1 # SPDX-License-Identifier: GPL-2.0-only
2 menu "Core Netfilter Configuration"
3 depends on NET && INET && NETFILTER
5 config NETFILTER_INGRESS
6 bool "Netfilter ingress support"
10 This allows you to classify packets from ingress using the Netfilter
13 config NETFILTER_NETLINK
16 config NETFILTER_FAMILY_BRIDGE
19 config NETFILTER_FAMILY_ARP
22 config NETFILTER_NETLINK_ACCT
23 tristate "Netfilter NFACCT over NFNETLINK interface"
24 depends on NETFILTER_ADVANCED
25 select NETFILTER_NETLINK
27 If this option is enabled, the kernel will include support
28 for extended accounting via NFNETLINK.
30 config NETFILTER_NETLINK_QUEUE
31 tristate "Netfilter NFQUEUE over NFNETLINK interface"
32 depends on NETFILTER_ADVANCED
33 select NETFILTER_NETLINK
35 If this option is enabled, the kernel will include support
36 for queueing packets via NFNETLINK.
38 config NETFILTER_NETLINK_LOG
39 tristate "Netfilter LOG over NFNETLINK interface"
40 default m if NETFILTER_ADVANCED=n
41 select NETFILTER_NETLINK
43 If this option is enabled, the kernel will include support
44 for logging packets via NFNETLINK.
46 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
47 and is also scheduled to replace the old syslog-based ipt_LOG
50 config NETFILTER_NETLINK_OSF
51 tristate "Netfilter OSF over NFNETLINK interface"
52 depends on NETFILTER_ADVANCED
53 select NETFILTER_NETLINK
55 If this option is enabled, the kernel will include support
56 for passive OS fingerprint via NFNETLINK.
59 tristate "Netfilter connection tracking support"
60 default m if NETFILTER_ADVANCED=n
62 select NF_DEFRAG_IPV6 if IPV6 != n
64 Connection tracking keeps a record of what packets have passed
65 through your machine, in order to figure out how they are related
68 This is required to do Masquerading or other kinds of Network
69 Address Translation. It can also be used to enhance packet
70 filtering (see `Connection state match support' below).
72 To compile it as a module, choose M here. If unsure, say N.
78 tristate "Netdev packet logging"
82 config NETFILTER_CONNCOUNT
85 config NF_CONNTRACK_MARK
86 bool 'Connection mark tracking support'
87 depends on NETFILTER_ADVANCED
89 This option enables support for connection marks, used by the
90 `CONNMARK' target and `connmark' match. Similar to the mark value
91 of packets, but this mark value is kept in the conntrack session
92 instead of the individual packets.
94 config NF_CONNTRACK_SECMARK
95 bool 'Connection tracking security mark support'
96 depends on NETWORK_SECMARK
97 default m if NETFILTER_ADVANCED=n
99 This option enables security markings to be applied to
100 connections. Typically they are copied to connections from
101 packets using the CONNSECMARK target and copied back from
102 connections to packets with the same target, with the packets
103 being originally labeled via SECMARK.
107 config NF_CONNTRACK_ZONES
108 bool 'Connection tracking zones'
109 depends on NETFILTER_ADVANCED
111 This option enables support for connection tracking zones.
112 Normally, each connection needs to have a unique system wide
113 identity. Connection tracking zones allow to have multiple
114 connections using the same identity, as long as they are
115 contained in different zones.
119 config NF_CONNTRACK_PROCFS
120 bool "Supply CT list in procfs (OBSOLETE)"
124 This option enables for the list of known conntrack entries
125 to be shown in procfs under net/netfilter/nf_conntrack. This
126 is considered obsolete in favor of using the conntrack(8)
127 tool which uses Netlink.
129 config NF_CONNTRACK_EVENTS
130 bool "Connection tracking events"
131 depends on NETFILTER_ADVANCED
133 If this option is enabled, the connection tracking code will
134 provide a notifier chain that can be used by other kernel code
135 to get notified about changes in the connection tracking state.
139 config NF_CONNTRACK_TIMEOUT
140 bool 'Connection tracking timeout'
141 depends on NETFILTER_ADVANCED
143 This option enables support for connection tracking timeout
144 extension. This allows you to attach timeout policies to flow
149 config NF_CONNTRACK_TIMESTAMP
150 bool 'Connection tracking timestamping'
151 depends on NETFILTER_ADVANCED
153 This option enables support for connection tracking timestamping.
154 This allows you to store the flow start-time and to obtain
155 the flow-stop time (once it has been destroyed) via Connection
160 config NF_CONNTRACK_LABELS
161 bool "Connection tracking labels"
163 This option enables support for assigning user-defined flag bits
164 to connection tracking entries. It can be used with xtables connlabel
165 match and the nftables ct expression.
167 config NF_CT_PROTO_DCCP
168 bool 'DCCP protocol connection tracking support'
169 depends on NETFILTER_ADVANCED
172 With this option enabled, the layer 3 independent connection
173 tracking code will be able to do state tracking on DCCP connections.
177 config NF_CT_PROTO_GRE
180 config NF_CT_PROTO_SCTP
181 bool 'SCTP protocol connection tracking support'
182 depends on NETFILTER_ADVANCED
186 With this option enabled, the layer 3 independent connection
187 tracking code will be able to do state tracking on SCTP connections.
191 config NF_CT_PROTO_UDPLITE
192 bool 'UDP-Lite protocol connection tracking support'
193 depends on NETFILTER_ADVANCED
196 With this option enabled, the layer 3 independent connection
197 tracking code will be able to do state tracking on UDP-Lite
202 config NF_CONNTRACK_AMANDA
203 tristate "Amanda backup protocol support"
204 depends on NETFILTER_ADVANCED
206 select TEXTSEARCH_KMP
208 If you are running the Amanda backup package <http://www.amanda.org/>
209 on this machine or machines that will be MASQUERADED through this
210 machine, then you may want to enable this feature. This allows the
211 connection tracking and natting code to allow the sub-channels that
212 Amanda requires for communication of the backup data, messages and
215 To compile it as a module, choose M here. If unsure, say N.
217 config NF_CONNTRACK_FTP
218 tristate "FTP protocol support"
219 default m if NETFILTER_ADVANCED=n
221 Tracking FTP connections is problematic: special helpers are
222 required for tracking them, and doing masquerading and other forms
223 of Network Address Translation on them.
225 This is FTP support on Layer 3 independent connection tracking.
227 To compile it as a module, choose M here. If unsure, say N.
229 config NF_CONNTRACK_H323
230 tristate "H.323 protocol support"
231 depends on IPV6 || IPV6=n
232 depends on NETFILTER_ADVANCED
234 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
235 important VoIP protocols, it is widely used by voice hardware and
236 software including voice gateways, IP phones, Netmeeting, OpenPhone,
239 With this module you can support H.323 on a connection tracking/NAT
242 This module supports RAS, Fast Start, H.245 Tunnelling, Call
243 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
244 whiteboard, file transfer, etc. For more information, please
245 visit http://nath323.sourceforge.net/.
247 To compile it as a module, choose M here. If unsure, say N.
249 config NF_CONNTRACK_IRC
250 tristate "IRC protocol support"
251 default m if NETFILTER_ADVANCED=n
253 There is a commonly-used extension to IRC called
254 Direct Client-to-Client Protocol (DCC). This enables users to send
255 files to each other, and also chat to each other without the need
256 of a server. DCC Sending is used anywhere you send files over IRC,
257 and DCC Chat is most commonly used by Eggdrop bots. If you are
258 using NAT, this extension will enable you to send files and initiate
259 chats. Note that you do NOT need this extension to get files or
260 have others initiate chats, or everything else in IRC.
262 To compile it as a module, choose M here. If unsure, say N.
264 config NF_CONNTRACK_BROADCAST
267 config NF_CONNTRACK_NETBIOS_NS
268 tristate "NetBIOS name service protocol support"
269 select NF_CONNTRACK_BROADCAST
271 NetBIOS name service requests are sent as broadcast messages from an
272 unprivileged port and responded to with unicast messages to the
273 same port. This make them hard to firewall properly because connection
274 tracking doesn't deal with broadcasts. This helper tracks locally
275 originating NetBIOS name service requests and the corresponding
276 responses. It relies on correct IP address configuration, specifically
277 netmask and broadcast address. When properly configured, the output
278 of "ip address show" should look similar to this:
280 $ ip -4 address show eth0
281 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
282 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
284 To compile it as a module, choose M here. If unsure, say N.
286 config NF_CONNTRACK_SNMP
287 tristate "SNMP service protocol support"
288 depends on NETFILTER_ADVANCED
289 select NF_CONNTRACK_BROADCAST
291 SNMP service requests are sent as broadcast messages from an
292 unprivileged port and responded to with unicast messages to the
293 same port. This make them hard to firewall properly because connection
294 tracking doesn't deal with broadcasts. This helper tracks locally
295 originating SNMP service requests and the corresponding
296 responses. It relies on correct IP address configuration, specifically
297 netmask and broadcast address.
299 To compile it as a module, choose M here. If unsure, say N.
301 config NF_CONNTRACK_PPTP
302 tristate "PPtP protocol support"
303 depends on NETFILTER_ADVANCED
304 select NF_CT_PROTO_GRE
306 This module adds support for PPTP (Point to Point Tunnelling
307 Protocol, RFC2637) connection tracking and NAT.
309 If you are running PPTP sessions over a stateful firewall or NAT
310 box, you may want to enable this feature.
312 Please note that not all PPTP modes of operation are supported yet.
313 Specifically these limitations exist:
314 - Blindly assumes that control connections are always established
315 in PNS->PAC direction. This is a violation of RFC2637.
316 - Only supports a single call within each session
318 To compile it as a module, choose M here. If unsure, say N.
320 config NF_CONNTRACK_SANE
321 tristate "SANE protocol support"
322 depends on NETFILTER_ADVANCED
324 SANE is a protocol for remote access to scanners as implemented
325 by the 'saned' daemon. Like FTP, it uses separate control and
328 With this module you can support SANE on a connection tracking
331 To compile it as a module, choose M here. If unsure, say N.
333 config NF_CONNTRACK_SIP
334 tristate "SIP protocol support"
335 default m if NETFILTER_ADVANCED=n
337 SIP is an application-layer control protocol that can establish,
338 modify, and terminate multimedia sessions (conferences) such as
339 Internet telephony calls. With the nf_conntrack_sip and
340 the nf_nat_sip modules you can support the protocol on a connection
341 tracking/NATing firewall.
343 To compile it as a module, choose M here. If unsure, say N.
345 config NF_CONNTRACK_TFTP
346 tristate "TFTP protocol support"
347 depends on NETFILTER_ADVANCED
349 TFTP connection tracking helper, this is required depending
350 on how restrictive your ruleset is.
351 If you are using a tftp client behind -j SNAT or -j MASQUERADING
354 To compile it as a module, choose M here. If unsure, say N.
357 tristate 'Connection tracking netlink interface'
358 select NETFILTER_NETLINK
359 default m if NETFILTER_ADVANCED=n
361 This option enables support for a netlink-based userspace interface
363 config NF_CT_NETLINK_TIMEOUT
364 tristate 'Connection tracking timeout tuning via Netlink'
365 select NETFILTER_NETLINK
366 depends on NETFILTER_ADVANCED
367 depends on NF_CONNTRACK_TIMEOUT
369 This option enables support for connection tracking timeout
370 fine-grain tuning. This allows you to attach specific timeout
371 policies to flows, instead of using the global timeout policy.
375 config NF_CT_NETLINK_HELPER
376 tristate 'Connection tracking helpers in user-space via Netlink'
377 select NETFILTER_NETLINK
378 depends on NF_CT_NETLINK
379 depends on NETFILTER_NETLINK_QUEUE
380 depends on NETFILTER_NETLINK_GLUE_CT
381 depends on NETFILTER_ADVANCED
383 This option enables the user-space connection tracking helpers
388 config NETFILTER_NETLINK_GLUE_CT
389 bool "NFQUEUE and NFLOG integration with Connection Tracking"
391 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
393 If this option is enabled, NFQUEUE and NFLOG can include
394 Connection Tracking information together with the packet is
395 the enqueued via NFNETLINK.
398 tristate "Network Address Translation support"
399 depends on NF_CONNTRACK
400 default m if NETFILTER_ADVANCED=n
402 The NAT option allows masquerading, port forwarding and other
403 forms of full Network Address Port Translation. This can be
404 controlled by iptables, ip6tables or nft.
408 depends on NF_CONNTRACK && NF_NAT
409 default NF_NAT && NF_CONNTRACK_AMANDA
413 depends on NF_CONNTRACK && NF_NAT
414 default NF_NAT && NF_CONNTRACK_FTP
418 depends on NF_CONNTRACK && NF_NAT
419 default NF_NAT && NF_CONNTRACK_IRC
423 depends on NF_CONNTRACK && NF_NAT
424 default NF_NAT && NF_CONNTRACK_SIP
428 depends on NF_CONNTRACK && NF_NAT
429 default NF_NAT && NF_CONNTRACK_TFTP
431 config NF_NAT_REDIRECT
434 config NF_NAT_MASQUERADE
437 config NETFILTER_SYNPROXY
443 select NETFILTER_NETLINK
445 tristate "Netfilter nf_tables support"
447 nftables is the new packet classification framework that intends to
448 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
449 provides a pseudo-state machine with an extensible instruction-set
450 (also known as expressions) that the userspace 'nft' utility
451 (https://www.netfilter.org/projects/nftables) uses to build the
452 rule-set. It also comes with the generic set infrastructure that
453 allows you to construct mappings between matchings and actions
454 for performance lookups.
456 To compile it as a module, choose M here.
459 config NF_TABLES_INET
461 select NF_TABLES_IPV4
462 select NF_TABLES_IPV6
463 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
465 This option enables support for a mixed IPv4/IPv6 "inet" table.
467 config NF_TABLES_NETDEV
468 bool "Netfilter nf_tables netdev tables support"
470 This option enables support for the "netdev" table.
473 tristate "Netfilter nf_tables number generator module"
475 This option adds the number generator expression used to perform
476 incremental counting and random numbers bound to a upper limit.
479 depends on NF_CONNTRACK
480 tristate "Netfilter nf_tables conntrack module"
482 This option adds the "ct" expression that you can use to match
483 connection tracking information such as the flow state.
485 config NFT_FLOW_OFFLOAD
486 depends on NF_CONNTRACK && NF_FLOW_TABLE
487 tristate "Netfilter nf_tables hardware flow offload module"
489 This option adds the "flow_offload" expression that you can use to
490 choose what flows are placed into the hardware.
493 tristate "Netfilter nf_tables counter module"
495 This option adds the "counter" expression that you can use to
496 include packet and byte counters in a rule.
499 tristate "Netfilter nf_tables connlimit module"
500 depends on NF_CONNTRACK
501 depends on NETFILTER_ADVANCED
502 select NETFILTER_CONNCOUNT
504 This option adds the "connlimit" expression that you can use to
505 ratelimit rule matchings per connections.
508 tristate "Netfilter nf_tables log module"
510 This option adds the "log" expression that you can use to log
511 packets matching some criteria.
514 tristate "Netfilter nf_tables limit module"
516 This option adds the "limit" expression that you can use to
517 ratelimit rule matchings.
520 depends on NF_CONNTRACK
522 select NF_NAT_MASQUERADE
523 tristate "Netfilter nf_tables masquerade support"
525 This option adds the "masquerade" expression that you can use
526 to perform NAT in the masquerade flavour.
529 depends on NF_CONNTRACK
531 tristate "Netfilter nf_tables redirect support"
532 select NF_NAT_REDIRECT
534 This options adds the "redirect" expression that you can use
535 to perform NAT in the redirect flavour.
538 depends on NF_CONNTRACK
540 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
541 tristate "Netfilter nf_tables nat module"
543 This option adds the "nat" expression that you can use to perform
544 typical Network Address Translation (NAT) packet transformations.
547 tristate "Netfilter nf_tables tunnel module"
549 This option adds the "tunnel" expression that you can use to set
553 tristate "Netfilter nf_tables stateful object reference module"
555 This option adds the "objref" expression that allows you to refer to
556 stateful objects, such as counters and quotas.
559 depends on NETFILTER_NETLINK_QUEUE
560 tristate "Netfilter nf_tables queue module"
562 This is required if you intend to use the userspace queueing
563 infrastructure (also known as NFQUEUE) from nftables.
566 tristate "Netfilter nf_tables quota module"
568 This option adds the "quota" expression that you can use to match
569 enforce bytes quotas.
572 default m if NETFILTER_ADVANCED=n
573 tristate "Netfilter nf_tables reject support"
574 depends on !NF_TABLES_INET || (IPV6!=m || m)
576 This option adds the "reject" expression that you can use to
577 explicitly deny and notify via TCP reset/ICMP informational errors
580 config NFT_REJECT_INET
581 depends on NF_TABLES_INET
586 depends on NETFILTER_XTABLES
587 tristate "Netfilter x_tables over nf_tables module"
589 This is required if you intend to use any of existing
590 x_tables match/target extensions over the nf_tables
594 tristate "Netfilter nf_tables hash module"
596 This option adds the "hash" expression that you can use to perform
597 a hash operation on registers.
603 depends on NF_TABLES_INET
604 depends on NFT_FIB_IPV4
605 depends on NFT_FIB_IPV6
606 tristate "Netfilter nf_tables fib inet support"
608 This option allows using the FIB expression from the inet table.
609 The lookup will be delegated to the IPv4 or IPv6 FIB depending
610 on the protocol of the packet.
613 tristate "Netfilter nf_tables xfrm/IPSec security association matching"
616 This option adds an expression that you can use to extract properties
617 of a packets security association.
620 tristate "Netfilter nf_tables socket match support"
621 depends on IPV6 || IPV6=n
622 select NF_SOCKET_IPV4
623 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
625 This option allows matching for the presence or absence of a
626 corresponding socket and its attributes.
629 tristate "Netfilter nf_tables passive OS fingerprint support"
630 depends on NETFILTER_ADVANCED
631 select NETFILTER_NETLINK_OSF
633 This option allows matching packets from an specific OS.
636 tristate "Netfilter nf_tables tproxy support"
637 depends on IPV6 || IPV6=n
638 select NF_DEFRAG_IPV4
639 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
640 select NF_TPROXY_IPV4
641 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
643 This makes transparent proxy support available in nftables.
646 tristate "Netfilter nf_tables SYNPROXY expression support"
647 depends on NF_CONNTRACK && NETFILTER_ADVANCED
648 select NETFILTER_SYNPROXY
651 The SYNPROXY expression allows you to intercept TCP connections and
652 establish them using syncookies before they are passed on to the
653 server. This allows to avoid conntrack and server resource usage
654 during SYN-flood attacks.
659 tristate "Netfilter packet duplication support"
661 This option enables the generic packet duplication infrastructure
664 config NFT_DUP_NETDEV
665 tristate "Netfilter nf_tables netdev packet duplication support"
668 This option enables packet duplication for the "netdev" family.
670 config NFT_FWD_NETDEV
671 tristate "Netfilter nf_tables netdev packet forwarding support"
674 This option enables packet forwarding for the "netdev" family.
676 config NFT_FIB_NETDEV
677 depends on NFT_FIB_IPV4
678 depends on NFT_FIB_IPV6
679 tristate "Netfilter nf_tables netdev fib lookups support"
681 This option allows using the FIB expression from the netdev table.
682 The lookup will be delegated to the IPv4 or IPv6 FIB depending
683 on the protocol of the packet.
685 endif # NF_TABLES_NETDEV
689 config NF_FLOW_TABLE_INET
690 tristate "Netfilter flow table mixed IPv4/IPv6 module"
691 depends on NF_FLOW_TABLE
693 This option adds the flow table mixed IPv4/IPv6 support.
695 To compile it as a module, choose M here.
698 tristate "Netfilter flow table module"
699 depends on NETFILTER_INGRESS
700 depends on NF_CONNTRACK
703 This option adds the flow table core infrastructure.
705 To compile it as a module, choose M here.
707 config NETFILTER_XTABLES
708 tristate "Netfilter Xtables support (required for ip_tables)"
709 default m if NETFILTER_ADVANCED=n
711 This is required if you intend to use any of ip_tables,
712 ip6_tables or arp_tables.
716 comment "Xtables combined modules"
718 config NETFILTER_XT_MARK
719 tristate 'nfmark target and match support'
720 default m if NETFILTER_ADVANCED=n
722 This option adds the "MARK" target and "mark" match.
724 Netfilter mark matching allows you to match packets based on the
725 "nfmark" value in the packet.
726 The target allows you to create rules in the "mangle" table which alter
727 the netfilter mark (nfmark) field associated with the packet.
729 Prior to routing, the nfmark can influence the routing method and can
730 also be used by other subsystems to change their behavior.
732 config NETFILTER_XT_CONNMARK
733 tristate 'ctmark target and match support'
734 depends on NF_CONNTRACK
735 depends on NETFILTER_ADVANCED
736 select NF_CONNTRACK_MARK
738 This option adds the "CONNMARK" target and "connmark" match.
740 Netfilter allows you to store a mark value per connection (a.k.a.
741 ctmark), similarly to the packet mark (nfmark). Using this
742 target and match, you can set and match on this mark.
744 config NETFILTER_XT_SET
745 tristate 'set target and match support'
747 depends on NETFILTER_ADVANCED
749 This option adds the "SET" target and "set" match.
751 Using this target and match, you can add/delete and match
752 elements in the sets created by ipset(8).
754 To compile it as a module, choose M here. If unsure, say N.
756 # alphabetically ordered list of targets
758 comment "Xtables targets"
760 config NETFILTER_XT_TARGET_AUDIT
761 tristate "AUDIT target support"
763 depends on NETFILTER_ADVANCED
765 This option adds a 'AUDIT' target, which can be used to create
766 audit records for packets dropped/accepted.
768 To compileit as a module, choose M here. If unsure, say N.
770 config NETFILTER_XT_TARGET_CHECKSUM
771 tristate "CHECKSUM target support"
772 depends on IP_NF_MANGLE || IP6_NF_MANGLE
773 depends on NETFILTER_ADVANCED
775 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
776 table to work around buggy DHCP clients in virtualized environments.
778 Some old DHCP clients drop packets because they are not aware
779 that the checksum would normally be offloaded to hardware and
780 thus should be considered valid.
781 This target can be used to fill in the checksum using iptables
782 when such packets are sent via a virtual network device.
784 To compile it as a module, choose M here. If unsure, say N.
786 config NETFILTER_XT_TARGET_CLASSIFY
787 tristate '"CLASSIFY" target support'
788 depends on NETFILTER_ADVANCED
790 This option adds a `CLASSIFY' target, which enables the user to set
791 the priority of a packet. Some qdiscs can use this value for
792 classification, among these are:
794 atm, cbq, dsmark, pfifo_fast, htb, prio
796 To compile it as a module, choose M here. If unsure, say N.
798 config NETFILTER_XT_TARGET_CONNMARK
799 tristate '"CONNMARK" target support'
800 depends on NF_CONNTRACK
801 depends on NETFILTER_ADVANCED
802 select NETFILTER_XT_CONNMARK
804 This is a backwards-compat option for the user's convenience
805 (e.g. when running oldconfig). It selects
806 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
808 config NETFILTER_XT_TARGET_CONNSECMARK
809 tristate '"CONNSECMARK" target support'
810 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
811 default m if NETFILTER_ADVANCED=n
813 The CONNSECMARK target copies security markings from packets
814 to connections, and restores security markings from connections
815 to packets (if the packets are not already marked). This would
816 normally be used in conjunction with the SECMARK target.
818 To compile it as a module, choose M here. If unsure, say N.
820 config NETFILTER_XT_TARGET_CT
821 tristate '"CT" target support'
822 depends on NF_CONNTRACK
823 depends on IP_NF_RAW || IP6_NF_RAW
824 depends on NETFILTER_ADVANCED
826 This options adds a `CT' target, which allows to specify initial
827 connection tracking parameters like events to be delivered and
828 the helper to be used.
830 To compile it as a module, choose M here. If unsure, say N.
832 config NETFILTER_XT_TARGET_DSCP
833 tristate '"DSCP" and "TOS" target support'
834 depends on IP_NF_MANGLE || IP6_NF_MANGLE
835 depends on NETFILTER_ADVANCED
837 This option adds a `DSCP' target, which allows you to manipulate
838 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
840 The DSCP field can have any value between 0x0 and 0x3f inclusive.
842 It also adds the "TOS" target, which allows you to create rules in
843 the "mangle" table which alter the Type Of Service field of an IPv4
844 or the Priority field of an IPv6 packet, prior to routing.
846 To compile it as a module, choose M here. If unsure, say N.
848 config NETFILTER_XT_TARGET_HL
849 tristate '"HL" hoplimit target support'
850 depends on IP_NF_MANGLE || IP6_NF_MANGLE
851 depends on NETFILTER_ADVANCED
853 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
854 targets, which enable the user to change the
855 hoplimit/time-to-live value of the IP header.
857 While it is safe to decrement the hoplimit/TTL value, the
858 modules also allow to increment and set the hoplimit value of
859 the header to arbitrary values. This is EXTREMELY DANGEROUS
860 since you can easily create immortal packets that loop
861 forever on the network.
863 config NETFILTER_XT_TARGET_HMARK
864 tristate '"HMARK" target support'
865 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
866 depends on NETFILTER_ADVANCED
868 This option adds the "HMARK" target.
870 The target allows you to create rules in the "raw" and "mangle" tables
871 which set the skbuff mark by means of hash calculation within a given
872 range. The nfmark can influence the routing method and can also be used
873 by other subsystems to change their behaviour.
875 To compile it as a module, choose M here. If unsure, say N.
877 config NETFILTER_XT_TARGET_IDLETIMER
878 tristate "IDLETIMER target support"
879 depends on NETFILTER_ADVANCED
882 This option adds the `IDLETIMER' target. Each matching packet
883 resets the timer associated with label specified when the rule is
884 added. When the timer expires, it triggers a sysfs notification.
885 The remaining time for expiration can be read via sysfs.
887 To compile it as a module, choose M here. If unsure, say N.
889 config NETFILTER_XT_TARGET_LED
890 tristate '"LED" target support'
891 depends on LEDS_CLASS && LEDS_TRIGGERS
892 depends on NETFILTER_ADVANCED
894 This option adds a `LED' target, which allows you to blink LEDs in
895 response to particular packets passing through your machine.
897 This can be used to turn a spare LED into a network activity LED,
898 which only flashes in response to FTP transfers, for example. Or
899 you could have an LED which lights up for a minute or two every time
900 somebody connects to your machine via SSH.
902 You will need support for the "led" class to make this work.
904 To create an LED trigger for incoming SSH traffic:
905 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
907 Then attach the new trigger to an LED on your system:
908 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
910 For more information on the LEDs available on your system, see
911 Documentation/leds/leds-class.rst
913 config NETFILTER_XT_TARGET_LOG
914 tristate "LOG target support"
917 select NF_LOG_IPV6 if IP6_NF_IPTABLES
918 default m if NETFILTER_ADVANCED=n
920 This option adds a `LOG' target, which allows you to create rules in
921 any iptables table which records the packet header to the syslog.
923 To compile it as a module, choose M here. If unsure, say N.
925 config NETFILTER_XT_TARGET_MARK
926 tristate '"MARK" target support'
927 depends on NETFILTER_ADVANCED
928 select NETFILTER_XT_MARK
930 This is a backwards-compat option for the user's convenience
931 (e.g. when running oldconfig). It selects
932 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
934 config NETFILTER_XT_NAT
935 tristate '"SNAT and DNAT" targets support'
938 This option enables the SNAT and DNAT targets.
940 To compile it as a module, choose M here. If unsure, say N.
942 config NETFILTER_XT_TARGET_NETMAP
943 tristate '"NETMAP" target support'
946 NETMAP is an implementation of static 1:1 NAT mapping of network
947 addresses. It maps the network address part, while keeping the host
950 To compile it as a module, choose M here. If unsure, say N.
952 config NETFILTER_XT_TARGET_NFLOG
953 tristate '"NFLOG" target support'
954 default m if NETFILTER_ADVANCED=n
955 select NETFILTER_NETLINK_LOG
957 This option enables the NFLOG target, which allows to LOG
958 messages through nfnetlink_log.
960 To compile it as a module, choose M here. If unsure, say N.
962 config NETFILTER_XT_TARGET_NFQUEUE
963 tristate '"NFQUEUE" target Support'
964 depends on NETFILTER_ADVANCED
965 select NETFILTER_NETLINK_QUEUE
967 This target replaced the old obsolete QUEUE target.
969 As opposed to QUEUE, it supports 65535 different queues,
972 To compile it as a module, choose M here. If unsure, say N.
974 config NETFILTER_XT_TARGET_NOTRACK
975 tristate '"NOTRACK" target support (DEPRECATED)'
976 depends on NF_CONNTRACK
977 depends on IP_NF_RAW || IP6_NF_RAW
978 depends on NETFILTER_ADVANCED
979 select NETFILTER_XT_TARGET_CT
981 config NETFILTER_XT_TARGET_RATEEST
982 tristate '"RATEEST" target support'
983 depends on NETFILTER_ADVANCED
985 This option adds a `RATEEST' target, which allows to measure
986 rates similar to TC estimators. The `rateest' match can be
987 used to match on the measured rates.
989 To compile it as a module, choose M here. If unsure, say N.
991 config NETFILTER_XT_TARGET_REDIRECT
992 tristate "REDIRECT target support"
994 select NF_NAT_REDIRECT
996 REDIRECT is a special case of NAT: all incoming connections are
997 mapped onto the incoming interface's address, causing the packets to
998 come to the local machine instead of passing through. This is
999 useful for transparent proxies.
1001 To compile it as a module, choose M here. If unsure, say N.
1003 config NETFILTER_XT_TARGET_MASQUERADE
1004 tristate "MASQUERADE target support"
1006 default m if NETFILTER_ADVANCED=n
1007 select NF_NAT_MASQUERADE
1009 Masquerading is a special case of NAT: all outgoing connections are
1010 changed to seem to come from a particular interface's address, and
1011 if the interface goes down, those connections are lost. This is
1012 only useful for dialup accounts with dynamic IP address (ie. your IP
1013 address will be different on next dialup).
1015 To compile it as a module, choose M here. If unsure, say N.
1017 config NETFILTER_XT_TARGET_TEE
1018 tristate '"TEE" - packet cloning to alternate destination'
1019 depends on NETFILTER_ADVANCED
1020 depends on IPV6 || IPV6=n
1021 depends on !NF_CONNTRACK || NF_CONNTRACK
1022 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1024 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1026 This option adds a "TEE" target with which a packet can be cloned and
1027 this clone be rerouted to another nexthop.
1029 config NETFILTER_XT_TARGET_TPROXY
1030 tristate '"TPROXY" target transparent proxying support'
1031 depends on NETFILTER_XTABLES
1032 depends on NETFILTER_ADVANCED
1033 depends on IPV6 || IPV6=n
1034 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1035 depends on IP_NF_MANGLE
1036 select NF_DEFRAG_IPV4
1037 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1038 select NF_TPROXY_IPV4
1039 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1041 This option adds a `TPROXY' target, which is somewhat similar to
1042 REDIRECT. It can only be used in the mangle table and is useful
1043 to redirect traffic to a transparent proxy. It does _not_ depend
1044 on Netfilter connection tracking and NAT, unlike REDIRECT.
1045 For it to work you will have to configure certain iptables rules
1046 and use policy routing. For more information on how to set it up
1047 see Documentation/networking/tproxy.rst.
1049 To compile it as a module, choose M here. If unsure, say N.
1051 config NETFILTER_XT_TARGET_TRACE
1052 tristate '"TRACE" target support'
1053 depends on IP_NF_RAW || IP6_NF_RAW
1054 depends on NETFILTER_ADVANCED
1056 The TRACE target allows you to mark packets so that the kernel
1057 will log every rule which match the packets as those traverse
1058 the tables, chains, rules.
1060 If you want to compile it as a module, say M here and read
1061 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1063 config NETFILTER_XT_TARGET_SECMARK
1064 tristate '"SECMARK" target support'
1065 depends on NETWORK_SECMARK
1066 default m if NETFILTER_ADVANCED=n
1068 The SECMARK target allows security marking of network
1069 packets, for use with security subsystems.
1071 To compile it as a module, choose M here. If unsure, say N.
1073 config NETFILTER_XT_TARGET_TCPMSS
1074 tristate '"TCPMSS" target support'
1075 depends on IPV6 || IPV6=n
1076 default m if NETFILTER_ADVANCED=n
1078 This option adds a `TCPMSS' target, which allows you to alter the
1079 MSS value of TCP SYN packets, to control the maximum size for that
1080 connection (usually limiting it to your outgoing interface's MTU
1083 This is used to overcome criminally braindead ISPs or servers which
1084 block ICMP Fragmentation Needed packets. The symptoms of this
1085 problem are that everything works fine from your Linux
1086 firewall/router, but machines behind it can never exchange large
1088 1) Web browsers connect, then hang with no data received.
1089 2) Small mail works fine, but large emails hang.
1090 3) ssh works fine, but scp hangs after initial handshaking.
1092 Workaround: activate this option and add a rule to your firewall
1095 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1096 -j TCPMSS --clamp-mss-to-pmtu
1098 To compile it as a module, choose M here. If unsure, say N.
1100 config NETFILTER_XT_TARGET_TCPOPTSTRIP
1101 tristate '"TCPOPTSTRIP" target support'
1102 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1103 depends on NETFILTER_ADVANCED
1105 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1106 TCP options from TCP packets.
1108 # alphabetically ordered list of matches
1110 comment "Xtables matches"
1112 config NETFILTER_XT_MATCH_ADDRTYPE
1113 tristate '"addrtype" address type match support'
1114 default m if NETFILTER_ADVANCED=n
1116 This option allows you to match what routing thinks of an address,
1117 eg. UNICAST, LOCAL, BROADCAST, ...
1119 If you want to compile it as a module, say M here and read
1120 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1122 config NETFILTER_XT_MATCH_BPF
1123 tristate '"bpf" match support'
1124 depends on NETFILTER_ADVANCED
1126 BPF matching applies a linux socket filter to each packet and
1127 accepts those for which the filter returns non-zero.
1129 To compile it as a module, choose M here. If unsure, say N.
1131 config NETFILTER_XT_MATCH_CGROUP
1132 tristate '"control group" match support'
1133 depends on NETFILTER_ADVANCED
1135 select CGROUP_NET_CLASSID
1137 Socket/process control group matching allows you to match locally
1138 generated packets based on which net_cls control group processes
1141 config NETFILTER_XT_MATCH_CLUSTER
1142 tristate '"cluster" match support'
1143 depends on NF_CONNTRACK
1144 depends on NETFILTER_ADVANCED
1146 This option allows you to build work-load-sharing clusters of
1147 network servers/stateful firewalls without having a dedicated
1148 load-balancing router/server/switch. Basically, this match returns
1149 true when the packet must be handled by this cluster node. Thus,
1150 all nodes see all packets and this match decides which node handles
1151 what packets. The work-load sharing algorithm is based on source
1154 If you say Y or M here, try `iptables -m cluster --help` for
1157 config NETFILTER_XT_MATCH_COMMENT
1158 tristate '"comment" match support'
1159 depends on NETFILTER_ADVANCED
1161 This option adds a `comment' dummy-match, which allows you to put
1162 comments in your iptables ruleset.
1164 If you want to compile it as a module, say M here and read
1165 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1167 config NETFILTER_XT_MATCH_CONNBYTES
1168 tristate '"connbytes" per-connection counter match support'
1169 depends on NF_CONNTRACK
1170 depends on NETFILTER_ADVANCED
1172 This option adds a `connbytes' match, which allows you to match the
1173 number of bytes and/or packets for each direction within a connection.
1175 If you want to compile it as a module, say M here and read
1176 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1178 config NETFILTER_XT_MATCH_CONNLABEL
1179 tristate '"connlabel" match support'
1180 select NF_CONNTRACK_LABELS
1181 depends on NF_CONNTRACK
1182 depends on NETFILTER_ADVANCED
1184 This match allows you to test and assign userspace-defined labels names
1185 to a connection. The kernel only stores bit values - mapping
1186 names to bits is done by userspace.
1188 Unlike connmark, more than 32 flag bits may be assigned to a
1189 connection simultaneously.
1191 config NETFILTER_XT_MATCH_CONNLIMIT
1192 tristate '"connlimit" match support'
1193 depends on NF_CONNTRACK
1194 depends on NETFILTER_ADVANCED
1195 select NETFILTER_CONNCOUNT
1197 This match allows you to match against the number of parallel
1198 connections to a server per client IP address (or address block).
1200 config NETFILTER_XT_MATCH_CONNMARK
1201 tristate '"connmark" connection mark match support'
1202 depends on NF_CONNTRACK
1203 depends on NETFILTER_ADVANCED
1204 select NETFILTER_XT_CONNMARK
1206 This is a backwards-compat option for the user's convenience
1207 (e.g. when running oldconfig). It selects
1208 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1210 config NETFILTER_XT_MATCH_CONNTRACK
1211 tristate '"conntrack" connection tracking match support'
1212 depends on NF_CONNTRACK
1213 default m if NETFILTER_ADVANCED=n
1215 This is a general conntrack match module, a superset of the state match.
1217 It allows matching on additional conntrack information, which is
1218 useful in complex configurations, such as NAT gateways with multiple
1219 internet links or tunnels.
1221 To compile it as a module, choose M here. If unsure, say N.
1223 config NETFILTER_XT_MATCH_CPU
1224 tristate '"cpu" match support'
1225 depends on NETFILTER_ADVANCED
1227 CPU matching allows you to match packets based on the CPU
1228 currently handling the packet.
1230 To compile it as a module, choose M here. If unsure, say N.
1232 config NETFILTER_XT_MATCH_DCCP
1233 tristate '"dccp" protocol match support'
1234 depends on NETFILTER_ADVANCED
1237 With this option enabled, you will be able to use the iptables
1238 `dccp' match in order to match on DCCP source/destination ports
1241 If you want to compile it as a module, say M here and read
1242 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1244 config NETFILTER_XT_MATCH_DEVGROUP
1245 tristate '"devgroup" match support'
1246 depends on NETFILTER_ADVANCED
1248 This options adds a `devgroup' match, which allows to match on the
1249 device group a network device is assigned to.
1251 To compile it as a module, choose M here. If unsure, say N.
1253 config NETFILTER_XT_MATCH_DSCP
1254 tristate '"dscp" and "tos" match support'
1255 depends on NETFILTER_ADVANCED
1257 This option adds a `DSCP' match, which allows you to match against
1258 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1260 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1262 It will also add a "tos" match, which allows you to match packets
1263 based on the Type Of Service fields of the IPv4 packet (which share
1264 the same bits as DSCP).
1266 To compile it as a module, choose M here. If unsure, say N.
1268 config NETFILTER_XT_MATCH_ECN
1269 tristate '"ecn" match support'
1270 depends on NETFILTER_ADVANCED
1272 This option adds an "ECN" match, which allows you to match against
1273 the IPv4 and TCP header ECN fields.
1275 To compile it as a module, choose M here. If unsure, say N.
1277 config NETFILTER_XT_MATCH_ESP
1278 tristate '"esp" match support'
1279 depends on NETFILTER_ADVANCED
1281 This match extension allows you to match a range of SPIs
1282 inside ESP header of IPSec packets.
1284 To compile it as a module, choose M here. If unsure, say N.
1286 config NETFILTER_XT_MATCH_HASHLIMIT
1287 tristate '"hashlimit" match support'
1288 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1289 depends on NETFILTER_ADVANCED
1291 This option adds a `hashlimit' match.
1293 As opposed to `limit', this match dynamically creates a hash table
1294 of limit buckets, based on your selection of source/destination
1295 addresses and/or ports.
1297 It enables you to express policies like `10kpps for any given
1298 destination address' or `500pps from any given source address'
1301 config NETFILTER_XT_MATCH_HELPER
1302 tristate '"helper" match support'
1303 depends on NF_CONNTRACK
1304 depends on NETFILTER_ADVANCED
1306 Helper matching allows you to match packets in dynamic connections
1307 tracked by a conntrack-helper, ie. nf_conntrack_ftp
1309 To compile it as a module, choose M here. If unsure, say Y.
1311 config NETFILTER_XT_MATCH_HL
1312 tristate '"hl" hoplimit/TTL match support'
1313 depends on NETFILTER_ADVANCED
1315 HL matching allows you to match packets based on the hoplimit
1316 in the IPv6 header, or the time-to-live field in the IPv4
1317 header of the packet.
1319 config NETFILTER_XT_MATCH_IPCOMP
1320 tristate '"ipcomp" match support'
1321 depends on NETFILTER_ADVANCED
1323 This match extension allows you to match a range of CPIs(16 bits)
1324 inside IPComp header of IPSec packets.
1326 To compile it as a module, choose M here. If unsure, say N.
1328 config NETFILTER_XT_MATCH_IPRANGE
1329 tristate '"iprange" address range match support'
1330 depends on NETFILTER_ADVANCED
1332 This option adds a "iprange" match, which allows you to match based on
1333 an IP address range. (Normal iptables only matches on single addresses
1334 with an optional mask.)
1338 config NETFILTER_XT_MATCH_IPVS
1339 tristate '"ipvs" match support'
1341 depends on NETFILTER_ADVANCED
1342 depends on NF_CONNTRACK
1344 This option allows you to match against IPVS properties of a packet.
1348 config NETFILTER_XT_MATCH_L2TP
1349 tristate '"l2tp" match support'
1350 depends on NETFILTER_ADVANCED
1353 This option adds an "L2TP" match, which allows you to match against
1354 L2TP protocol header fields.
1356 To compile it as a module, choose M here. If unsure, say N.
1358 config NETFILTER_XT_MATCH_LENGTH
1359 tristate '"length" match support'
1360 depends on NETFILTER_ADVANCED
1362 This option allows you to match the length of a packet against a
1363 specific value or range of values.
1365 To compile it as a module, choose M here. If unsure, say N.
1367 config NETFILTER_XT_MATCH_LIMIT
1368 tristate '"limit" match support'
1369 depends on NETFILTER_ADVANCED
1371 limit matching allows you to control the rate at which a rule can be
1372 matched: mainly useful in combination with the LOG target ("LOG
1373 target support", below) and to avoid some Denial of Service attacks.
1375 To compile it as a module, choose M here. If unsure, say N.
1377 config NETFILTER_XT_MATCH_MAC
1378 tristate '"mac" address match support'
1379 depends on NETFILTER_ADVANCED
1381 MAC matching allows you to match packets based on the source
1382 Ethernet address of the packet.
1384 To compile it as a module, choose M here. If unsure, say N.
1386 config NETFILTER_XT_MATCH_MARK
1387 tristate '"mark" match support'
1388 depends on NETFILTER_ADVANCED
1389 select NETFILTER_XT_MARK
1391 This is a backwards-compat option for the user's convenience
1392 (e.g. when running oldconfig). It selects
1393 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1395 config NETFILTER_XT_MATCH_MULTIPORT
1396 tristate '"multiport" Multiple port match support'
1397 depends on NETFILTER_ADVANCED
1399 Multiport matching allows you to match TCP or UDP packets based on
1400 a series of source or destination ports: normally a rule can only
1401 match a single range of ports.
1403 To compile it as a module, choose M here. If unsure, say N.
1405 config NETFILTER_XT_MATCH_NFACCT
1406 tristate '"nfacct" match support'
1407 depends on NETFILTER_ADVANCED
1408 select NETFILTER_NETLINK_ACCT
1410 This option allows you to use the extended accounting through
1413 To compile it as a module, choose M here. If unsure, say N.
1415 config NETFILTER_XT_MATCH_OSF
1416 tristate '"osf" Passive OS fingerprint match'
1417 depends on NETFILTER_ADVANCED
1418 select NETFILTER_NETLINK_OSF
1420 This option selects the Passive OS Fingerprinting match module
1421 that allows to passively match the remote operating system by
1422 analyzing incoming TCP SYN packets.
1424 Rules and loading software can be downloaded from
1425 http://www.ioremap.net/projects/osf
1427 To compile it as a module, choose M here. If unsure, say N.
1429 config NETFILTER_XT_MATCH_OWNER
1430 tristate '"owner" match support'
1431 depends on NETFILTER_ADVANCED
1433 Socket owner matching allows you to match locally-generated packets
1434 based on who created the socket: the user or group. It is also
1435 possible to check whether a socket actually exists.
1437 config NETFILTER_XT_MATCH_POLICY
1438 tristate 'IPsec "policy" match support'
1440 default m if NETFILTER_ADVANCED=n
1442 Policy matching allows you to match packets based on the
1443 IPsec policy that was used during decapsulation/will
1444 be used during encapsulation.
1446 To compile it as a module, choose M here. If unsure, say N.
1448 config NETFILTER_XT_MATCH_PHYSDEV
1449 tristate '"physdev" match support'
1450 depends on BRIDGE && BRIDGE_NETFILTER
1451 depends on NETFILTER_ADVANCED
1453 Physdev packet matching matches against the physical bridge ports
1454 the IP packet arrived on or will leave by.
1456 To compile it as a module, choose M here. If unsure, say N.
1458 config NETFILTER_XT_MATCH_PKTTYPE
1459 tristate '"pkttype" packet type match support'
1460 depends on NETFILTER_ADVANCED
1462 Packet type matching allows you to match a packet by
1463 its "class", eg. BROADCAST, MULTICAST, ...
1466 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1468 To compile it as a module, choose M here. If unsure, say N.
1470 config NETFILTER_XT_MATCH_QUOTA
1471 tristate '"quota" match support'
1472 depends on NETFILTER_ADVANCED
1474 This option adds a `quota' match, which allows to match on a
1477 If you want to compile it as a module, say M here and read
1478 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1480 config NETFILTER_XT_MATCH_RATEEST
1481 tristate '"rateest" match support'
1482 depends on NETFILTER_ADVANCED
1483 select NETFILTER_XT_TARGET_RATEEST
1485 This option adds a `rateest' match, which allows to match on the
1486 rate estimated by the RATEEST target.
1488 To compile it as a module, choose M here. If unsure, say N.
1490 config NETFILTER_XT_MATCH_REALM
1491 tristate '"realm" match support'
1492 depends on NETFILTER_ADVANCED
1493 select IP_ROUTE_CLASSID
1495 This option adds a `realm' match, which allows you to use the realm
1496 key from the routing subsystem inside iptables.
1498 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1501 If you want to compile it as a module, say M here and read
1502 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1504 config NETFILTER_XT_MATCH_RECENT
1505 tristate '"recent" match support'
1506 depends on NETFILTER_ADVANCED
1508 This match is used for creating one or many lists of recently
1509 used addresses and then matching against that/those list(s).
1511 Short options are available by using 'iptables -m recent -h'
1512 Official Website: <http://snowman.net/projects/ipt_recent/>
1514 config NETFILTER_XT_MATCH_SCTP
1515 tristate '"sctp" protocol match support'
1516 depends on NETFILTER_ADVANCED
1519 With this option enabled, you will be able to use the
1520 `sctp' match in order to match on SCTP source/destination ports
1521 and SCTP chunk types.
1523 If you want to compile it as a module, say M here and read
1524 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1526 config NETFILTER_XT_MATCH_SOCKET
1527 tristate '"socket" match support'
1528 depends on NETFILTER_XTABLES
1529 depends on NETFILTER_ADVANCED
1530 depends on IPV6 || IPV6=n
1531 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1532 select NF_SOCKET_IPV4
1533 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1534 select NF_DEFRAG_IPV4
1535 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1537 This option adds a `socket' match, which can be used to match
1538 packets for which a TCP or UDP socket lookup finds a valid socket.
1539 It can be used in combination with the MARK target and policy
1540 routing to implement full featured non-locally bound sockets.
1542 To compile it as a module, choose M here. If unsure, say N.
1544 config NETFILTER_XT_MATCH_STATE
1545 tristate '"state" match support'
1546 depends on NF_CONNTRACK
1547 default m if NETFILTER_ADVANCED=n
1549 Connection state matching allows you to match packets based on their
1550 relationship to a tracked connection (ie. previous packets). This
1551 is a powerful tool for packet classification.
1553 To compile it as a module, choose M here. If unsure, say N.
1555 config NETFILTER_XT_MATCH_STATISTIC
1556 tristate '"statistic" match support'
1557 depends on NETFILTER_ADVANCED
1559 This option adds a `statistic' match, which allows you to match
1560 on packets periodically or randomly with a given percentage.
1562 To compile it as a module, choose M here. If unsure, say N.
1564 config NETFILTER_XT_MATCH_STRING
1565 tristate '"string" match support'
1566 depends on NETFILTER_ADVANCED
1568 select TEXTSEARCH_KMP
1569 select TEXTSEARCH_BM
1570 select TEXTSEARCH_FSM
1572 This option adds a `string' match, which allows you to look for
1573 pattern matchings in packets.
1575 To compile it as a module, choose M here. If unsure, say N.
1577 config NETFILTER_XT_MATCH_TCPMSS
1578 tristate '"tcpmss" match support'
1579 depends on NETFILTER_ADVANCED
1581 This option adds a `tcpmss' match, which allows you to examine the
1582 MSS value of TCP SYN packets, which control the maximum packet size
1583 for that connection.
1585 To compile it as a module, choose M here. If unsure, say N.
1587 config NETFILTER_XT_MATCH_TIME
1588 tristate '"time" match support'
1589 depends on NETFILTER_ADVANCED
1591 This option adds a "time" match, which allows you to match based on
1592 the packet arrival time (at the machine which netfilter is running)
1593 on) or departure time/date (for locally generated packets).
1595 If you say Y here, try `iptables -m time --help` for
1598 If you want to compile it as a module, say M here.
1601 config NETFILTER_XT_MATCH_U32
1602 tristate '"u32" match support'
1603 depends on NETFILTER_ADVANCED
1605 u32 allows you to extract quantities of up to 4 bytes from a packet,
1606 AND them with specified masks, shift them by specified amounts and
1607 test whether the results are in any of a set of specified ranges.
1608 The specification of what to extract is general enough to skip over
1609 headers with lengths stored in the packet, as in IP or TCP header
1612 Details and examples are in the kernel module source.
1614 endif # NETFILTER_XTABLES
1618 source "net/netfilter/ipset/Kconfig"
1620 source "net/netfilter/ipvs/Kconfig"