.
1574 config NETFILTER_XT_MATCH_TCPMSS
1575 tristate '"tcpmss" match support'
1576 depends on NETFILTER_ADVANCED
1578 This option adds a `tcpmss' match, which allows you to examine the
1579 MSS value of TCP SYN packets, which control the maximum packet size
1580 for that connection.
1582 To compile it as a module, choose M here. If unsure, say N.
1584 config NETFILTER_XT_MATCH_TIME
1585 tristate '"time" match support'
1586 depends on NETFILTER_ADVANCED
1588 This option adds a "time" match, which allows you to match based on
1589 the packet arrival time (at the machine which netfilter is running)
1590 on) or departure time/date (for locally generated packets).
1592 If you say Y here, try `iptables -m time --help` for
1595 If you want to compile it as a module, say M here.
1598 config NETFILTER_XT_MATCH_U32
1599 tristate '"u32" match support'
1600 depends on NETFILTER_ADVANCED
1602 u32 allows you to extract quantities of up to 4 bytes from a packet,
1603 AND them with specified masks, shift them by specified amounts and
1604 test whether the results are in any of a set of specified ranges.
1605 The specification of what to extract is general enough to skip over
1606 headers with lengths stored in the packet, as in IP or TCP header
1609 Details and examples are in the kernel module source.
1611 endif # NETFILTER_XTABLES
1615 source "net/netfilter/ipset/Kconfig"
1617 source "net/netfilter/ipvs/Kconfig"