1 menu "Core Netfilter Configuration"
2 depends on NET && INET && NETFILTER
4 config NETFILTER_INGRESS
5 bool "Netfilter ingress support"
9 This allows you to classify packets from ingress using the Netfilter
12 config NETFILTER_NETLINK
15 config NETFILTER_FAMILY_BRIDGE
18 config NETFILTER_FAMILY_ARP
21 config NETFILTER_NETLINK_ACCT
22 tristate "Netfilter NFACCT over NFNETLINK interface"
23 depends on NETFILTER_ADVANCED
24 select NETFILTER_NETLINK
26 If this option is enabled, the kernel will include support
27 for extended accounting via NFNETLINK.
29 config NETFILTER_NETLINK_QUEUE
30 tristate "Netfilter NFQUEUE over NFNETLINK interface"
31 depends on NETFILTER_ADVANCED
32 select NETFILTER_NETLINK
34 If this option is enabled, the kernel will include support
35 for queueing packets via NFNETLINK.
37 config NETFILTER_NETLINK_LOG
38 tristate "Netfilter LOG over NFNETLINK interface"
39 default m if NETFILTER_ADVANCED=n
40 select NETFILTER_NETLINK
42 If this option is enabled, the kernel will include support
43 for logging packets via NFNETLINK.
45 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
46 and is also scheduled to replace the old syslog-based ipt_LOG
49 config NETFILTER_NETLINK_OSF
50 tristate "Netfilter OSF over NFNETLINK interface"
51 depends on NETFILTER_ADVANCED
52 select NETFILTER_NETLINK
54 If this option is enabled, the kernel will include support
55 for passive OS fingerprint via NFNETLINK.
58 tristate "Netfilter connection tracking support"
59 default m if NETFILTER_ADVANCED=n
61 select NF_DEFRAG_IPV6 if IPV6 != n
63 Connection tracking keeps a record of what packets have passed
64 through your machine, in order to figure out how they are related
67 This is required to do Masquerading or other kinds of Network
68 Address Translation. It can also be used to enhance packet
69 filtering (see `Connection state match support' below).
71 To compile it as a module, choose M here. If unsure, say N.
77 tristate "Netdev packet logging"
81 config NETFILTER_CONNCOUNT
84 config NF_CONNTRACK_MARK
85 bool 'Connection mark tracking support'
86 depends on NETFILTER_ADVANCED
88 This option enables support for connection marks, used by the
89 `CONNMARK' target and `connmark' match. Similar to the mark value
90 of packets, but this mark value is kept in the conntrack session
91 instead of the individual packets.
93 config NF_CONNTRACK_SECMARK
94 bool 'Connection tracking security mark support'
95 depends on NETWORK_SECMARK
96 default m if NETFILTER_ADVANCED=n
98 This option enables security markings to be applied to
99 connections. Typically they are copied to connections from
100 packets using the CONNSECMARK target and copied back from
101 connections to packets with the same target, with the packets
102 being originally labeled via SECMARK.
106 config NF_CONNTRACK_ZONES
107 bool 'Connection tracking zones'
108 depends on NETFILTER_ADVANCED
110 This option enables support for connection tracking zones.
111 Normally, each connection needs to have a unique system wide
112 identity. Connection tracking zones allow to have multiple
113 connections using the same identity, as long as they are
114 contained in different zones.
118 config NF_CONNTRACK_PROCFS
119 bool "Supply CT list in procfs (OBSOLETE)"
123 This option enables for the list of known conntrack entries
124 to be shown in procfs under net/netfilter/nf_conntrack. This
125 is considered obsolete in favor of using the conntrack(8)
126 tool which uses Netlink.
128 config NF_CONNTRACK_EVENTS
129 bool "Connection tracking events"
130 depends on NETFILTER_ADVANCED
132 If this option is enabled, the connection tracking code will
133 provide a notifier chain that can be used by other kernel code
134 to get notified about changes in the connection tracking state.
138 config NF_CONNTRACK_TIMEOUT
139 bool 'Connection tracking timeout'
140 depends on NETFILTER_ADVANCED
142 This option enables support for connection tracking timeout
143 extension. This allows you to attach timeout policies to flow
148 config NF_CONNTRACK_TIMESTAMP
149 bool 'Connection tracking timestamping'
150 depends on NETFILTER_ADVANCED
152 This option enables support for connection tracking timestamping.
153 This allows you to store the flow start-time and to obtain
154 the flow-stop time (once it has been destroyed) via Connection
159 config NF_CONNTRACK_LABELS
160 bool "Connection tracking labels"
162 This option enables support for assigning user-defined flag bits
163 to connection tracking entries. It can be used with xtables connlabel
164 match and the nftables ct expression.
166 config NF_CT_PROTO_DCCP
167 bool 'DCCP protocol connection tracking support'
168 depends on NETFILTER_ADVANCED
171 With this option enabled, the layer 3 independent connection
172 tracking code will be able to do state tracking on DCCP connections.
176 config NF_CT_PROTO_GRE
179 config NF_CT_PROTO_SCTP
180 bool 'SCTP protocol connection tracking support'
181 depends on NETFILTER_ADVANCED
185 With this option enabled, the layer 3 independent connection
186 tracking code will be able to do state tracking on SCTP connections.
190 config NF_CT_PROTO_UDPLITE
191 bool 'UDP-Lite protocol connection tracking support'
192 depends on NETFILTER_ADVANCED
195 With this option enabled, the layer 3 independent connection
196 tracking code will be able to do state tracking on UDP-Lite
201 config NF_CONNTRACK_AMANDA
202 tristate "Amanda backup protocol support"
203 depends on NETFILTER_ADVANCED
205 select TEXTSEARCH_KMP
207 If you are running the Amanda backup package <http://www.amanda.org/>
208 on this machine or machines that will be MASQUERADED through this
209 machine, then you may want to enable this feature. This allows the
210 connection tracking and natting code to allow the sub-channels that
211 Amanda requires for communication of the backup data, messages and
214 To compile it as a module, choose M here. If unsure, say N.
216 config NF_CONNTRACK_FTP
217 tristate "FTP protocol support"
218 default m if NETFILTER_ADVANCED=n
220 Tracking FTP connections is problematic: special helpers are
221 required for tracking them, and doing masquerading and other forms
222 of Network Address Translation on them.
224 This is FTP support on Layer 3 independent connection tracking.
225 Layer 3 independent connection tracking is experimental scheme
226 which generalize ip_conntrack to support other layer 3 protocols.
228 To compile it as a module, choose M here. If unsure, say N.
230 config NF_CONNTRACK_H323
231 tristate "H.323 protocol support"
232 depends on IPV6 || IPV6=n
233 depends on NETFILTER_ADVANCED
235 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
236 important VoIP protocols, it is widely used by voice hardware and
237 software including voice gateways, IP phones, Netmeeting, OpenPhone,
240 With this module you can support H.323 on a connection tracking/NAT
243 This module supports RAS, Fast Start, H.245 Tunnelling, Call
244 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
245 whiteboard, file transfer, etc. For more information, please
246 visit http://nath323.sourceforge.net/.
248 To compile it as a module, choose M here. If unsure, say N.
250 config NF_CONNTRACK_IRC
251 tristate "IRC protocol support"
252 default m if NETFILTER_ADVANCED=n
254 There is a commonly-used extension to IRC called
255 Direct Client-to-Client Protocol (DCC). This enables users to send
256 files to each other, and also chat to each other without the need
257 of a server. DCC Sending is used anywhere you send files over IRC,
258 and DCC Chat is most commonly used by Eggdrop bots. If you are
259 using NAT, this extension will enable you to send files and initiate
260 chats. Note that you do NOT need this extension to get files or
261 have others initiate chats, or everything else in IRC.
263 To compile it as a module, choose M here. If unsure, say N.
265 config NF_CONNTRACK_BROADCAST
268 config NF_CONNTRACK_NETBIOS_NS
269 tristate "NetBIOS name service protocol support"
270 select NF_CONNTRACK_BROADCAST
272 NetBIOS name service requests are sent as broadcast messages from an
273 unprivileged port and responded to with unicast messages to the
274 same port. This make them hard to firewall properly because connection
275 tracking doesn't deal with broadcasts. This helper tracks locally
276 originating NetBIOS name service requests and the corresponding
277 responses. It relies on correct IP address configuration, specifically
278 netmask and broadcast address. When properly configured, the output
279 of "ip address show" should look similar to this:
281 $ ip -4 address show eth0
282 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
283 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
285 To compile it as a module, choose M here. If unsure, say N.
287 config NF_CONNTRACK_SNMP
288 tristate "SNMP service protocol support"
289 depends on NETFILTER_ADVANCED
290 select NF_CONNTRACK_BROADCAST
292 SNMP service requests are sent as broadcast messages from an
293 unprivileged port and responded to with unicast messages to the
294 same port. This make them hard to firewall properly because connection
295 tracking doesn't deal with broadcasts. This helper tracks locally
296 originating SNMP service requests and the corresponding
297 responses. It relies on correct IP address configuration, specifically
298 netmask and broadcast address.
300 To compile it as a module, choose M here. If unsure, say N.
302 config NF_CONNTRACK_PPTP
303 tristate "PPtP protocol support"
304 depends on NETFILTER_ADVANCED
305 select NF_CT_PROTO_GRE
307 This module adds support for PPTP (Point to Point Tunnelling
308 Protocol, RFC2637) connection tracking and NAT.
310 If you are running PPTP sessions over a stateful firewall or NAT
311 box, you may want to enable this feature.
313 Please note that not all PPTP modes of operation are supported yet.
314 Specifically these limitations exist:
315 - Blindly assumes that control connections are always established
316 in PNS->PAC direction. This is a violation of RFC2637.
317 - Only supports a single call within each session
319 To compile it as a module, choose M here. If unsure, say N.
321 config NF_CONNTRACK_SANE
322 tristate "SANE protocol support"
323 depends on NETFILTER_ADVANCED
325 SANE is a protocol for remote access to scanners as implemented
326 by the 'saned' daemon. Like FTP, it uses separate control and
329 With this module you can support SANE on a connection tracking
332 To compile it as a module, choose M here. If unsure, say N.
334 config NF_CONNTRACK_SIP
335 tristate "SIP protocol support"
336 default m if NETFILTER_ADVANCED=n
338 SIP is an application-layer control protocol that can establish,
339 modify, and terminate multimedia sessions (conferences) such as
340 Internet telephony calls. With the ip_conntrack_sip and
341 the nf_nat_sip modules you can support the protocol on a connection
342 tracking/NATing firewall.
344 To compile it as a module, choose M here. If unsure, say N.
346 config NF_CONNTRACK_TFTP
347 tristate "TFTP protocol support"
348 depends on NETFILTER_ADVANCED
350 TFTP connection tracking helper, this is required depending
351 on how restrictive your ruleset is.
352 If you are using a tftp client behind -j SNAT or -j MASQUERADING
355 To compile it as a module, choose M here. If unsure, say N.
358 tristate 'Connection tracking netlink interface'
359 select NETFILTER_NETLINK
360 default m if NETFILTER_ADVANCED=n
362 This option enables support for a netlink-based userspace interface
364 config NF_CT_NETLINK_TIMEOUT
365 tristate 'Connection tracking timeout tuning via Netlink'
366 select NETFILTER_NETLINK
367 depends on NETFILTER_ADVANCED
368 depends on NF_CONNTRACK_TIMEOUT
370 This option enables support for connection tracking timeout
371 fine-grain tuning. This allows you to attach specific timeout
372 policies to flows, instead of using the global timeout policy.
376 config NF_CT_NETLINK_HELPER
377 tristate 'Connection tracking helpers in user-space via Netlink'
378 select NETFILTER_NETLINK
379 depends on NF_CT_NETLINK
380 depends on NETFILTER_NETLINK_QUEUE
381 depends on NETFILTER_NETLINK_GLUE_CT
382 depends on NETFILTER_ADVANCED
384 This option enables the user-space connection tracking helpers
389 config NETFILTER_NETLINK_GLUE_CT
390 bool "NFQUEUE and NFLOG integration with Connection Tracking"
392 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
394 If this option is enabled, NFQUEUE and NFLOG can include
395 Connection Tracking information together with the packet is
396 the enqueued via NFNETLINK.
406 config NF_NAT_PROTO_DCCP
408 depends on NF_NAT && NF_CT_PROTO_DCCP
409 default NF_NAT && NF_CT_PROTO_DCCP
411 config NF_NAT_PROTO_UDPLITE
413 depends on NF_NAT && NF_CT_PROTO_UDPLITE
414 default NF_NAT && NF_CT_PROTO_UDPLITE
416 config NF_NAT_PROTO_SCTP
418 default NF_NAT && NF_CT_PROTO_SCTP
419 depends on NF_NAT && NF_CT_PROTO_SCTP
423 depends on NF_CONNTRACK && NF_NAT
424 default NF_NAT && NF_CONNTRACK_AMANDA
428 depends on NF_CONNTRACK && NF_NAT
429 default NF_NAT && NF_CONNTRACK_FTP
433 depends on NF_CONNTRACK && NF_NAT
434 default NF_NAT && NF_CONNTRACK_IRC
438 depends on NF_CONNTRACK && NF_NAT
439 default NF_NAT && NF_CONNTRACK_SIP
443 depends on NF_CONNTRACK && NF_NAT
444 default NF_NAT && NF_CONNTRACK_TFTP
446 config NF_NAT_REDIRECT
449 config NETFILTER_SYNPROXY
455 select NETFILTER_NETLINK
456 tristate "Netfilter nf_tables support"
458 nftables is the new packet classification framework that intends to
459 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
460 provides a pseudo-state machine with an extensible instruction-set
461 (also known as expressions) that the userspace 'nft' utility
462 (http://www.netfilter.org/projects/nftables) uses to build the
463 rule-set. It also comes with the generic set infrastructure that
464 allows you to construct mappings between matchings and actions
465 for performance lookups.
467 To compile it as a module, choose M here.
472 tristate "Netfilter nf_tables set infrastructure"
474 This option enables the nf_tables set infrastructure that allows to
475 look up for elements in a set and to build one-way mappings between
476 matchings and actions.
478 config NF_TABLES_INET
480 select NF_TABLES_IPV4
481 select NF_TABLES_IPV6
482 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
484 This option enables support for a mixed IPv4/IPv6 "inet" table.
486 config NF_TABLES_NETDEV
487 bool "Netfilter nf_tables netdev tables support"
489 This option enables support for the "netdev" table.
492 tristate "Netfilter nf_tables number generator module"
494 This option adds the number generator expression used to perform
495 incremental counting and random numbers bound to a upper limit.
498 depends on NF_CONNTRACK
499 tristate "Netfilter nf_tables conntrack module"
501 This option adds the "ct" expression that you can use to match
502 connection tracking information such as the flow state.
504 config NFT_FLOW_OFFLOAD
505 depends on NF_CONNTRACK && NF_FLOW_TABLE
506 tristate "Netfilter nf_tables hardware flow offload module"
508 This option adds the "flow_offload" expression that you can use to
509 choose what flows are placed into the hardware.
512 tristate "Netfilter nf_tables counter module"
514 This option adds the "counter" expression that you can use to
515 include packet and byte counters in a rule.
518 tristate "Netfilter nf_tables connlimit module"
519 depends on NF_CONNTRACK
520 depends on NETFILTER_ADVANCED
521 select NETFILTER_CONNCOUNT
523 This option adds the "connlimit" expression that you can use to
524 ratelimit rule matchings per connections.
527 tristate "Netfilter nf_tables log module"
529 This option adds the "log" expression that you can use to log
530 packets matching some criteria.
533 tristate "Netfilter nf_tables limit module"
535 This option adds the "limit" expression that you can use to
536 ratelimit rule matchings.
539 depends on NF_CONNTRACK
541 tristate "Netfilter nf_tables masquerade support"
543 This option adds the "masquerade" expression that you can use
544 to perform NAT in the masquerade flavour.
547 depends on NF_CONNTRACK
549 tristate "Netfilter nf_tables redirect support"
551 This options adds the "redirect" expression that you can use
552 to perform NAT in the redirect flavour.
555 depends on NF_CONNTRACK
557 tristate "Netfilter nf_tables nat module"
559 This option adds the "nat" expression that you can use to perform
560 typical Network Address Translation (NAT) packet transformations.
563 tristate "Netfilter nf_tables tunnel module"
565 This option adds the "tunnel" expression that you can use to set
569 tristate "Netfilter nf_tables stateful object reference module"
571 This option adds the "objref" expression that allows you to refer to
572 stateful objects, such as counters and quotas.
575 depends on NETFILTER_NETLINK_QUEUE
576 tristate "Netfilter nf_tables queue module"
578 This is required if you intend to use the userspace queueing
579 infrastructure (also known as NFQUEUE) from nftables.
582 tristate "Netfilter nf_tables quota module"
584 This option adds the "quota" expression that you can use to match
585 enforce bytes quotas.
588 default m if NETFILTER_ADVANCED=n
589 tristate "Netfilter nf_tables reject support"
590 depends on !NF_TABLES_INET || (IPV6!=m || m)
592 This option adds the "reject" expression that you can use to
593 explicitly deny and notify via TCP reset/ICMP informational errors
596 config NFT_REJECT_INET
597 depends on NF_TABLES_INET
602 depends on NETFILTER_XTABLES
603 tristate "Netfilter x_tables over nf_tables module"
605 This is required if you intend to use any of existing
606 x_tables match/target extensions over the nf_tables
610 tristate "Netfilter nf_tables hash module"
612 This option adds the "hash" expression that you can use to perform
613 a hash operation on registers.
619 depends on NF_TABLES_INET
620 depends on NFT_FIB_IPV4
621 depends on NFT_FIB_IPV6
622 tristate "Netfilter nf_tables fib inet support"
624 This option allows using the FIB expression from the inet table.
625 The lookup will be delegated to the IPv4 or IPv6 FIB depending
626 on the protocol of the packet.
629 tristate "Netfilter nf_tables socket match support"
630 depends on IPV6 || IPV6=n
631 select NF_SOCKET_IPV4
632 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
634 This option allows matching for the presence or absence of a
635 corresponding socket and its attributes.
638 tristate "Netfilter nf_tables passive OS fingerprint support"
639 depends on NETFILTER_ADVANCED
640 select NETFILTER_NETLINK_OSF
642 This option allows matching packets from an specific OS.
645 tristate "Netfilter nf_tables tproxy support"
646 depends on IPV6 || IPV6=n
647 select NF_DEFRAG_IPV4
648 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
649 select NF_TPROXY_IPV4
650 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
652 This makes transparent proxy support available in nftables.
657 tristate "Netfilter packet duplication support"
659 This option enables the generic packet duplication infrastructure
662 config NFT_DUP_NETDEV
663 tristate "Netfilter nf_tables netdev packet duplication support"
666 This option enables packet duplication for the "netdev" family.
668 config NFT_FWD_NETDEV
669 tristate "Netfilter nf_tables netdev packet forwarding support"
672 This option enables packet forwarding for the "netdev" family.
674 config NFT_FIB_NETDEV
675 depends on NFT_FIB_IPV4
676 depends on NFT_FIB_IPV6
677 tristate "Netfilter nf_tables netdev fib lookups support"
679 This option allows using the FIB expression from the netdev table.
680 The lookup will be delegated to the IPv4 or IPv6 FIB depending
681 on the protocol of the packet.
683 endif # NF_TABLES_NETDEV
687 config NF_FLOW_TABLE_INET
688 tristate "Netfilter flow table mixed IPv4/IPv6 module"
689 depends on NF_FLOW_TABLE
691 This option adds the flow table mixed IPv4/IPv6 support.
693 To compile it as a module, choose M here.
696 tristate "Netfilter flow table module"
697 depends on NETFILTER_INGRESS
698 depends on NF_CONNTRACK
701 This option adds the flow table core infrastructure.
703 To compile it as a module, choose M here.
705 config NETFILTER_XTABLES
706 tristate "Netfilter Xtables support (required for ip_tables)"
707 default m if NETFILTER_ADVANCED=n
709 This is required if you intend to use any of ip_tables,
710 ip6_tables or arp_tables.
714 comment "Xtables combined modules"
716 config NETFILTER_XT_MARK
717 tristate 'nfmark target and match support'
718 default m if NETFILTER_ADVANCED=n
720 This option adds the "MARK" target and "mark" match.
722 Netfilter mark matching allows you to match packets based on the
723 "nfmark" value in the packet.
724 The target allows you to create rules in the "mangle" table which alter
725 the netfilter mark (nfmark) field associated with the packet.
727 Prior to routing, the nfmark can influence the routing method and can
728 also be used by other subsystems to change their behavior.
730 config NETFILTER_XT_CONNMARK
731 tristate 'ctmark target and match support'
732 depends on NF_CONNTRACK
733 depends on NETFILTER_ADVANCED
734 select NF_CONNTRACK_MARK
736 This option adds the "CONNMARK" target and "connmark" match.
738 Netfilter allows you to store a mark value per connection (a.k.a.
739 ctmark), similarly to the packet mark (nfmark). Using this
740 target and match, you can set and match on this mark.
742 config NETFILTER_XT_SET
743 tristate 'set target and match support'
745 depends on NETFILTER_ADVANCED
747 This option adds the "SET" target and "set" match.
749 Using this target and match, you can add/delete and match
750 elements in the sets created by ipset(8).
752 To compile it as a module, choose M here. If unsure, say N.
754 # alphabetically ordered list of targets
756 comment "Xtables targets"
758 config NETFILTER_XT_TARGET_AUDIT
759 tristate "AUDIT target support"
761 depends on NETFILTER_ADVANCED
763 This option adds a 'AUDIT' target, which can be used to create
764 audit records for packets dropped/accepted.
766 To compileit as a module, choose M here. If unsure, say N.
768 config NETFILTER_XT_TARGET_CHECKSUM
769 tristate "CHECKSUM target support"
770 depends on IP_NF_MANGLE || IP6_NF_MANGLE
771 depends on NETFILTER_ADVANCED
773 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
774 table to work around buggy DHCP clients in virtualized environments.
776 Some old DHCP clients drop packets because they are not aware
777 that the checksum would normally be offloaded to hardware and
778 thus should be considered valid.
779 This target can be used to fill in the checksum using iptables
780 when such packets are sent via a virtual network device.
782 To compile it as a module, choose M here. If unsure, say N.
784 config NETFILTER_XT_TARGET_CLASSIFY
785 tristate '"CLASSIFY" target support'
786 depends on NETFILTER_ADVANCED
788 This option adds a `CLASSIFY' target, which enables the user to set
789 the priority of a packet. Some qdiscs can use this value for
790 classification, among these are:
792 atm, cbq, dsmark, pfifo_fast, htb, prio
794 To compile it as a module, choose M here. If unsure, say N.
796 config NETFILTER_XT_TARGET_CONNMARK
797 tristate '"CONNMARK" target support'
798 depends on NF_CONNTRACK
799 depends on NETFILTER_ADVANCED
800 select NETFILTER_XT_CONNMARK
802 This is a backwards-compat option for the user's convenience
803 (e.g. when running oldconfig). It selects
804 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
806 config NETFILTER_XT_TARGET_CONNSECMARK
807 tristate '"CONNSECMARK" target support'
808 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
809 default m if NETFILTER_ADVANCED=n
811 The CONNSECMARK target copies security markings from packets
812 to connections, and restores security markings from connections
813 to packets (if the packets are not already marked). This would
814 normally be used in conjunction with the SECMARK target.
816 To compile it as a module, choose M here. If unsure, say N.
818 config NETFILTER_XT_TARGET_CT
819 tristate '"CT" target support'
820 depends on NF_CONNTRACK
821 depends on IP_NF_RAW || IP6_NF_RAW
822 depends on NETFILTER_ADVANCED
824 This options adds a `CT' target, which allows to specify initial
825 connection tracking parameters like events to be delivered and
826 the helper to be used.
828 To compile it as a module, choose M here. If unsure, say N.
830 config NETFILTER_XT_TARGET_DSCP
831 tristate '"DSCP" and "TOS" target support'
832 depends on IP_NF_MANGLE || IP6_NF_MANGLE
833 depends on NETFILTER_ADVANCED
835 This option adds a `DSCP' target, which allows you to manipulate
836 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
838 The DSCP field can have any value between 0x0 and 0x3f inclusive.
840 It also adds the "TOS" target, which allows you to create rules in
841 the "mangle" table which alter the Type Of Service field of an IPv4
842 or the Priority field of an IPv6 packet, prior to routing.
844 To compile it as a module, choose M here. If unsure, say N.
846 config NETFILTER_XT_TARGET_HL
847 tristate '"HL" hoplimit target support'
848 depends on IP_NF_MANGLE || IP6_NF_MANGLE
849 depends on NETFILTER_ADVANCED
851 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
852 targets, which enable the user to change the
853 hoplimit/time-to-live value of the IP header.
855 While it is safe to decrement the hoplimit/TTL value, the
856 modules also allow to increment and set the hoplimit value of
857 the header to arbitrary values. This is EXTREMELY DANGEROUS
858 since you can easily create immortal packets that loop
859 forever on the network.
861 config NETFILTER_XT_TARGET_HMARK
862 tristate '"HMARK" target support'
863 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
864 depends on NETFILTER_ADVANCED
866 This option adds the "HMARK" target.
868 The target allows you to create rules in the "raw" and "mangle" tables
869 which set the skbuff mark by means of hash calculation within a given
870 range. The nfmark can influence the routing method and can also be used
871 by other subsystems to change their behaviour.
873 To compile it as a module, choose M here. If unsure, say N.
875 config NETFILTER_XT_TARGET_IDLETIMER
876 tristate "IDLETIMER target support"
877 depends on NETFILTER_ADVANCED
880 This option adds the `IDLETIMER' target. Each matching packet
881 resets the timer associated with label specified when the rule is
882 added. When the timer expires, it triggers a sysfs notification.
883 The remaining time for expiration can be read via sysfs.
885 To compile it as a module, choose M here. If unsure, say N.
887 config NETFILTER_XT_TARGET_LED
888 tristate '"LED" target support'
889 depends on LEDS_CLASS && LEDS_TRIGGERS
890 depends on NETFILTER_ADVANCED
892 This option adds a `LED' target, which allows you to blink LEDs in
893 response to particular packets passing through your machine.
895 This can be used to turn a spare LED into a network activity LED,
896 which only flashes in response to FTP transfers, for example. Or
897 you could have an LED which lights up for a minute or two every time
898 somebody connects to your machine via SSH.
900 You will need support for the "led" class to make this work.
902 To create an LED trigger for incoming SSH traffic:
903 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
905 Then attach the new trigger to an LED on your system:
906 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
908 For more information on the LEDs available on your system, see
909 Documentation/leds/leds-class.txt
911 config NETFILTER_XT_TARGET_LOG
912 tristate "LOG target support"
915 select NF_LOG_IPV6 if IP6_NF_IPTABLES
916 default m if NETFILTER_ADVANCED=n
918 This option adds a `LOG' target, which allows you to create rules in
919 any iptables table which records the packet header to the syslog.
921 To compile it as a module, choose M here. If unsure, say N.
923 config NETFILTER_XT_TARGET_MARK
924 tristate '"MARK" target support'
925 depends on NETFILTER_ADVANCED
926 select NETFILTER_XT_MARK
928 This is a backwards-compat option for the user's convenience
929 (e.g. when running oldconfig). It selects
930 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
932 config NETFILTER_XT_NAT
933 tristate '"SNAT and DNAT" targets support'
936 This option enables the SNAT and DNAT targets.
938 To compile it as a module, choose M here. If unsure, say N.
940 config NETFILTER_XT_TARGET_NETMAP
941 tristate '"NETMAP" target support'
944 NETMAP is an implementation of static 1:1 NAT mapping of network
945 addresses. It maps the network address part, while keeping the host
948 To compile it as a module, choose M here. If unsure, say N.
950 config NETFILTER_XT_TARGET_NFLOG
951 tristate '"NFLOG" target support'
952 default m if NETFILTER_ADVANCED=n
953 select NETFILTER_NETLINK_LOG
955 This option enables the NFLOG target, which allows to LOG
956 messages through nfnetlink_log.
958 To compile it as a module, choose M here. If unsure, say N.
960 config NETFILTER_XT_TARGET_NFQUEUE
961 tristate '"NFQUEUE" target Support'
962 depends on NETFILTER_ADVANCED
963 select NETFILTER_NETLINK_QUEUE
965 This target replaced the old obsolete QUEUE target.
967 As opposed to QUEUE, it supports 65535 different queues,
970 To compile it as a module, choose M here. If unsure, say N.
972 config NETFILTER_XT_TARGET_NOTRACK
973 tristate '"NOTRACK" target support (DEPRECATED)'
974 depends on NF_CONNTRACK
975 depends on IP_NF_RAW || IP6_NF_RAW
976 depends on NETFILTER_ADVANCED
977 select NETFILTER_XT_TARGET_CT
979 config NETFILTER_XT_TARGET_RATEEST
980 tristate '"RATEEST" target support'
981 depends on NETFILTER_ADVANCED
983 This option adds a `RATEEST' target, which allows to measure
984 rates similar to TC estimators. The `rateest' match can be
985 used to match on the measured rates.
987 To compile it as a module, choose M here. If unsure, say N.
989 config NETFILTER_XT_TARGET_REDIRECT
990 tristate "REDIRECT target support"
992 select NF_NAT_REDIRECT
994 REDIRECT is a special case of NAT: all incoming connections are
995 mapped onto the incoming interface's address, causing the packets to
996 come to the local machine instead of passing through. This is
997 useful for transparent proxies.
999 To compile it as a module, choose M here. If unsure, say N.
1001 config NETFILTER_XT_TARGET_TEE
1002 tristate '"TEE" - packet cloning to alternate destination'
1003 depends on NETFILTER_ADVANCED
1004 depends on IPV6 || IPV6=n
1005 depends on !NF_CONNTRACK || NF_CONNTRACK
1007 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1009 This option adds a "TEE" target with which a packet can be cloned and
1010 this clone be rerouted to another nexthop.
1012 config NETFILTER_XT_TARGET_TPROXY
1013 tristate '"TPROXY" target transparent proxying support'
1014 depends on NETFILTER_XTABLES
1015 depends on NETFILTER_ADVANCED
1016 depends on IPV6 || IPV6=n
1017 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1018 depends on IP_NF_MANGLE
1019 select NF_DEFRAG_IPV4
1020 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1021 select NF_TPROXY_IPV4
1022 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1024 This option adds a `TPROXY' target, which is somewhat similar to
1025 REDIRECT. It can only be used in the mangle table and is useful
1026 to redirect traffic to a transparent proxy. It does _not_ depend
1027 on Netfilter connection tracking and NAT, unlike REDIRECT.
1028 For it to work you will have to configure certain iptables rules
1029 and use policy routing. For more information on how to set it up
1030 see Documentation/networking/tproxy.txt.
1032 To compile it as a module, choose M here. If unsure, say N.
1034 config NETFILTER_XT_TARGET_TRACE
1035 tristate '"TRACE" target support'
1036 depends on IP_NF_RAW || IP6_NF_RAW
1037 depends on NETFILTER_ADVANCED
1039 The TRACE target allows you to mark packets so that the kernel
1040 will log every rule which match the packets as those traverse
1041 the tables, chains, rules.
1043 If you want to compile it as a module, say M here and read
1044 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1046 config NETFILTER_XT_TARGET_SECMARK
1047 tristate '"SECMARK" target support'
1048 depends on NETWORK_SECMARK
1049 default m if NETFILTER_ADVANCED=n
1051 The SECMARK target allows security marking of network
1052 packets, for use with security subsystems.
1054 To compile it as a module, choose M here. If unsure, say N.
1056 config NETFILTER_XT_TARGET_TCPMSS
1057 tristate '"TCPMSS" target support'
1058 depends on IPV6 || IPV6=n
1059 default m if NETFILTER_ADVANCED=n
1061 This option adds a `TCPMSS' target, which allows you to alter the
1062 MSS value of TCP SYN packets, to control the maximum size for that
1063 connection (usually limiting it to your outgoing interface's MTU
1066 This is used to overcome criminally braindead ISPs or servers which
1067 block ICMP Fragmentation Needed packets. The symptoms of this
1068 problem are that everything works fine from your Linux
1069 firewall/router, but machines behind it can never exchange large
1071 1) Web browsers connect, then hang with no data received.
1072 2) Small mail works fine, but large emails hang.
1073 3) ssh works fine, but scp hangs after initial handshaking.
1075 Workaround: activate this option and add a rule to your firewall
1078 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1079 -j TCPMSS --clamp-mss-to-pmtu
1081 To compile it as a module, choose M here. If unsure, say N.
1083 config NETFILTER_XT_TARGET_TCPOPTSTRIP
1084 tristate '"TCPOPTSTRIP" target support'
1085 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1086 depends on NETFILTER_ADVANCED
1088 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1089 TCP options from TCP packets.
1091 # alphabetically ordered list of matches
1093 comment "Xtables matches"
1095 config NETFILTER_XT_MATCH_ADDRTYPE
1096 tristate '"addrtype" address type match support'
1097 default m if NETFILTER_ADVANCED=n
1099 This option allows you to match what routing thinks of an address,
1100 eg. UNICAST, LOCAL, BROADCAST, ...
1102 If you want to compile it as a module, say M here and read
1103 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1105 config NETFILTER_XT_MATCH_BPF
1106 tristate '"bpf" match support'
1107 depends on NETFILTER_ADVANCED
1109 BPF matching applies a linux socket filter to each packet and
1110 accepts those for which the filter returns non-zero.
1112 To compile it as a module, choose M here. If unsure, say N.
1114 config NETFILTER_XT_MATCH_CGROUP
1115 tristate '"control group" match support'
1116 depends on NETFILTER_ADVANCED
1118 select CGROUP_NET_CLASSID
1120 Socket/process control group matching allows you to match locally
1121 generated packets based on which net_cls control group processes
1124 config NETFILTER_XT_MATCH_CLUSTER
1125 tristate '"cluster" match support'
1126 depends on NF_CONNTRACK
1127 depends on NETFILTER_ADVANCED
1129 This option allows you to build work-load-sharing clusters of
1130 network servers/stateful firewalls without having a dedicated
1131 load-balancing router/server/switch. Basically, this match returns
1132 true when the packet must be handled by this cluster node. Thus,
1133 all nodes see all packets and this match decides which node handles
1134 what packets. The work-load sharing algorithm is based on source
1137 If you say Y or M here, try `iptables -m cluster --help` for
1140 config NETFILTER_XT_MATCH_COMMENT
1141 tristate '"comment" match support'
1142 depends on NETFILTER_ADVANCED
1144 This option adds a `comment' dummy-match, which allows you to put
1145 comments in your iptables ruleset.
1147 If you want to compile it as a module, say M here and read
1148 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1150 config NETFILTER_XT_MATCH_CONNBYTES
1151 tristate '"connbytes" per-connection counter match support'
1152 depends on NF_CONNTRACK
1153 depends on NETFILTER_ADVANCED
1155 This option adds a `connbytes' match, which allows you to match the
1156 number of bytes and/or packets for each direction within a connection.
1158 If you want to compile it as a module, say M here and read
1159 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1161 config NETFILTER_XT_MATCH_CONNLABEL
1162 tristate '"connlabel" match support'
1163 select NF_CONNTRACK_LABELS
1164 depends on NF_CONNTRACK
1165 depends on NETFILTER_ADVANCED
1167 This match allows you to test and assign userspace-defined labels names
1168 to a connection. The kernel only stores bit values - mapping
1169 names to bits is done by userspace.
1171 Unlike connmark, more than 32 flag bits may be assigned to a
1172 connection simultaneously.
1174 config NETFILTER_XT_MATCH_CONNLIMIT
1175 tristate '"connlimit" match support'
1176 depends on NF_CONNTRACK
1177 depends on NETFILTER_ADVANCED
1178 select NETFILTER_CONNCOUNT
1180 This match allows you to match against the number of parallel
1181 connections to a server per client IP address (or address block).
1183 config NETFILTER_XT_MATCH_CONNMARK
1184 tristate '"connmark" connection mark match support'
1185 depends on NF_CONNTRACK
1186 depends on NETFILTER_ADVANCED
1187 select NETFILTER_XT_CONNMARK
1189 This is a backwards-compat option for the user's convenience
1190 (e.g. when running oldconfig). It selects
1191 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1193 config NETFILTER_XT_MATCH_CONNTRACK
1194 tristate '"conntrack" connection tracking match support'
1195 depends on NF_CONNTRACK
1196 default m if NETFILTER_ADVANCED=n
1198 This is a general conntrack match module, a superset of the state match.
1200 It allows matching on additional conntrack information, which is
1201 useful in complex configurations, such as NAT gateways with multiple
1202 internet links or tunnels.
1204 To compile it as a module, choose M here. If unsure, say N.
1206 config NETFILTER_XT_MATCH_CPU
1207 tristate '"cpu" match support'
1208 depends on NETFILTER_ADVANCED
1210 CPU matching allows you to match packets based on the CPU
1211 currently handling the packet.
1213 To compile it as a module, choose M here. If unsure, say N.
1215 config NETFILTER_XT_MATCH_DCCP
1216 tristate '"dccp" protocol match support'
1217 depends on NETFILTER_ADVANCED
1220 With this option enabled, you will be able to use the iptables
1221 `dccp' match in order to match on DCCP source/destination ports
1224 If you want to compile it as a module, say M here and read
1225 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1227 config NETFILTER_XT_MATCH_DEVGROUP
1228 tristate '"devgroup" match support'
1229 depends on NETFILTER_ADVANCED
1231 This options adds a `devgroup' match, which allows to match on the
1232 device group a network device is assigned to.
1234 To compile it as a module, choose M here. If unsure, say N.
1236 config NETFILTER_XT_MATCH_DSCP
1237 tristate '"dscp" and "tos" match support'
1238 depends on NETFILTER_ADVANCED
1240 This option adds a `DSCP' match, which allows you to match against
1241 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1243 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1245 It will also add a "tos" match, which allows you to match packets
1246 based on the Type Of Service fields of the IPv4 packet (which share
1247 the same bits as DSCP).
1249 To compile it as a module, choose M here. If unsure, say N.
1251 config NETFILTER_XT_MATCH_ECN
1252 tristate '"ecn" match support'
1253 depends on NETFILTER_ADVANCED
1255 This option adds an "ECN" match, which allows you to match against
1256 the IPv4 and TCP header ECN fields.
1258 To compile it as a module, choose M here. If unsure, say N.
1260 config NETFILTER_XT_MATCH_ESP
1261 tristate '"esp" match support'
1262 depends on NETFILTER_ADVANCED
1264 This match extension allows you to match a range of SPIs
1265 inside ESP header of IPSec packets.
1267 To compile it as a module, choose M here. If unsure, say N.
1269 config NETFILTER_XT_MATCH_HASHLIMIT
1270 tristate '"hashlimit" match support'
1271 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1272 depends on NETFILTER_ADVANCED
1274 This option adds a `hashlimit' match.
1276 As opposed to `limit', this match dynamically creates a hash table
1277 of limit buckets, based on your selection of source/destination
1278 addresses and/or ports.
1280 It enables you to express policies like `10kpps for any given
1281 destination address' or `500pps from any given source address'
1284 config NETFILTER_XT_MATCH_HELPER
1285 tristate '"helper" match support'
1286 depends on NF_CONNTRACK
1287 depends on NETFILTER_ADVANCED
1289 Helper matching allows you to match packets in dynamic connections
1290 tracked by a conntrack-helper, ie. ip_conntrack_ftp
1292 To compile it as a module, choose M here. If unsure, say Y.
1294 config NETFILTER_XT_MATCH_HL
1295 tristate '"hl" hoplimit/TTL match support'
1296 depends on NETFILTER_ADVANCED
1298 HL matching allows you to match packets based on the hoplimit
1299 in the IPv6 header, or the time-to-live field in the IPv4
1300 header of the packet.
1302 config NETFILTER_XT_MATCH_IPCOMP
1303 tristate '"ipcomp" match support'
1304 depends on NETFILTER_ADVANCED
1306 This match extension allows you to match a range of CPIs(16 bits)
1307 inside IPComp header of IPSec packets.
1309 To compile it as a module, choose M here. If unsure, say N.
1311 config NETFILTER_XT_MATCH_IPRANGE
1312 tristate '"iprange" address range match support'
1313 depends on NETFILTER_ADVANCED
1315 This option adds a "iprange" match, which allows you to match based on
1316 an IP address range. (Normal iptables only matches on single addresses
1317 with an optional mask.)
1321 config NETFILTER_XT_MATCH_IPVS
1322 tristate '"ipvs" match support'
1324 depends on NETFILTER_ADVANCED
1325 depends on NF_CONNTRACK
1327 This option allows you to match against IPVS properties of a packet.
1331 config NETFILTER_XT_MATCH_L2TP
1332 tristate '"l2tp" match support'
1333 depends on NETFILTER_ADVANCED
1336 This option adds an "L2TP" match, which allows you to match against
1337 L2TP protocol header fields.
1339 To compile it as a module, choose M here. If unsure, say N.
1341 config NETFILTER_XT_MATCH_LENGTH
1342 tristate '"length" match support'
1343 depends on NETFILTER_ADVANCED
1345 This option allows you to match the length of a packet against a
1346 specific value or range of values.
1348 To compile it as a module, choose M here. If unsure, say N.
1350 config NETFILTER_XT_MATCH_LIMIT
1351 tristate '"limit" match support'
1352 depends on NETFILTER_ADVANCED
1354 limit matching allows you to control the rate at which a rule can be
1355 matched: mainly useful in combination with the LOG target ("LOG
1356 target support", below) and to avoid some Denial of Service attacks.
1358 To compile it as a module, choose M here. If unsure, say N.
1360 config NETFILTER_XT_MATCH_MAC
1361 tristate '"mac" address match support'
1362 depends on NETFILTER_ADVANCED
1364 MAC matching allows you to match packets based on the source
1365 Ethernet address of the packet.
1367 To compile it as a module, choose M here. If unsure, say N.
1369 config NETFILTER_XT_MATCH_MARK
1370 tristate '"mark" match support'
1371 depends on NETFILTER_ADVANCED
1372 select NETFILTER_XT_MARK
1374 This is a backwards-compat option for the user's convenience
1375 (e.g. when running oldconfig). It selects
1376 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1378 config NETFILTER_XT_MATCH_MULTIPORT
1379 tristate '"multiport" Multiple port match support'
1380 depends on NETFILTER_ADVANCED
1382 Multiport matching allows you to match TCP or UDP packets based on
1383 a series of source or destination ports: normally a rule can only
1384 match a single range of ports.
1386 To compile it as a module, choose M here. If unsure, say N.
1388 config NETFILTER_XT_MATCH_NFACCT
1389 tristate '"nfacct" match support'
1390 depends on NETFILTER_ADVANCED
1391 select NETFILTER_NETLINK_ACCT
1393 This option allows you to use the extended accounting through
1396 To compile it as a module, choose M here. If unsure, say N.
1398 config NETFILTER_XT_MATCH_OSF
1399 tristate '"osf" Passive OS fingerprint match'
1400 depends on NETFILTER_ADVANCED
1401 select NETFILTER_NETLINK_OSF
1403 This option selects the Passive OS Fingerprinting match module
1404 that allows to passively match the remote operating system by
1405 analyzing incoming TCP SYN packets.
1407 Rules and loading software can be downloaded from
1408 http://www.ioremap.net/projects/osf
1410 To compile it as a module, choose M here. If unsure, say N.
1412 config NETFILTER_XT_MATCH_OWNER
1413 tristate '"owner" match support'
1414 depends on NETFILTER_ADVANCED
1416 Socket owner matching allows you to match locally-generated packets
1417 based on who created the socket: the user or group. It is also
1418 possible to check whether a socket actually exists.
1420 config NETFILTER_XT_MATCH_POLICY
1421 tristate 'IPsec "policy" match support'
1423 default m if NETFILTER_ADVANCED=n
1425 Policy matching allows you to match packets based on the
1426 IPsec policy that was used during decapsulation/will
1427 be used during encapsulation.
1429 To compile it as a module, choose M here. If unsure, say N.
1431 config NETFILTER_XT_MATCH_PHYSDEV
1432 tristate '"physdev" match support'
1433 depends on BRIDGE && BRIDGE_NETFILTER
1434 depends on NETFILTER_ADVANCED
1436 Physdev packet matching matches against the physical bridge ports
1437 the IP packet arrived on or will leave by.
1439 To compile it as a module, choose M here. If unsure, say N.
1441 config NETFILTER_XT_MATCH_PKTTYPE
1442 tristate '"pkttype" packet type match support'
1443 depends on NETFILTER_ADVANCED
1445 Packet type matching allows you to match a packet by
1446 its "class", eg. BROADCAST, MULTICAST, ...
1449 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1451 To compile it as a module, choose M here. If unsure, say N.
1453 config NETFILTER_XT_MATCH_QUOTA
1454 tristate '"quota" match support'
1455 depends on NETFILTER_ADVANCED
1457 This option adds a `quota' match, which allows to match on a
1460 If you want to compile it as a module, say M here and read
1461 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1463 config NETFILTER_XT_MATCH_RATEEST
1464 tristate '"rateest" match support'
1465 depends on NETFILTER_ADVANCED
1466 select NETFILTER_XT_TARGET_RATEEST
1468 This option adds a `rateest' match, which allows to match on the
1469 rate estimated by the RATEEST target.
1471 To compile it as a module, choose M here. If unsure, say N.
1473 config NETFILTER_XT_MATCH_REALM
1474 tristate '"realm" match support'
1475 depends on NETFILTER_ADVANCED
1476 select IP_ROUTE_CLASSID
1478 This option adds a `realm' match, which allows you to use the realm
1479 key from the routing subsystem inside iptables.
1481 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1484 If you want to compile it as a module, say M here and read
1485 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1487 config NETFILTER_XT_MATCH_RECENT
1488 tristate '"recent" match support'
1489 depends on NETFILTER_ADVANCED
1491 This match is used for creating one or many lists of recently
1492 used addresses and then matching against that/those list(s).
1494 Short options are available by using 'iptables -m recent -h'
1495 Official Website: <http://snowman.net/projects/ipt_recent/>
1497 config NETFILTER_XT_MATCH_SCTP
1498 tristate '"sctp" protocol match support'
1499 depends on NETFILTER_ADVANCED
1502 With this option enabled, you will be able to use the
1503 `sctp' match in order to match on SCTP source/destination ports
1504 and SCTP chunk types.
1506 If you want to compile it as a module, say M here and read
1507 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1509 config NETFILTER_XT_MATCH_SOCKET
1510 tristate '"socket" match support'
1511 depends on NETFILTER_XTABLES
1512 depends on NETFILTER_ADVANCED
1513 depends on IPV6 || IPV6=n
1514 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1515 select NF_SOCKET_IPV4
1516 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1517 select NF_DEFRAG_IPV4
1518 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1520 This option adds a `socket' match, which can be used to match
1521 packets for which a TCP or UDP socket lookup finds a valid socket.
1522 It can be used in combination with the MARK target and policy
1523 routing to implement full featured non-locally bound sockets.
1525 To compile it as a module, choose M here. If unsure, say N.
1527 config NETFILTER_XT_MATCH_STATE
1528 tristate '"state" match support'
1529 depends on NF_CONNTRACK
1530 default m if NETFILTER_ADVANCED=n
1532 Connection state matching allows you to match packets based on their
1533 relationship to a tracked connection (ie. previous packets). This
1534 is a powerful tool for packet classification.
1536 To compile it as a module, choose M here. If unsure, say N.
1538 config NETFILTER_XT_MATCH_STATISTIC
1539 tristate '"statistic" match support'
1540 depends on NETFILTER_ADVANCED
1542 This option adds a `statistic' match, which allows you to match
1543 on packets periodically or randomly with a given percentage.
1545 To compile it as a module, choose M here. If unsure, say N.
1547 config NETFILTER_XT_MATCH_STRING
1548 tristate '"string" match support'
1549 depends on NETFILTER_ADVANCED
1551 select TEXTSEARCH_KMP
1552 select TEXTSEARCH_BM
1553 select TEXTSEARCH_FSM
1555 This option adds a `string' match, which allows you to look for
1556 pattern matchings in packets.
1558 To compile it as a module, choose M here. If unsure, say N.
1560 config NETFILTER_XT_MATCH_TCPMSS
1561 tristate '"tcpmss" match support'
1562 depends on NETFILTER_ADVANCED
1564 This option adds a `tcpmss' match, which allows you to examine the
1565 MSS value of TCP SYN packets, which control the maximum packet size
1566 for that connection.
1568 To compile it as a module, choose M here. If unsure, say N.
1570 config NETFILTER_XT_MATCH_TIME
1571 tristate '"time" match support'
1572 depends on NETFILTER_ADVANCED
1574 This option adds a "time" match, which allows you to match based on
1575 the packet arrival time (at the machine which netfilter is running)
1576 on) or departure time/date (for locally generated packets).
1578 If you say Y here, try `iptables -m time --help` for
1581 If you want to compile it as a module, say M here.
1584 config NETFILTER_XT_MATCH_U32
1585 tristate '"u32" match support'
1586 depends on NETFILTER_ADVANCED
1588 u32 allows you to extract quantities of up to 4 bytes from a packet,
1589 AND them with specified masks, shift them by specified amounts and
1590 test whether the results are in any of a set of specified ranges.
1591 The specification of what to extract is general enough to skip over
1592 headers with lengths stored in the packet, as in IP or TCP header
1595 Details and examples are in the kernel module source.
1597 endif # NETFILTER_XTABLES
1601 source "net/netfilter/ipset/Kconfig"
1603 source "net/netfilter/ipvs/Kconfig"