1 # SPDX-License-Identifier: GPL-2.0-only
2 menu "Core Netfilter Configuration"
3 depends on INET && NETFILTER
5 config NETFILTER_INGRESS
6 bool "Netfilter ingress support"
10 This allows you to classify packets from ingress using the Netfilter
13 config NETFILTER_NETLINK
16 config NETFILTER_FAMILY_BRIDGE
19 config NETFILTER_FAMILY_ARP
22 config NETFILTER_NETLINK_ACCT
23 tristate "Netfilter NFACCT over NFNETLINK interface"
24 depends on NETFILTER_ADVANCED
25 select NETFILTER_NETLINK
27 If this option is enabled, the kernel will include support
28 for extended accounting via NFNETLINK.
30 config NETFILTER_NETLINK_QUEUE
31 tristate "Netfilter NFQUEUE over NFNETLINK interface"
32 depends on NETFILTER_ADVANCED
33 select NETFILTER_NETLINK
35 If this option is enabled, the kernel will include support
36 for queueing packets via NFNETLINK.
38 config NETFILTER_NETLINK_LOG
39 tristate "Netfilter LOG over NFNETLINK interface"
40 default m if NETFILTER_ADVANCED=n
41 select NETFILTER_NETLINK
43 If this option is enabled, the kernel will include support
44 for logging packets via NFNETLINK.
46 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
47 and is also scheduled to replace the old syslog-based ipt_LOG
50 config NETFILTER_NETLINK_OSF
51 tristate "Netfilter OSF over NFNETLINK interface"
52 depends on NETFILTER_ADVANCED
53 select NETFILTER_NETLINK
55 If this option is enabled, the kernel will include support
56 for passive OS fingerprint via NFNETLINK.
59 tristate "Netfilter connection tracking support"
60 default m if NETFILTER_ADVANCED=n
62 select NF_DEFRAG_IPV6 if IPV6 != n
64 Connection tracking keeps a record of what packets have passed
65 through your machine, in order to figure out how they are related
68 This is required to do Masquerading or other kinds of Network
69 Address Translation. It can also be used to enhance packet
70 filtering (see `Connection state match support' below).
72 To compile it as a module, choose M here. If unsure, say N.
75 tristate "Syslog packet logging"
76 default m if NETFILTER_ADVANCED=n
78 This option enable support for packet logging via syslog.
79 It supports IPv4, IPV6, ARP and common transport protocols such
81 This is a simpler but less flexible logging method compared to
82 CONFIG_NETFILTER_NETLINK_LOG.
83 If both are enabled the backend to use can be configured at run-time
84 by means of per-address-family sysctl tunables.
87 config NETFILTER_CONNCOUNT
90 config NF_CONNTRACK_MARK
91 bool 'Connection mark tracking support'
92 depends on NETFILTER_ADVANCED
94 This option enables support for connection marks, used by the
95 `CONNMARK' target and `connmark' match. Similar to the mark value
96 of packets, but this mark value is kept in the conntrack session
97 instead of the individual packets.
99 config NF_CONNTRACK_SECMARK
100 bool 'Connection tracking security mark support'
101 depends on NETWORK_SECMARK
102 default m if NETFILTER_ADVANCED=n
104 This option enables security markings to be applied to
105 connections. Typically they are copied to connections from
106 packets using the CONNSECMARK target and copied back from
107 connections to packets with the same target, with the packets
108 being originally labeled via SECMARK.
112 config NF_CONNTRACK_ZONES
113 bool 'Connection tracking zones'
114 depends on NETFILTER_ADVANCED
116 This option enables support for connection tracking zones.
117 Normally, each connection needs to have a unique system wide
118 identity. Connection tracking zones allow to have multiple
119 connections using the same identity, as long as they are
120 contained in different zones.
124 config NF_CONNTRACK_PROCFS
125 bool "Supply CT list in procfs (OBSOLETE)"
129 This option enables for the list of known conntrack entries
130 to be shown in procfs under net/netfilter/nf_conntrack. This
131 is considered obsolete in favor of using the conntrack(8)
132 tool which uses Netlink.
134 config NF_CONNTRACK_EVENTS
135 bool "Connection tracking events"
136 depends on NETFILTER_ADVANCED
138 If this option is enabled, the connection tracking code will
139 provide a notifier chain that can be used by other kernel code
140 to get notified about changes in the connection tracking state.
144 config NF_CONNTRACK_TIMEOUT
145 bool 'Connection tracking timeout'
146 depends on NETFILTER_ADVANCED
148 This option enables support for connection tracking timeout
149 extension. This allows you to attach timeout policies to flow
154 config NF_CONNTRACK_TIMESTAMP
155 bool 'Connection tracking timestamping'
156 depends on NETFILTER_ADVANCED
158 This option enables support for connection tracking timestamping.
159 This allows you to store the flow start-time and to obtain
160 the flow-stop time (once it has been destroyed) via Connection
165 config NF_CONNTRACK_LABELS
166 bool "Connection tracking labels"
168 This option enables support for assigning user-defined flag bits
169 to connection tracking entries. It can be used with xtables connlabel
170 match and the nftables ct expression.
172 config NF_CT_PROTO_DCCP
173 bool 'DCCP protocol connection tracking support'
174 depends on NETFILTER_ADVANCED
177 With this option enabled, the layer 3 independent connection
178 tracking code will be able to do state tracking on DCCP connections.
182 config NF_CT_PROTO_GRE
185 config NF_CT_PROTO_SCTP
186 bool 'SCTP protocol connection tracking support'
187 depends on NETFILTER_ADVANCED
191 With this option enabled, the layer 3 independent connection
192 tracking code will be able to do state tracking on SCTP connections.
196 config NF_CT_PROTO_UDPLITE
197 bool 'UDP-Lite protocol connection tracking support'
198 depends on NETFILTER_ADVANCED
201 With this option enabled, the layer 3 independent connection
202 tracking code will be able to do state tracking on UDP-Lite
207 config NF_CONNTRACK_AMANDA
208 tristate "Amanda backup protocol support"
209 depends on NETFILTER_ADVANCED
211 select TEXTSEARCH_KMP
213 If you are running the Amanda backup package <http://www.amanda.org/>
214 on this machine or machines that will be MASQUERADED through this
215 machine, then you may want to enable this feature. This allows the
216 connection tracking and natting code to allow the sub-channels that
217 Amanda requires for communication of the backup data, messages and
220 To compile it as a module, choose M here. If unsure, say N.
222 config NF_CONNTRACK_FTP
223 tristate "FTP protocol support"
224 default m if NETFILTER_ADVANCED=n
226 Tracking FTP connections is problematic: special helpers are
227 required for tracking them, and doing masquerading and other forms
228 of Network Address Translation on them.
230 This is FTP support on Layer 3 independent connection tracking.
232 To compile it as a module, choose M here. If unsure, say N.
234 config NF_CONNTRACK_H323
235 tristate "H.323 protocol support"
236 depends on IPV6 || IPV6=n
237 depends on NETFILTER_ADVANCED
239 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
240 important VoIP protocols, it is widely used by voice hardware and
241 software including voice gateways, IP phones, Netmeeting, OpenPhone,
244 With this module you can support H.323 on a connection tracking/NAT
247 This module supports RAS, Fast Start, H.245 Tunnelling, Call
248 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
249 whiteboard, file transfer, etc. For more information, please
250 visit http://nath323.sourceforge.net/.
252 To compile it as a module, choose M here. If unsure, say N.
254 config NF_CONNTRACK_IRC
255 tristate "IRC protocol support"
256 default m if NETFILTER_ADVANCED=n
258 There is a commonly-used extension to IRC called
259 Direct Client-to-Client Protocol (DCC). This enables users to send
260 files to each other, and also chat to each other without the need
261 of a server. DCC Sending is used anywhere you send files over IRC,
262 and DCC Chat is most commonly used by Eggdrop bots. If you are
263 using NAT, this extension will enable you to send files and initiate
264 chats. Note that you do NOT need this extension to get files or
265 have others initiate chats, or everything else in IRC.
267 To compile it as a module, choose M here. If unsure, say N.
269 config NF_CONNTRACK_BROADCAST
272 config NF_CONNTRACK_NETBIOS_NS
273 tristate "NetBIOS name service protocol support"
274 select NF_CONNTRACK_BROADCAST
276 NetBIOS name service requests are sent as broadcast messages from an
277 unprivileged port and responded to with unicast messages to the
278 same port. This make them hard to firewall properly because connection
279 tracking doesn't deal with broadcasts. This helper tracks locally
280 originating NetBIOS name service requests and the corresponding
281 responses. It relies on correct IP address configuration, specifically
282 netmask and broadcast address. When properly configured, the output
283 of "ip address show" should look similar to this:
285 $ ip -4 address show eth0
286 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
287 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
289 To compile it as a module, choose M here. If unsure, say N.
291 config NF_CONNTRACK_SNMP
292 tristate "SNMP service protocol support"
293 depends on NETFILTER_ADVANCED
294 select NF_CONNTRACK_BROADCAST
296 SNMP service requests are sent as broadcast messages from an
297 unprivileged port and responded to with unicast messages to the
298 same port. This make them hard to firewall properly because connection
299 tracking doesn't deal with broadcasts. This helper tracks locally
300 originating SNMP service requests and the corresponding
301 responses. It relies on correct IP address configuration, specifically
302 netmask and broadcast address.
304 To compile it as a module, choose M here. If unsure, say N.
306 config NF_CONNTRACK_PPTP
307 tristate "PPtP protocol support"
308 depends on NETFILTER_ADVANCED
309 select NF_CT_PROTO_GRE
311 This module adds support for PPTP (Point to Point Tunnelling
312 Protocol, RFC2637) connection tracking and NAT.
314 If you are running PPTP sessions over a stateful firewall or NAT
315 box, you may want to enable this feature.
317 Please note that not all PPTP modes of operation are supported yet.
318 Specifically these limitations exist:
319 - Blindly assumes that control connections are always established
320 in PNS->PAC direction. This is a violation of RFC2637.
321 - Only supports a single call within each session
323 To compile it as a module, choose M here. If unsure, say N.
325 config NF_CONNTRACK_SANE
326 tristate "SANE protocol support"
327 depends on NETFILTER_ADVANCED
329 SANE is a protocol for remote access to scanners as implemented
330 by the 'saned' daemon. Like FTP, it uses separate control and
333 With this module you can support SANE on a connection tracking
336 To compile it as a module, choose M here. If unsure, say N.
338 config NF_CONNTRACK_SIP
339 tristate "SIP protocol support"
340 default m if NETFILTER_ADVANCED=n
342 SIP is an application-layer control protocol that can establish,
343 modify, and terminate multimedia sessions (conferences) such as
344 Internet telephony calls. With the nf_conntrack_sip and
345 the nf_nat_sip modules you can support the protocol on a connection
346 tracking/NATing firewall.
348 To compile it as a module, choose M here. If unsure, say N.
350 config NF_CONNTRACK_TFTP
351 tristate "TFTP protocol support"
352 depends on NETFILTER_ADVANCED
354 TFTP connection tracking helper, this is required depending
355 on how restrictive your ruleset is.
356 If you are using a tftp client behind -j SNAT or -j MASQUERADING
359 To compile it as a module, choose M here. If unsure, say N.
362 tristate 'Connection tracking netlink interface'
363 select NETFILTER_NETLINK
364 default m if NETFILTER_ADVANCED=n
366 This option enables support for a netlink-based userspace interface
368 config NF_CT_NETLINK_TIMEOUT
369 tristate 'Connection tracking timeout tuning via Netlink'
370 select NETFILTER_NETLINK
371 depends on NETFILTER_ADVANCED
372 depends on NF_CONNTRACK_TIMEOUT
374 This option enables support for connection tracking timeout
375 fine-grain tuning. This allows you to attach specific timeout
376 policies to flows, instead of using the global timeout policy.
380 config NF_CT_NETLINK_HELPER
381 tristate 'Connection tracking helpers in user-space via Netlink'
382 select NETFILTER_NETLINK
383 depends on NF_CT_NETLINK
384 depends on NETFILTER_NETLINK_QUEUE
385 depends on NETFILTER_NETLINK_GLUE_CT
386 depends on NETFILTER_ADVANCED
388 This option enables the user-space connection tracking helpers
393 config NETFILTER_NETLINK_GLUE_CT
394 bool "NFQUEUE and NFLOG integration with Connection Tracking"
396 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
398 If this option is enabled, NFQUEUE and NFLOG can include
399 Connection Tracking information together with the packet is
400 the enqueued via NFNETLINK.
403 tristate "Network Address Translation support"
404 depends on NF_CONNTRACK
405 default m if NETFILTER_ADVANCED=n
407 The NAT option allows masquerading, port forwarding and other
408 forms of full Network Address Port Translation. This can be
409 controlled by iptables, ip6tables or nft.
413 depends on NF_CONNTRACK && NF_NAT
414 default NF_NAT && NF_CONNTRACK_AMANDA
418 depends on NF_CONNTRACK && NF_NAT
419 default NF_NAT && NF_CONNTRACK_FTP
423 depends on NF_CONNTRACK && NF_NAT
424 default NF_NAT && NF_CONNTRACK_IRC
428 depends on NF_CONNTRACK && NF_NAT
429 default NF_NAT && NF_CONNTRACK_SIP
433 depends on NF_CONNTRACK && NF_NAT
434 default NF_NAT && NF_CONNTRACK_TFTP
436 config NF_NAT_REDIRECT
439 config NF_NAT_MASQUERADE
442 config NETFILTER_SYNPROXY
448 select NETFILTER_NETLINK
450 tristate "Netfilter nf_tables support"
452 nftables is the new packet classification framework that intends to
453 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
454 provides a pseudo-state machine with an extensible instruction-set
455 (also known as expressions) that the userspace 'nft' utility
456 (https://www.netfilter.org/projects/nftables) uses to build the
457 rule-set. It also comes with the generic set infrastructure that
458 allows you to construct mappings between matchings and actions
459 for performance lookups.
461 To compile it as a module, choose M here.
464 config NF_TABLES_INET
466 select NF_TABLES_IPV4
467 select NF_TABLES_IPV6
468 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
470 This option enables support for a mixed IPv4/IPv6 "inet" table.
472 config NF_TABLES_NETDEV
473 bool "Netfilter nf_tables netdev tables support"
475 This option enables support for the "netdev" table.
478 tristate "Netfilter nf_tables number generator module"
480 This option adds the number generator expression used to perform
481 incremental counting and random numbers bound to a upper limit.
484 depends on NF_CONNTRACK
485 tristate "Netfilter nf_tables conntrack module"
487 This option adds the "ct" expression that you can use to match
488 connection tracking information such as the flow state.
490 config NFT_FLOW_OFFLOAD
491 depends on NF_CONNTRACK && NF_FLOW_TABLE
492 tristate "Netfilter nf_tables hardware flow offload module"
494 This option adds the "flow_offload" expression that you can use to
495 choose what flows are placed into the hardware.
498 tristate "Netfilter nf_tables counter module"
500 This option adds the "counter" expression that you can use to
501 include packet and byte counters in a rule.
504 tristate "Netfilter nf_tables connlimit module"
505 depends on NF_CONNTRACK
506 depends on NETFILTER_ADVANCED
507 select NETFILTER_CONNCOUNT
509 This option adds the "connlimit" expression that you can use to
510 ratelimit rule matchings per connections.
513 tristate "Netfilter nf_tables log module"
515 This option adds the "log" expression that you can use to log
516 packets matching some criteria.
519 tristate "Netfilter nf_tables limit module"
521 This option adds the "limit" expression that you can use to
522 ratelimit rule matchings.
525 depends on NF_CONNTRACK
527 select NF_NAT_MASQUERADE
528 tristate "Netfilter nf_tables masquerade support"
530 This option adds the "masquerade" expression that you can use
531 to perform NAT in the masquerade flavour.
534 depends on NF_CONNTRACK
536 tristate "Netfilter nf_tables redirect support"
537 select NF_NAT_REDIRECT
539 This options adds the "redirect" expression that you can use
540 to perform NAT in the redirect flavour.
543 depends on NF_CONNTRACK
545 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
546 tristate "Netfilter nf_tables nat module"
548 This option adds the "nat" expression that you can use to perform
549 typical Network Address Translation (NAT) packet transformations.
552 tristate "Netfilter nf_tables tunnel module"
554 This option adds the "tunnel" expression that you can use to set
558 tristate "Netfilter nf_tables stateful object reference module"
560 This option adds the "objref" expression that allows you to refer to
561 stateful objects, such as counters and quotas.
564 depends on NETFILTER_NETLINK_QUEUE
565 tristate "Netfilter nf_tables queue module"
567 This is required if you intend to use the userspace queueing
568 infrastructure (also known as NFQUEUE) from nftables.
571 tristate "Netfilter nf_tables quota module"
573 This option adds the "quota" expression that you can use to match
574 enforce bytes quotas.
577 default m if NETFILTER_ADVANCED=n
578 tristate "Netfilter nf_tables reject support"
579 depends on !NF_TABLES_INET || (IPV6!=m || m)
581 This option adds the "reject" expression that you can use to
582 explicitly deny and notify via TCP reset/ICMP informational errors
585 config NFT_REJECT_INET
586 depends on NF_TABLES_INET
591 depends on NETFILTER_XTABLES
592 tristate "Netfilter x_tables over nf_tables module"
594 This is required if you intend to use any of existing
595 x_tables match/target extensions over the nf_tables
599 tristate "Netfilter nf_tables hash module"
601 This option adds the "hash" expression that you can use to perform
602 a hash operation on registers.
608 depends on NF_TABLES_INET
609 depends on NFT_FIB_IPV4
610 depends on NFT_FIB_IPV6
611 tristate "Netfilter nf_tables fib inet support"
613 This option allows using the FIB expression from the inet table.
614 The lookup will be delegated to the IPv4 or IPv6 FIB depending
615 on the protocol of the packet.
618 tristate "Netfilter nf_tables xfrm/IPSec security association matching"
621 This option adds an expression that you can use to extract properties
622 of a packets security association.
625 tristate "Netfilter nf_tables socket match support"
626 depends on IPV6 || IPV6=n
627 select NF_SOCKET_IPV4
628 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
630 This option allows matching for the presence or absence of a
631 corresponding socket and its attributes.
634 tristate "Netfilter nf_tables passive OS fingerprint support"
635 depends on NETFILTER_ADVANCED
636 select NETFILTER_NETLINK_OSF
638 This option allows matching packets from an specific OS.
641 tristate "Netfilter nf_tables tproxy support"
642 depends on IPV6 || IPV6=n
643 select NF_DEFRAG_IPV4
644 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
645 select NF_TPROXY_IPV4
646 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
648 This makes transparent proxy support available in nftables.
651 tristate "Netfilter nf_tables SYNPROXY expression support"
652 depends on NF_CONNTRACK && NETFILTER_ADVANCED
653 select NETFILTER_SYNPROXY
656 The SYNPROXY expression allows you to intercept TCP connections and
657 establish them using syncookies before they are passed on to the
658 server. This allows to avoid conntrack and server resource usage
659 during SYN-flood attacks.
664 tristate "Netfilter packet duplication support"
666 This option enables the generic packet duplication infrastructure
669 config NFT_DUP_NETDEV
670 tristate "Netfilter nf_tables netdev packet duplication support"
673 This option enables packet duplication for the "netdev" family.
675 config NFT_FWD_NETDEV
676 tristate "Netfilter nf_tables netdev packet forwarding support"
679 This option enables packet forwarding for the "netdev" family.
681 config NFT_FIB_NETDEV
682 depends on NFT_FIB_IPV4
683 depends on NFT_FIB_IPV6
684 tristate "Netfilter nf_tables netdev fib lookups support"
686 This option allows using the FIB expression from the netdev table.
687 The lookup will be delegated to the IPv4 or IPv6 FIB depending
688 on the protocol of the packet.
690 config NFT_REJECT_NETDEV
691 depends on NFT_REJECT_IPV4
692 depends on NFT_REJECT_IPV6
693 tristate "Netfilter nf_tables netdev REJECT support"
695 This option enables the REJECT support from the netdev table.
696 The return packet generation will be delegated to the IPv4
697 or IPv6 ICMP or TCP RST implementation depending on the
698 protocol of the packet.
700 endif # NF_TABLES_NETDEV
704 config NF_FLOW_TABLE_INET
705 tristate "Netfilter flow table mixed IPv4/IPv6 module"
706 depends on NF_FLOW_TABLE
708 This option adds the flow table mixed IPv4/IPv6 support.
710 To compile it as a module, choose M here.
713 tristate "Netfilter flow table module"
714 depends on NETFILTER_INGRESS
715 depends on NF_CONNTRACK
718 This option adds the flow table core infrastructure.
720 To compile it as a module, choose M here.
722 config NETFILTER_XTABLES
723 tristate "Netfilter Xtables support (required for ip_tables)"
724 default m if NETFILTER_ADVANCED=n
726 This is required if you intend to use any of ip_tables,
727 ip6_tables or arp_tables.
731 config NETFILTER_XTABLES_COMPAT
732 bool "Netfilter Xtables 32bit support"
736 This option provides a translation layer to run 32bit arp,ip(6),ebtables
737 binaries on 64bit kernels.
741 comment "Xtables combined modules"
743 config NETFILTER_XT_MARK
744 tristate 'nfmark target and match support'
745 default m if NETFILTER_ADVANCED=n
747 This option adds the "MARK" target and "mark" match.
749 Netfilter mark matching allows you to match packets based on the
750 "nfmark" value in the packet.
751 The target allows you to create rules in the "mangle" table which alter
752 the netfilter mark (nfmark) field associated with the packet.
754 Prior to routing, the nfmark can influence the routing method and can
755 also be used by other subsystems to change their behavior.
757 config NETFILTER_XT_CONNMARK
758 tristate 'ctmark target and match support'
759 depends on NF_CONNTRACK
760 depends on NETFILTER_ADVANCED
761 select NF_CONNTRACK_MARK
763 This option adds the "CONNMARK" target and "connmark" match.
765 Netfilter allows you to store a mark value per connection (a.k.a.
766 ctmark), similarly to the packet mark (nfmark). Using this
767 target and match, you can set and match on this mark.
769 config NETFILTER_XT_SET
770 tristate 'set target and match support'
772 depends on NETFILTER_ADVANCED
774 This option adds the "SET" target and "set" match.
776 Using this target and match, you can add/delete and match
777 elements in the sets created by ipset(8).
779 To compile it as a module, choose M here. If unsure, say N.
781 # alphabetically ordered list of targets
783 comment "Xtables targets"
785 config NETFILTER_XT_TARGET_AUDIT
786 tristate "AUDIT target support"
788 depends on NETFILTER_ADVANCED
790 This option adds a 'AUDIT' target, which can be used to create
791 audit records for packets dropped/accepted.
793 To compileit as a module, choose M here. If unsure, say N.
795 config NETFILTER_XT_TARGET_CHECKSUM
796 tristate "CHECKSUM target support"
797 depends on IP_NF_MANGLE || IP6_NF_MANGLE
798 depends on NETFILTER_ADVANCED
800 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
801 table to work around buggy DHCP clients in virtualized environments.
803 Some old DHCP clients drop packets because they are not aware
804 that the checksum would normally be offloaded to hardware and
805 thus should be considered valid.
806 This target can be used to fill in the checksum using iptables
807 when such packets are sent via a virtual network device.
809 To compile it as a module, choose M here. If unsure, say N.
811 config NETFILTER_XT_TARGET_CLASSIFY
812 tristate '"CLASSIFY" target support'
813 depends on NETFILTER_ADVANCED
815 This option adds a `CLASSIFY' target, which enables the user to set
816 the priority of a packet. Some qdiscs can use this value for
817 classification, among these are:
819 atm, cbq, dsmark, pfifo_fast, htb, prio
821 To compile it as a module, choose M here. If unsure, say N.
823 config NETFILTER_XT_TARGET_CONNMARK
824 tristate '"CONNMARK" target support'
825 depends on NF_CONNTRACK
826 depends on NETFILTER_ADVANCED
827 select NETFILTER_XT_CONNMARK
829 This is a backwards-compat option for the user's convenience
830 (e.g. when running oldconfig). It selects
831 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
833 config NETFILTER_XT_TARGET_CONNSECMARK
834 tristate '"CONNSECMARK" target support'
835 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
836 default m if NETFILTER_ADVANCED=n
838 The CONNSECMARK target copies security markings from packets
839 to connections, and restores security markings from connections
840 to packets (if the packets are not already marked). This would
841 normally be used in conjunction with the SECMARK target.
843 To compile it as a module, choose M here. If unsure, say N.
845 config NETFILTER_XT_TARGET_CT
846 tristate '"CT" target support'
847 depends on NF_CONNTRACK
848 depends on IP_NF_RAW || IP6_NF_RAW
849 depends on NETFILTER_ADVANCED
851 This options adds a `CT' target, which allows to specify initial
852 connection tracking parameters like events to be delivered and
853 the helper to be used.
855 To compile it as a module, choose M here. If unsure, say N.
857 config NETFILTER_XT_TARGET_DSCP
858 tristate '"DSCP" and "TOS" target support'
859 depends on IP_NF_MANGLE || IP6_NF_MANGLE
860 depends on NETFILTER_ADVANCED
862 This option adds a `DSCP' target, which allows you to manipulate
863 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
865 The DSCP field can have any value between 0x0 and 0x3f inclusive.
867 It also adds the "TOS" target, which allows you to create rules in
868 the "mangle" table which alter the Type Of Service field of an IPv4
869 or the Priority field of an IPv6 packet, prior to routing.
871 To compile it as a module, choose M here. If unsure, say N.
873 config NETFILTER_XT_TARGET_HL
874 tristate '"HL" hoplimit target support'
875 depends on IP_NF_MANGLE || IP6_NF_MANGLE
876 depends on NETFILTER_ADVANCED
878 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
879 targets, which enable the user to change the
880 hoplimit/time-to-live value of the IP header.
882 While it is safe to decrement the hoplimit/TTL value, the
883 modules also allow to increment and set the hoplimit value of
884 the header to arbitrary values. This is EXTREMELY DANGEROUS
885 since you can easily create immortal packets that loop
886 forever on the network.
888 config NETFILTER_XT_TARGET_HMARK
889 tristate '"HMARK" target support'
890 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
891 depends on NETFILTER_ADVANCED
893 This option adds the "HMARK" target.
895 The target allows you to create rules in the "raw" and "mangle" tables
896 which set the skbuff mark by means of hash calculation within a given
897 range. The nfmark can influence the routing method and can also be used
898 by other subsystems to change their behaviour.
900 To compile it as a module, choose M here. If unsure, say N.
902 config NETFILTER_XT_TARGET_IDLETIMER
903 tristate "IDLETIMER target support"
904 depends on NETFILTER_ADVANCED
907 This option adds the `IDLETIMER' target. Each matching packet
908 resets the timer associated with label specified when the rule is
909 added. When the timer expires, it triggers a sysfs notification.
910 The remaining time for expiration can be read via sysfs.
912 To compile it as a module, choose M here. If unsure, say N.
914 config NETFILTER_XT_TARGET_LED
915 tristate '"LED" target support'
916 depends on LEDS_CLASS && LEDS_TRIGGERS
917 depends on NETFILTER_ADVANCED
919 This option adds a `LED' target, which allows you to blink LEDs in
920 response to particular packets passing through your machine.
922 This can be used to turn a spare LED into a network activity LED,
923 which only flashes in response to FTP transfers, for example. Or
924 you could have an LED which lights up for a minute or two every time
925 somebody connects to your machine via SSH.
927 You will need support for the "led" class to make this work.
929 To create an LED trigger for incoming SSH traffic:
930 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
932 Then attach the new trigger to an LED on your system:
933 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
935 For more information on the LEDs available on your system, see
936 Documentation/leds/leds-class.rst
938 config NETFILTER_XT_TARGET_LOG
939 tristate "LOG target support"
941 select NF_LOG_IPV6 if IP6_NF_IPTABLES
942 default m if NETFILTER_ADVANCED=n
944 This option adds a `LOG' target, which allows you to create rules in
945 any iptables table which records the packet header to the syslog.
947 To compile it as a module, choose M here. If unsure, say N.
949 config NETFILTER_XT_TARGET_MARK
950 tristate '"MARK" target support'
951 depends on NETFILTER_ADVANCED
952 select NETFILTER_XT_MARK
954 This is a backwards-compat option for the user's convenience
955 (e.g. when running oldconfig). It selects
956 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
958 config NETFILTER_XT_NAT
959 tristate '"SNAT and DNAT" targets support'
962 This option enables the SNAT and DNAT targets.
964 To compile it as a module, choose M here. If unsure, say N.
966 config NETFILTER_XT_TARGET_NETMAP
967 tristate '"NETMAP" target support'
970 NETMAP is an implementation of static 1:1 NAT mapping of network
971 addresses. It maps the network address part, while keeping the host
974 To compile it as a module, choose M here. If unsure, say N.
976 config NETFILTER_XT_TARGET_NFLOG
977 tristate '"NFLOG" target support'
978 default m if NETFILTER_ADVANCED=n
979 select NETFILTER_NETLINK_LOG
981 This option enables the NFLOG target, which allows to LOG
982 messages through nfnetlink_log.
984 To compile it as a module, choose M here. If unsure, say N.
986 config NETFILTER_XT_TARGET_NFQUEUE
987 tristate '"NFQUEUE" target Support'
988 depends on NETFILTER_ADVANCED
989 select NETFILTER_NETLINK_QUEUE
991 This target replaced the old obsolete QUEUE target.
993 As opposed to QUEUE, it supports 65535 different queues,
996 To compile it as a module, choose M here. If unsure, say N.
998 config NETFILTER_XT_TARGET_NOTRACK
999 tristate '"NOTRACK" target support (DEPRECATED)'
1000 depends on NF_CONNTRACK
1001 depends on IP_NF_RAW || IP6_NF_RAW
1002 depends on NETFILTER_ADVANCED
1003 select NETFILTER_XT_TARGET_CT
1005 config NETFILTER_XT_TARGET_RATEEST
1006 tristate '"RATEEST" target support'
1007 depends on NETFILTER_ADVANCED
1009 This option adds a `RATEEST' target, which allows to measure
1010 rates similar to TC estimators. The `rateest' match can be
1011 used to match on the measured rates.
1013 To compile it as a module, choose M here. If unsure, say N.
1015 config NETFILTER_XT_TARGET_REDIRECT
1016 tristate "REDIRECT target support"
1018 select NF_NAT_REDIRECT
1020 REDIRECT is a special case of NAT: all incoming connections are
1021 mapped onto the incoming interface's address, causing the packets to
1022 come to the local machine instead of passing through. This is
1023 useful for transparent proxies.
1025 To compile it as a module, choose M here. If unsure, say N.
1027 config NETFILTER_XT_TARGET_MASQUERADE
1028 tristate "MASQUERADE target support"
1030 default m if NETFILTER_ADVANCED=n
1031 select NF_NAT_MASQUERADE
1033 Masquerading is a special case of NAT: all outgoing connections are
1034 changed to seem to come from a particular interface's address, and
1035 if the interface goes down, those connections are lost. This is
1036 only useful for dialup accounts with dynamic IP address (ie. your IP
1037 address will be different on next dialup).
1039 To compile it as a module, choose M here. If unsure, say N.
1041 config NETFILTER_XT_TARGET_TEE
1042 tristate '"TEE" - packet cloning to alternate destination'
1043 depends on NETFILTER_ADVANCED
1044 depends on IPV6 || IPV6=n
1045 depends on !NF_CONNTRACK || NF_CONNTRACK
1046 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1048 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1050 This option adds a "TEE" target with which a packet can be cloned and
1051 this clone be rerouted to another nexthop.
1053 config NETFILTER_XT_TARGET_TPROXY
1054 tristate '"TPROXY" target transparent proxying support'
1055 depends on NETFILTER_XTABLES
1056 depends on NETFILTER_ADVANCED
1057 depends on IPV6 || IPV6=n
1058 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1059 depends on IP_NF_MANGLE
1060 select NF_DEFRAG_IPV4
1061 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1062 select NF_TPROXY_IPV4
1063 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1065 This option adds a `TPROXY' target, which is somewhat similar to
1066 REDIRECT. It can only be used in the mangle table and is useful
1067 to redirect traffic to a transparent proxy. It does _not_ depend
1068 on Netfilter connection tracking and NAT, unlike REDIRECT.
1069 For it to work you will have to configure certain iptables rules
1070 and use policy routing. For more information on how to set it up
1071 see Documentation/networking/tproxy.rst.
1073 To compile it as a module, choose M here. If unsure, say N.
1075 config NETFILTER_XT_TARGET_TRACE
1076 tristate '"TRACE" target support'
1077 depends on IP_NF_RAW || IP6_NF_RAW
1078 depends on NETFILTER_ADVANCED
1080 The TRACE target allows you to mark packets so that the kernel
1081 will log every rule which match the packets as those traverse
1082 the tables, chains, rules.
1084 If you want to compile it as a module, say M here and read
1085 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1087 config NETFILTER_XT_TARGET_SECMARK
1088 tristate '"SECMARK" target support'
1089 depends on NETWORK_SECMARK
1090 default m if NETFILTER_ADVANCED=n
1092 The SECMARK target allows security marking of network
1093 packets, for use with security subsystems.
1095 To compile it as a module, choose M here. If unsure, say N.
1097 config NETFILTER_XT_TARGET_TCPMSS
1098 tristate '"TCPMSS" target support'
1099 depends on IPV6 || IPV6=n
1100 default m if NETFILTER_ADVANCED=n
1102 This option adds a `TCPMSS' target, which allows you to alter the
1103 MSS value of TCP SYN packets, to control the maximum size for that
1104 connection (usually limiting it to your outgoing interface's MTU
1107 This is used to overcome criminally braindead ISPs or servers which
1108 block ICMP Fragmentation Needed packets. The symptoms of this
1109 problem are that everything works fine from your Linux
1110 firewall/router, but machines behind it can never exchange large
1112 1) Web browsers connect, then hang with no data received.
1113 2) Small mail works fine, but large emails hang.
1114 3) ssh works fine, but scp hangs after initial handshaking.
1116 Workaround: activate this option and add a rule to your firewall
1119 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1120 -j TCPMSS --clamp-mss-to-pmtu
1122 To compile it as a module, choose M here. If unsure, say N.
1124 config NETFILTER_XT_TARGET_TCPOPTSTRIP
1125 tristate '"TCPOPTSTRIP" target support'
1126 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1127 depends on NETFILTER_ADVANCED
1129 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1130 TCP options from TCP packets.
1132 # alphabetically ordered list of matches
1134 comment "Xtables matches"
1136 config NETFILTER_XT_MATCH_ADDRTYPE
1137 tristate '"addrtype" address type match support'
1138 default m if NETFILTER_ADVANCED=n
1140 This option allows you to match what routing thinks of an address,
1141 eg. UNICAST, LOCAL, BROADCAST, ...
1143 If you want to compile it as a module, say M here and read
1144 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1146 config NETFILTER_XT_MATCH_BPF
1147 tristate '"bpf" match support'
1148 depends on NETFILTER_ADVANCED
1150 BPF matching applies a linux socket filter to each packet and
1151 accepts those for which the filter returns non-zero.
1153 To compile it as a module, choose M here. If unsure, say N.
1155 config NETFILTER_XT_MATCH_CGROUP
1156 tristate '"control group" match support'
1157 depends on NETFILTER_ADVANCED
1159 select CGROUP_NET_CLASSID
1161 Socket/process control group matching allows you to match locally
1162 generated packets based on which net_cls control group processes
1165 config NETFILTER_XT_MATCH_CLUSTER
1166 tristate '"cluster" match support'
1167 depends on NF_CONNTRACK
1168 depends on NETFILTER_ADVANCED
1170 This option allows you to build work-load-sharing clusters of
1171 network servers/stateful firewalls without having a dedicated
1172 load-balancing router/server/switch. Basically, this match returns
1173 true when the packet must be handled by this cluster node. Thus,
1174 all nodes see all packets and this match decides which node handles
1175 what packets. The work-load sharing algorithm is based on source
1178 If you say Y or M here, try `iptables -m cluster --help` for
1181 config NETFILTER_XT_MATCH_COMMENT
1182 tristate '"comment" match support'
1183 depends on NETFILTER_ADVANCED
1185 This option adds a `comment' dummy-match, which allows you to put
1186 comments in your iptables ruleset.
1188 If you want to compile it as a module, say M here and read
1189 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1191 config NETFILTER_XT_MATCH_CONNBYTES
1192 tristate '"connbytes" per-connection counter match support'
1193 depends on NF_CONNTRACK
1194 depends on NETFILTER_ADVANCED
1196 This option adds a `connbytes' match, which allows you to match the
1197 number of bytes and/or packets for each direction within a connection.
1199 If you want to compile it as a module, say M here and read
1200 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1202 config NETFILTER_XT_MATCH_CONNLABEL
1203 tristate '"connlabel" match support'
1204 select NF_CONNTRACK_LABELS
1205 depends on NF_CONNTRACK
1206 depends on NETFILTER_ADVANCED
1208 This match allows you to test and assign userspace-defined labels names
1209 to a connection. The kernel only stores bit values - mapping
1210 names to bits is done by userspace.
1212 Unlike connmark, more than 32 flag bits may be assigned to a
1213 connection simultaneously.
1215 config NETFILTER_XT_MATCH_CONNLIMIT
1216 tristate '"connlimit" match support'
1217 depends on NF_CONNTRACK
1218 depends on NETFILTER_ADVANCED
1219 select NETFILTER_CONNCOUNT
1221 This match allows you to match against the number of parallel
1222 connections to a server per client IP address (or address block).
1224 config NETFILTER_XT_MATCH_CONNMARK
1225 tristate '"connmark" connection mark match support'
1226 depends on NF_CONNTRACK
1227 depends on NETFILTER_ADVANCED
1228 select NETFILTER_XT_CONNMARK
1230 This is a backwards-compat option for the user's convenience
1231 (e.g. when running oldconfig). It selects
1232 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1234 config NETFILTER_XT_MATCH_CONNTRACK
1235 tristate '"conntrack" connection tracking match support'
1236 depends on NF_CONNTRACK
1237 default m if NETFILTER_ADVANCED=n
1239 This is a general conntrack match module, a superset of the state match.
1241 It allows matching on additional conntrack information, which is
1242 useful in complex configurations, such as NAT gateways with multiple
1243 internet links or tunnels.
1245 To compile it as a module, choose M here. If unsure, say N.
1247 config NETFILTER_XT_MATCH_CPU
1248 tristate '"cpu" match support'
1249 depends on NETFILTER_ADVANCED
1251 CPU matching allows you to match packets based on the CPU
1252 currently handling the packet.
1254 To compile it as a module, choose M here. If unsure, say N.
1256 config NETFILTER_XT_MATCH_DCCP
1257 tristate '"dccp" protocol match support'
1258 depends on NETFILTER_ADVANCED
1261 With this option enabled, you will be able to use the iptables
1262 `dccp' match in order to match on DCCP source/destination ports
1265 If you want to compile it as a module, say M here and read
1266 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1268 config NETFILTER_XT_MATCH_DEVGROUP
1269 tristate '"devgroup" match support'
1270 depends on NETFILTER_ADVANCED
1272 This options adds a `devgroup' match, which allows to match on the
1273 device group a network device is assigned to.
1275 To compile it as a module, choose M here. If unsure, say N.
1277 config NETFILTER_XT_MATCH_DSCP
1278 tristate '"dscp" and "tos" match support'
1279 depends on NETFILTER_ADVANCED
1281 This option adds a `DSCP' match, which allows you to match against
1282 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1284 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1286 It will also add a "tos" match, which allows you to match packets
1287 based on the Type Of Service fields of the IPv4 packet (which share
1288 the same bits as DSCP).
1290 To compile it as a module, choose M here. If unsure, say N.
1292 config NETFILTER_XT_MATCH_ECN
1293 tristate '"ecn" match support'
1294 depends on NETFILTER_ADVANCED
1296 This option adds an "ECN" match, which allows you to match against
1297 the IPv4 and TCP header ECN fields.
1299 To compile it as a module, choose M here. If unsure, say N.
1301 config NETFILTER_XT_MATCH_ESP
1302 tristate '"esp" match support'
1303 depends on NETFILTER_ADVANCED
1305 This match extension allows you to match a range of SPIs
1306 inside ESP header of IPSec packets.
1308 To compile it as a module, choose M here. If unsure, say N.
1310 config NETFILTER_XT_MATCH_HASHLIMIT
1311 tristate '"hashlimit" match support'
1312 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1313 depends on NETFILTER_ADVANCED
1315 This option adds a `hashlimit' match.
1317 As opposed to `limit', this match dynamically creates a hash table
1318 of limit buckets, based on your selection of source/destination
1319 addresses and/or ports.
1321 It enables you to express policies like `10kpps for any given
1322 destination address' or `500pps from any given source address'
1325 config NETFILTER_XT_MATCH_HELPER
1326 tristate '"helper" match support'
1327 depends on NF_CONNTRACK
1328 depends on NETFILTER_ADVANCED
1330 Helper matching allows you to match packets in dynamic connections
1331 tracked by a conntrack-helper, ie. nf_conntrack_ftp
1333 To compile it as a module, choose M here. If unsure, say Y.
1335 config NETFILTER_XT_MATCH_HL
1336 tristate '"hl" hoplimit/TTL match support'
1337 depends on NETFILTER_ADVANCED
1339 HL matching allows you to match packets based on the hoplimit
1340 in the IPv6 header, or the time-to-live field in the IPv4
1341 header of the packet.
1343 config NETFILTER_XT_MATCH_IPCOMP
1344 tristate '"ipcomp" match support'
1345 depends on NETFILTER_ADVANCED
1347 This match extension allows you to match a range of CPIs(16 bits)
1348 inside IPComp header of IPSec packets.
1350 To compile it as a module, choose M here. If unsure, say N.
1352 config NETFILTER_XT_MATCH_IPRANGE
1353 tristate '"iprange" address range match support'
1354 depends on NETFILTER_ADVANCED
1356 This option adds a "iprange" match, which allows you to match based on
1357 an IP address range. (Normal iptables only matches on single addresses
1358 with an optional mask.)
1362 config NETFILTER_XT_MATCH_IPVS
1363 tristate '"ipvs" match support'
1365 depends on NETFILTER_ADVANCED
1366 depends on NF_CONNTRACK
1368 This option allows you to match against IPVS properties of a packet.
1372 config NETFILTER_XT_MATCH_L2TP
1373 tristate '"l2tp" match support'
1374 depends on NETFILTER_ADVANCED
1377 This option adds an "L2TP" match, which allows you to match against
1378 L2TP protocol header fields.
1380 To compile it as a module, choose M here. If unsure, say N.
1382 config NETFILTER_XT_MATCH_LENGTH
1383 tristate '"length" match support'
1384 depends on NETFILTER_ADVANCED
1386 This option allows you to match the length of a packet against a
1387 specific value or range of values.
1389 To compile it as a module, choose M here. If unsure, say N.
1391 config NETFILTER_XT_MATCH_LIMIT
1392 tristate '"limit" match support'
1393 depends on NETFILTER_ADVANCED
1395 limit matching allows you to control the rate at which a rule can be
1396 matched: mainly useful in combination with the LOG target ("LOG
1397 target support", below) and to avoid some Denial of Service attacks.
1399 To compile it as a module, choose M here. If unsure, say N.
1401 config NETFILTER_XT_MATCH_MAC
1402 tristate '"mac" address match support'
1403 depends on NETFILTER_ADVANCED
1405 MAC matching allows you to match packets based on the source
1406 Ethernet address of the packet.
1408 To compile it as a module, choose M here. If unsure, say N.
1410 config NETFILTER_XT_MATCH_MARK
1411 tristate '"mark" match support'
1412 depends on NETFILTER_ADVANCED
1413 select NETFILTER_XT_MARK
1415 This is a backwards-compat option for the user's convenience
1416 (e.g. when running oldconfig). It selects
1417 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1419 config NETFILTER_XT_MATCH_MULTIPORT
1420 tristate '"multiport" Multiple port match support'
1421 depends on NETFILTER_ADVANCED
1423 Multiport matching allows you to match TCP or UDP packets based on
1424 a series of source or destination ports: normally a rule can only
1425 match a single range of ports.
1427 To compile it as a module, choose M here. If unsure, say N.
1429 config NETFILTER_XT_MATCH_NFACCT
1430 tristate '"nfacct" match support'
1431 depends on NETFILTER_ADVANCED
1432 select NETFILTER_NETLINK_ACCT
1434 This option allows you to use the extended accounting through
1437 To compile it as a module, choose M here. If unsure, say N.
1439 config NETFILTER_XT_MATCH_OSF
1440 tristate '"osf" Passive OS fingerprint match'
1441 depends on NETFILTER_ADVANCED
1442 select NETFILTER_NETLINK_OSF
1444 This option selects the Passive OS Fingerprinting match module
1445 that allows to passively match the remote operating system by
1446 analyzing incoming TCP SYN packets.
1448 Rules and loading software can be downloaded from
1449 http://www.ioremap.net/projects/osf
1451 To compile it as a module, choose M here. If unsure, say N.
1453 config NETFILTER_XT_MATCH_OWNER
1454 tristate '"owner" match support'
1455 depends on NETFILTER_ADVANCED
1457 Socket owner matching allows you to match locally-generated packets
1458 based on who created the socket: the user or group. It is also
1459 possible to check whether a socket actually exists.
1461 config NETFILTER_XT_MATCH_POLICY
1462 tristate 'IPsec "policy" match support'
1464 default m if NETFILTER_ADVANCED=n
1466 Policy matching allows you to match packets based on the
1467 IPsec policy that was used during decapsulation/will
1468 be used during encapsulation.
1470 To compile it as a module, choose M here. If unsure, say N.
1472 config NETFILTER_XT_MATCH_PHYSDEV
1473 tristate '"physdev" match support'
1474 depends on BRIDGE && BRIDGE_NETFILTER
1475 depends on NETFILTER_ADVANCED
1477 Physdev packet matching matches against the physical bridge ports
1478 the IP packet arrived on or will leave by.
1480 To compile it as a module, choose M here. If unsure, say N.
1482 config NETFILTER_XT_MATCH_PKTTYPE
1483 tristate '"pkttype" packet type match support'
1484 depends on NETFILTER_ADVANCED
1486 Packet type matching allows you to match a packet by
1487 its "class", eg. BROADCAST, MULTICAST, ...
1490 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1492 To compile it as a module, choose M here. If unsure, say N.
1494 config NETFILTER_XT_MATCH_QUOTA
1495 tristate '"quota" match support'
1496 depends on NETFILTER_ADVANCED
1498 This option adds a `quota' match, which allows to match on a
1501 If you want to compile it as a module, say M here and read
1502 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1504 config NETFILTER_XT_MATCH_RATEEST
1505 tristate '"rateest" match support'
1506 depends on NETFILTER_ADVANCED
1507 select NETFILTER_XT_TARGET_RATEEST
1509 This option adds a `rateest' match, which allows to match on the
1510 rate estimated by the RATEEST target.
1512 To compile it as a module, choose M here. If unsure, say N.
1514 config NETFILTER_XT_MATCH_REALM
1515 tristate '"realm" match support'
1516 depends on NETFILTER_ADVANCED
1517 select IP_ROUTE_CLASSID
1519 This option adds a `realm' match, which allows you to use the realm
1520 key from the routing subsystem inside iptables.
1522 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1525 If you want to compile it as a module, say M here and read
1526 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1528 config NETFILTER_XT_MATCH_RECENT
1529 tristate '"recent" match support'
1530 depends on NETFILTER_ADVANCED
1532 This match is used for creating one or many lists of recently
1533 used addresses and then matching against that/those list(s).
1535 Short options are available by using 'iptables -m recent -h'
1536 Official Website: <http://snowman.net/projects/ipt_recent/>
1538 config NETFILTER_XT_MATCH_SCTP
1539 tristate '"sctp" protocol match support'
1540 depends on NETFILTER_ADVANCED
1543 With this option enabled, you will be able to use the
1544 `sctp' match in order to match on SCTP source/destination ports
1545 and SCTP chunk types.
1547 If you want to compile it as a module, say M here and read
1548 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1550 config NETFILTER_XT_MATCH_SOCKET
1551 tristate '"socket" match support'
1552 depends on NETFILTER_XTABLES
1553 depends on NETFILTER_ADVANCED
1554 depends on IPV6 || IPV6=n
1555 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1556 select NF_SOCKET_IPV4
1557 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1558 select NF_DEFRAG_IPV4
1559 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1561 This option adds a `socket' match, which can be used to match
1562 packets for which a TCP or UDP socket lookup finds a valid socket.
1563 It can be used in combination with the MARK target and policy
1564 routing to implement full featured non-locally bound sockets.
1566 To compile it as a module, choose M here. If unsure, say N.
1568 config NETFILTER_XT_MATCH_STATE
1569 tristate '"state" match support'
1570 depends on NF_CONNTRACK
1571 default m if NETFILTER_ADVANCED=n
1573 Connection state matching allows you to match packets based on their
1574 relationship to a tracked connection (ie. previous packets). This
1575 is a powerful tool for packet classification.
1577 To compile it as a module, choose M here. If unsure, say N.
1579 config NETFILTER_XT_MATCH_STATISTIC
1580 tristate '"statistic" match support'
1581 depends on NETFILTER_ADVANCED
1583 This option adds a `statistic' match, which allows you to match
1584 on packets periodically or randomly with a given percentage.
1586 To compile it as a module, choose M here. If unsure, say N.
1588 config NETFILTER_XT_MATCH_STRING
1589 tristate '"string" match support'
1590 depends on NETFILTER_ADVANCED
1592 select TEXTSEARCH_KMP
1593 select TEXTSEARCH_BM
1594 select TEXTSEARCH_FSM
1596 This option adds a `string' match, which allows you to look for
1597 pattern matchings in packets.
1599 To compile it as a module, choose M here. If unsure, say N.
1601 config NETFILTER_XT_MATCH_TCPMSS
1602 tristate '"tcpmss" match support'
1603 depends on NETFILTER_ADVANCED
1605 This option adds a `tcpmss' match, which allows you to examine the
1606 MSS value of TCP SYN packets, which control the maximum packet size
1607 for that connection.
1609 To compile it as a module, choose M here. If unsure, say N.
1611 config NETFILTER_XT_MATCH_TIME
1612 tristate '"time" match support'
1613 depends on NETFILTER_ADVANCED
1615 This option adds a "time" match, which allows you to match based on
1616 the packet arrival time (at the machine which netfilter is running)
1617 on) or departure time/date (for locally generated packets).
1619 If you say Y here, try `iptables -m time --help` for
1622 If you want to compile it as a module, say M here.
1625 config NETFILTER_XT_MATCH_U32
1626 tristate '"u32" match support'
1627 depends on NETFILTER_ADVANCED
1629 u32 allows you to extract quantities of up to 4 bytes from a packet,
1630 AND them with specified masks, shift them by specified amounts and
1631 test whether the results are in any of a set of specified ranges.
1632 The specification of what to extract is general enough to skip over
1633 headers with lengths stored in the packet, as in IP or TCP header
1636 Details and examples are in the kernel module source.
1638 endif # NETFILTER_XTABLES
1642 source "net/netfilter/ipset/Kconfig"
1644 source "net/netfilter/ipvs/Kconfig"