1 # SPDX-License-Identifier: GPL-2.0-only
2 menu "Core Netfilter Configuration"
3 depends on INET && NETFILTER
5 config NETFILTER_INGRESS
6 bool "Netfilter ingress support"
10 This allows you to classify packets from ingress using the Netfilter
13 config NETFILTER_EGRESS
14 bool "Netfilter egress support"
18 This allows you to classify packets before transmission using the
19 Netfilter infrastructure.
21 config NETFILTER_SKIP_EGRESS
22 def_bool NETFILTER_EGRESS && (NET_CLS_ACT || IFB)
24 config NETFILTER_NETLINK
27 config NETFILTER_FAMILY_BRIDGE
30 config NETFILTER_FAMILY_ARP
33 config NETFILTER_NETLINK_HOOK
34 tristate "Netfilter base hook dump support"
35 depends on NETFILTER_ADVANCED
37 select NETFILTER_NETLINK
39 If this option is enabled, the kernel will include support
40 to list the base netfilter hooks via NFNETLINK.
41 This is helpful for debugging.
43 config NETFILTER_NETLINK_ACCT
44 tristate "Netfilter NFACCT over NFNETLINK interface"
45 depends on NETFILTER_ADVANCED
46 select NETFILTER_NETLINK
48 If this option is enabled, the kernel will include support
49 for extended accounting via NFNETLINK.
51 config NETFILTER_NETLINK_QUEUE
52 tristate "Netfilter NFQUEUE over NFNETLINK interface"
53 depends on NETFILTER_ADVANCED
54 select NETFILTER_NETLINK
56 If this option is enabled, the kernel will include support
57 for queueing packets via NFNETLINK.
59 config NETFILTER_NETLINK_LOG
60 tristate "Netfilter LOG over NFNETLINK interface"
61 default m if NETFILTER_ADVANCED=n
62 select NETFILTER_NETLINK
64 If this option is enabled, the kernel will include support
65 for logging packets via NFNETLINK.
67 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
68 and is also scheduled to replace the old syslog-based ipt_LOG
71 config NETFILTER_NETLINK_OSF
72 tristate "Netfilter OSF over NFNETLINK interface"
73 depends on NETFILTER_ADVANCED
74 select NETFILTER_NETLINK
76 If this option is enabled, the kernel will include support
77 for passive OS fingerprint via NFNETLINK.
80 tristate "Netfilter connection tracking support"
81 default m if NETFILTER_ADVANCED=n
83 select NF_DEFRAG_IPV6 if IPV6 != n
85 Connection tracking keeps a record of what packets have passed
86 through your machine, in order to figure out how they are related
89 This is required to do Masquerading or other kinds of Network
90 Address Translation. It can also be used to enhance packet
91 filtering (see `Connection state match support' below).
93 To compile it as a module, choose M here. If unsure, say N.
96 tristate "Syslog packet logging"
97 default m if NETFILTER_ADVANCED=n
99 This option enable support for packet logging via syslog.
100 It supports IPv4, IPV6, ARP and common transport protocols such
102 This is a simpler but less flexible logging method compared to
103 CONFIG_NETFILTER_NETLINK_LOG.
104 If both are enabled the backend to use can be configured at run-time
105 by means of per-address-family sysctl tunables.
108 config NETFILTER_CONNCOUNT
111 config NF_CONNTRACK_MARK
112 bool 'Connection mark tracking support'
113 depends on NETFILTER_ADVANCED
115 This option enables support for connection marks, used by the
116 `CONNMARK' target and `connmark' match. Similar to the mark value
117 of packets, but this mark value is kept in the conntrack session
118 instead of the individual packets.
120 config NF_CONNTRACK_SECMARK
121 bool 'Connection tracking security mark support'
122 depends on NETWORK_SECMARK
123 default y if NETFILTER_ADVANCED=n
125 This option enables security markings to be applied to
126 connections. Typically they are copied to connections from
127 packets using the CONNSECMARK target and copied back from
128 connections to packets with the same target, with the packets
129 being originally labeled via SECMARK.
133 config NF_CONNTRACK_ZONES
134 bool 'Connection tracking zones'
135 depends on NETFILTER_ADVANCED
137 This option enables support for connection tracking zones.
138 Normally, each connection needs to have a unique system wide
139 identity. Connection tracking zones allow to have multiple
140 connections using the same identity, as long as they are
141 contained in different zones.
145 config NF_CONNTRACK_PROCFS
146 bool "Supply CT list in procfs (OBSOLETE)"
150 This option enables for the list of known conntrack entries
151 to be shown in procfs under net/netfilter/nf_conntrack. This
152 is considered obsolete in favor of using the conntrack(8)
153 tool which uses Netlink.
155 config NF_CONNTRACK_EVENTS
156 bool "Connection tracking events"
157 depends on NETFILTER_ADVANCED
159 If this option is enabled, the connection tracking code will
160 provide a notifier chain that can be used by other kernel code
161 to get notified about changes in the connection tracking state.
165 config NF_CONNTRACK_TIMEOUT
166 bool 'Connection tracking timeout'
167 depends on NETFILTER_ADVANCED
169 This option enables support for connection tracking timeout
170 extension. This allows you to attach timeout policies to flow
175 config NF_CONNTRACK_TIMESTAMP
176 bool 'Connection tracking timestamping'
177 depends on NETFILTER_ADVANCED
179 This option enables support for connection tracking timestamping.
180 This allows you to store the flow start-time and to obtain
181 the flow-stop time (once it has been destroyed) via Connection
186 config NF_CONNTRACK_LABELS
187 bool "Connection tracking labels"
189 This option enables support for assigning user-defined flag bits
190 to connection tracking entries. It can be used with xtables connlabel
191 match and the nftables ct expression.
193 config NF_CT_PROTO_DCCP
194 bool 'DCCP protocol connection tracking support'
195 depends on NETFILTER_ADVANCED
198 With this option enabled, the layer 3 independent connection
199 tracking code will be able to do state tracking on DCCP connections.
203 config NF_CT_PROTO_GRE
206 config NF_CT_PROTO_SCTP
207 bool 'SCTP protocol connection tracking support'
208 depends on NETFILTER_ADVANCED
212 With this option enabled, the layer 3 independent connection
213 tracking code will be able to do state tracking on SCTP connections.
217 config NF_CT_PROTO_UDPLITE
218 bool 'UDP-Lite protocol connection tracking support'
219 depends on NETFILTER_ADVANCED
222 With this option enabled, the layer 3 independent connection
223 tracking code will be able to do state tracking on UDP-Lite
228 config NF_CONNTRACK_AMANDA
229 tristate "Amanda backup protocol support"
230 depends on NETFILTER_ADVANCED
232 select TEXTSEARCH_KMP
234 If you are running the Amanda backup package <http://www.amanda.org/>
235 on this machine or machines that will be MASQUERADED through this
236 machine, then you may want to enable this feature. This allows the
237 connection tracking and natting code to allow the sub-channels that
238 Amanda requires for communication of the backup data, messages and
241 To compile it as a module, choose M here. If unsure, say N.
243 config NF_CONNTRACK_FTP
244 tristate "FTP protocol support"
245 default m if NETFILTER_ADVANCED=n
247 Tracking FTP connections is problematic: special helpers are
248 required for tracking them, and doing masquerading and other forms
249 of Network Address Translation on them.
251 This is FTP support on Layer 3 independent connection tracking.
253 To compile it as a module, choose M here. If unsure, say N.
255 config NF_CONNTRACK_H323
256 tristate "H.323 protocol support"
257 depends on IPV6 || IPV6=n
258 depends on NETFILTER_ADVANCED
260 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
261 important VoIP protocols, it is widely used by voice hardware and
262 software including voice gateways, IP phones, Netmeeting, OpenPhone,
265 With this module you can support H.323 on a connection tracking/NAT
268 This module supports RAS, Fast Start, H.245 Tunnelling, Call
269 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
270 whiteboard, file transfer, etc. For more information, please
271 visit http://nath323.sourceforge.net/.
273 To compile it as a module, choose M here. If unsure, say N.
275 config NF_CONNTRACK_IRC
276 tristate "IRC protocol support"
277 default m if NETFILTER_ADVANCED=n
279 There is a commonly-used extension to IRC called
280 Direct Client-to-Client Protocol (DCC). This enables users to send
281 files to each other, and also chat to each other without the need
282 of a server. DCC Sending is used anywhere you send files over IRC,
283 and DCC Chat is most commonly used by Eggdrop bots. If you are
284 using NAT, this extension will enable you to send files and initiate
285 chats. Note that you do NOT need this extension to get files or
286 have others initiate chats, or everything else in IRC.
288 To compile it as a module, choose M here. If unsure, say N.
290 config NF_CONNTRACK_BROADCAST
293 config NF_CONNTRACK_NETBIOS_NS
294 tristate "NetBIOS name service protocol support"
295 select NF_CONNTRACK_BROADCAST
297 NetBIOS name service requests are sent as broadcast messages from an
298 unprivileged port and responded to with unicast messages to the
299 same port. This make them hard to firewall properly because connection
300 tracking doesn't deal with broadcasts. This helper tracks locally
301 originating NetBIOS name service requests and the corresponding
302 responses. It relies on correct IP address configuration, specifically
303 netmask and broadcast address. When properly configured, the output
304 of "ip address show" should look similar to this:
306 $ ip -4 address show eth0
307 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
308 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
310 To compile it as a module, choose M here. If unsure, say N.
312 config NF_CONNTRACK_SNMP
313 tristate "SNMP service protocol support"
314 depends on NETFILTER_ADVANCED
315 select NF_CONNTRACK_BROADCAST
317 SNMP service requests are sent as broadcast messages from an
318 unprivileged port and responded to with unicast messages to the
319 same port. This make them hard to firewall properly because connection
320 tracking doesn't deal with broadcasts. This helper tracks locally
321 originating SNMP service requests and the corresponding
322 responses. It relies on correct IP address configuration, specifically
323 netmask and broadcast address.
325 To compile it as a module, choose M here. If unsure, say N.
327 config NF_CONNTRACK_PPTP
328 tristate "PPtP protocol support"
329 depends on NETFILTER_ADVANCED
330 select NF_CT_PROTO_GRE
332 This module adds support for PPTP (Point to Point Tunnelling
333 Protocol, RFC2637) connection tracking and NAT.
335 If you are running PPTP sessions over a stateful firewall or NAT
336 box, you may want to enable this feature.
338 Please note that not all PPTP modes of operation are supported yet.
339 Specifically these limitations exist:
340 - Blindly assumes that control connections are always established
341 in PNS->PAC direction. This is a violation of RFC2637.
342 - Only supports a single call within each session
344 To compile it as a module, choose M here. If unsure, say N.
346 config NF_CONNTRACK_SANE
347 tristate "SANE protocol support"
348 depends on NETFILTER_ADVANCED
350 SANE is a protocol for remote access to scanners as implemented
351 by the 'saned' daemon. Like FTP, it uses separate control and
354 With this module you can support SANE on a connection tracking
357 To compile it as a module, choose M here. If unsure, say N.
359 config NF_CONNTRACK_SIP
360 tristate "SIP protocol support"
361 default m if NETFILTER_ADVANCED=n
363 SIP is an application-layer control protocol that can establish,
364 modify, and terminate multimedia sessions (conferences) such as
365 Internet telephony calls. With the nf_conntrack_sip and
366 the nf_nat_sip modules you can support the protocol on a connection
367 tracking/NATing firewall.
369 To compile it as a module, choose M here. If unsure, say N.
371 config NF_CONNTRACK_TFTP
372 tristate "TFTP protocol support"
373 depends on NETFILTER_ADVANCED
375 TFTP connection tracking helper, this is required depending
376 on how restrictive your ruleset is.
377 If you are using a tftp client behind -j SNAT or -j MASQUERADING
380 To compile it as a module, choose M here. If unsure, say N.
383 tristate 'Connection tracking netlink interface'
384 select NETFILTER_NETLINK
385 default m if NETFILTER_ADVANCED=n
387 This option enables support for a netlink-based userspace interface
389 config NF_CT_NETLINK_TIMEOUT
390 tristate 'Connection tracking timeout tuning via Netlink'
391 select NETFILTER_NETLINK
392 depends on NETFILTER_ADVANCED
393 depends on NF_CONNTRACK_TIMEOUT
395 This option enables support for connection tracking timeout
396 fine-grain tuning. This allows you to attach specific timeout
397 policies to flows, instead of using the global timeout policy.
401 config NF_CT_NETLINK_HELPER
402 tristate 'Connection tracking helpers in user-space via Netlink'
403 select NETFILTER_NETLINK
404 depends on NF_CT_NETLINK
405 depends on NETFILTER_NETLINK_QUEUE
406 depends on NETFILTER_NETLINK_GLUE_CT
407 depends on NETFILTER_ADVANCED
409 This option enables the user-space connection tracking helpers
414 config NETFILTER_NETLINK_GLUE_CT
415 bool "NFQUEUE and NFLOG integration with Connection Tracking"
417 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
419 If this option is enabled, NFQUEUE and NFLOG can include
420 Connection Tracking information together with the packet is
421 the enqueued via NFNETLINK.
424 tristate "Network Address Translation support"
425 depends on NF_CONNTRACK
426 default m if NETFILTER_ADVANCED=n
428 The NAT option allows masquerading, port forwarding and other
429 forms of full Network Address Port Translation. This can be
430 controlled by iptables, ip6tables or nft.
434 depends on NF_CONNTRACK && NF_NAT
435 default NF_NAT && NF_CONNTRACK_AMANDA
439 depends on NF_CONNTRACK && NF_NAT
440 default NF_NAT && NF_CONNTRACK_FTP
444 depends on NF_CONNTRACK && NF_NAT
445 default NF_NAT && NF_CONNTRACK_IRC
449 depends on NF_CONNTRACK && NF_NAT
450 default NF_NAT && NF_CONNTRACK_SIP
454 depends on NF_CONNTRACK && NF_NAT
455 default NF_NAT && NF_CONNTRACK_TFTP
457 config NF_NAT_REDIRECT
460 config NF_NAT_MASQUERADE
463 config NETFILTER_SYNPROXY
469 select NETFILTER_NETLINK
471 tristate "Netfilter nf_tables support"
473 nftables is the new packet classification framework that intends to
474 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
475 provides a pseudo-state machine with an extensible instruction-set
476 (also known as expressions) that the userspace 'nft' utility
477 (https://www.netfilter.org/projects/nftables) uses to build the
478 rule-set. It also comes with the generic set infrastructure that
479 allows you to construct mappings between matchings and actions
480 for performance lookups.
482 To compile it as a module, choose M here.
485 config NF_TABLES_INET
487 select NF_TABLES_IPV4
488 select NF_TABLES_IPV6
489 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
491 This option enables support for a mixed IPv4/IPv6 "inet" table.
493 config NF_TABLES_NETDEV
494 bool "Netfilter nf_tables netdev tables support"
496 This option enables support for the "netdev" table.
499 tristate "Netfilter nf_tables number generator module"
501 This option adds the number generator expression used to perform
502 incremental counting and random numbers bound to a upper limit.
505 depends on NF_CONNTRACK
506 tristate "Netfilter nf_tables conntrack module"
508 This option adds the "ct" expression that you can use to match
509 connection tracking information such as the flow state.
511 config NFT_FLOW_OFFLOAD
512 depends on NF_CONNTRACK && NF_FLOW_TABLE
513 tristate "Netfilter nf_tables hardware flow offload module"
515 This option adds the "flow_offload" expression that you can use to
516 choose what flows are placed into the hardware.
519 tristate "Netfilter nf_tables connlimit module"
520 depends on NF_CONNTRACK
521 depends on NETFILTER_ADVANCED
522 select NETFILTER_CONNCOUNT
524 This option adds the "connlimit" expression that you can use to
525 ratelimit rule matchings per connections.
528 tristate "Netfilter nf_tables log module"
530 This option adds the "log" expression that you can use to log
531 packets matching some criteria.
534 tristate "Netfilter nf_tables limit module"
536 This option adds the "limit" expression that you can use to
537 ratelimit rule matchings.
540 depends on NF_CONNTRACK
542 select NF_NAT_MASQUERADE
543 tristate "Netfilter nf_tables masquerade support"
545 This option adds the "masquerade" expression that you can use
546 to perform NAT in the masquerade flavour.
549 depends on NF_CONNTRACK
551 tristate "Netfilter nf_tables redirect support"
552 select NF_NAT_REDIRECT
554 This options adds the "redirect" expression that you can use
555 to perform NAT in the redirect flavour.
558 depends on NF_CONNTRACK
560 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
561 tristate "Netfilter nf_tables nat module"
563 This option adds the "nat" expression that you can use to perform
564 typical Network Address Translation (NAT) packet transformations.
567 tristate "Netfilter nf_tables tunnel module"
569 This option adds the "tunnel" expression that you can use to set
573 tristate "Netfilter nf_tables stateful object reference module"
575 This option adds the "objref" expression that allows you to refer to
576 stateful objects, such as counters and quotas.
579 depends on NETFILTER_NETLINK_QUEUE
580 tristate "Netfilter nf_tables queue module"
582 This is required if you intend to use the userspace queueing
583 infrastructure (also known as NFQUEUE) from nftables.
586 tristate "Netfilter nf_tables quota module"
588 This option adds the "quota" expression that you can use to match
589 enforce bytes quotas.
592 default m if NETFILTER_ADVANCED=n
593 tristate "Netfilter nf_tables reject support"
594 depends on !NF_TABLES_INET || (IPV6!=m || m)
596 This option adds the "reject" expression that you can use to
597 explicitly deny and notify via TCP reset/ICMP informational errors
600 config NFT_REJECT_INET
601 depends on NF_TABLES_INET
606 depends on NETFILTER_XTABLES
607 tristate "Netfilter x_tables over nf_tables module"
609 This is required if you intend to use any of existing
610 x_tables match/target extensions over the nf_tables
614 tristate "Netfilter nf_tables hash module"
616 This option adds the "hash" expression that you can use to perform
617 a hash operation on registers.
623 depends on NF_TABLES_INET
624 depends on NFT_FIB_IPV4
625 depends on NFT_FIB_IPV6
626 tristate "Netfilter nf_tables fib inet support"
628 This option allows using the FIB expression from the inet table.
629 The lookup will be delegated to the IPv4 or IPv6 FIB depending
630 on the protocol of the packet.
633 tristate "Netfilter nf_tables xfrm/IPSec security association matching"
636 This option adds an expression that you can use to extract properties
637 of a packets security association.
640 tristate "Netfilter nf_tables socket match support"
641 depends on IPV6 || IPV6=n
642 select NF_SOCKET_IPV4
643 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
645 This option allows matching for the presence or absence of a
646 corresponding socket and its attributes.
649 tristate "Netfilter nf_tables passive OS fingerprint support"
650 depends on NETFILTER_ADVANCED
651 select NETFILTER_NETLINK_OSF
653 This option allows matching packets from an specific OS.
656 tristate "Netfilter nf_tables tproxy support"
657 depends on IPV6 || IPV6=n
658 select NF_DEFRAG_IPV4
659 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
660 select NF_TPROXY_IPV4
661 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
663 This makes transparent proxy support available in nftables.
666 tristate "Netfilter nf_tables SYNPROXY expression support"
667 depends on NF_CONNTRACK && NETFILTER_ADVANCED
668 select NETFILTER_SYNPROXY
671 The SYNPROXY expression allows you to intercept TCP connections and
672 establish them using syncookies before they are passed on to the
673 server. This allows to avoid conntrack and server resource usage
674 during SYN-flood attacks.
679 tristate "Netfilter packet duplication support"
681 This option enables the generic packet duplication infrastructure
684 config NFT_DUP_NETDEV
685 tristate "Netfilter nf_tables netdev packet duplication support"
688 This option enables packet duplication for the "netdev" family.
690 config NFT_FWD_NETDEV
691 tristate "Netfilter nf_tables netdev packet forwarding support"
694 This option enables packet forwarding for the "netdev" family.
696 config NFT_FIB_NETDEV
697 depends on NFT_FIB_IPV4
698 depends on NFT_FIB_IPV6
699 tristate "Netfilter nf_tables netdev fib lookups support"
701 This option allows using the FIB expression from the netdev table.
702 The lookup will be delegated to the IPv4 or IPv6 FIB depending
703 on the protocol of the packet.
705 config NFT_REJECT_NETDEV
706 depends on NFT_REJECT_IPV4
707 depends on NFT_REJECT_IPV6
708 tristate "Netfilter nf_tables netdev REJECT support"
710 This option enables the REJECT support from the netdev table.
711 The return packet generation will be delegated to the IPv4
712 or IPv6 ICMP or TCP RST implementation depending on the
713 protocol of the packet.
715 endif # NF_TABLES_NETDEV
719 config NF_FLOW_TABLE_INET
720 tristate "Netfilter flow table mixed IPv4/IPv6 module"
721 depends on NF_FLOW_TABLE
723 This option adds the flow table mixed IPv4/IPv6 support.
725 To compile it as a module, choose M here.
728 tristate "Netfilter flow table module"
729 depends on NETFILTER_INGRESS
730 depends on NF_CONNTRACK
733 This option adds the flow table core infrastructure.
735 To compile it as a module, choose M here.
737 config NETFILTER_XTABLES
738 tristate "Netfilter Xtables support (required for ip_tables)"
739 default m if NETFILTER_ADVANCED=n
741 This is required if you intend to use any of ip_tables,
742 ip6_tables or arp_tables.
746 config NETFILTER_XTABLES_COMPAT
747 bool "Netfilter Xtables 32bit support"
751 This option provides a translation layer to run 32bit arp,ip(6),ebtables
752 binaries on 64bit kernels.
756 comment "Xtables combined modules"
758 config NETFILTER_XT_MARK
759 tristate 'nfmark target and match support'
760 default m if NETFILTER_ADVANCED=n
762 This option adds the "MARK" target and "mark" match.
764 Netfilter mark matching allows you to match packets based on the
765 "nfmark" value in the packet.
766 The target allows you to create rules in the "mangle" table which alter
767 the netfilter mark (nfmark) field associated with the packet.
769 Prior to routing, the nfmark can influence the routing method and can
770 also be used by other subsystems to change their behavior.
772 config NETFILTER_XT_CONNMARK
773 tristate 'ctmark target and match support'
774 depends on NF_CONNTRACK
775 depends on NETFILTER_ADVANCED
776 select NF_CONNTRACK_MARK
778 This option adds the "CONNMARK" target and "connmark" match.
780 Netfilter allows you to store a mark value per connection (a.k.a.
781 ctmark), similarly to the packet mark (nfmark). Using this
782 target and match, you can set and match on this mark.
784 config NETFILTER_XT_SET
785 tristate 'set target and match support'
787 depends on NETFILTER_ADVANCED
789 This option adds the "SET" target and "set" match.
791 Using this target and match, you can add/delete and match
792 elements in the sets created by ipset(8).
794 To compile it as a module, choose M here. If unsure, say N.
796 # alphabetically ordered list of targets
798 comment "Xtables targets"
800 config NETFILTER_XT_TARGET_AUDIT
801 tristate "AUDIT target support"
803 depends on NETFILTER_ADVANCED
805 This option adds a 'AUDIT' target, which can be used to create
806 audit records for packets dropped/accepted.
808 To compileit as a module, choose M here. If unsure, say N.
810 config NETFILTER_XT_TARGET_CHECKSUM
811 tristate "CHECKSUM target support"
812 depends on IP_NF_MANGLE || IP6_NF_MANGLE
813 depends on NETFILTER_ADVANCED
815 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
816 table to work around buggy DHCP clients in virtualized environments.
818 Some old DHCP clients drop packets because they are not aware
819 that the checksum would normally be offloaded to hardware and
820 thus should be considered valid.
821 This target can be used to fill in the checksum using iptables
822 when such packets are sent via a virtual network device.
824 To compile it as a module, choose M here. If unsure, say N.
826 config NETFILTER_XT_TARGET_CLASSIFY
827 tristate '"CLASSIFY" target support'
828 depends on NETFILTER_ADVANCED
830 This option adds a `CLASSIFY' target, which enables the user to set
831 the priority of a packet. Some qdiscs can use this value for
832 classification, among these are:
834 atm, cbq, dsmark, pfifo_fast, htb, prio
836 To compile it as a module, choose M here. If unsure, say N.
838 config NETFILTER_XT_TARGET_CONNMARK
839 tristate '"CONNMARK" target support'
840 depends on NF_CONNTRACK
841 depends on NETFILTER_ADVANCED
842 select NETFILTER_XT_CONNMARK
844 This is a backwards-compat option for the user's convenience
845 (e.g. when running oldconfig). It selects
846 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
848 config NETFILTER_XT_TARGET_CONNSECMARK
849 tristate '"CONNSECMARK" target support'
850 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
851 default m if NETFILTER_ADVANCED=n
853 The CONNSECMARK target copies security markings from packets
854 to connections, and restores security markings from connections
855 to packets (if the packets are not already marked). This would
856 normally be used in conjunction with the SECMARK target.
858 To compile it as a module, choose M here. If unsure, say N.
860 config NETFILTER_XT_TARGET_CT
861 tristate '"CT" target support'
862 depends on NF_CONNTRACK
863 depends on IP_NF_RAW || IP6_NF_RAW
864 depends on NETFILTER_ADVANCED
866 This options adds a `CT' target, which allows to specify initial
867 connection tracking parameters like events to be delivered and
868 the helper to be used.
870 To compile it as a module, choose M here. If unsure, say N.
872 config NETFILTER_XT_TARGET_DSCP
873 tristate '"DSCP" and "TOS" target support'
874 depends on IP_NF_MANGLE || IP6_NF_MANGLE
875 depends on NETFILTER_ADVANCED
877 This option adds a `DSCP' target, which allows you to manipulate
878 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
880 The DSCP field can have any value between 0x0 and 0x3f inclusive.
882 It also adds the "TOS" target, which allows you to create rules in
883 the "mangle" table which alter the Type Of Service field of an IPv4
884 or the Priority field of an IPv6 packet, prior to routing.
886 To compile it as a module, choose M here. If unsure, say N.
888 config NETFILTER_XT_TARGET_HL
889 tristate '"HL" hoplimit target support'
890 depends on IP_NF_MANGLE || IP6_NF_MANGLE
891 depends on NETFILTER_ADVANCED
893 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
894 targets, which enable the user to change the
895 hoplimit/time-to-live value of the IP header.
897 While it is safe to decrement the hoplimit/TTL value, the
898 modules also allow to increment and set the hoplimit value of
899 the header to arbitrary values. This is EXTREMELY DANGEROUS
900 since you can easily create immortal packets that loop
901 forever on the network.
903 config NETFILTER_XT_TARGET_HMARK
904 tristate '"HMARK" target support'
905 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
906 depends on NETFILTER_ADVANCED
908 This option adds the "HMARK" target.
910 The target allows you to create rules in the "raw" and "mangle" tables
911 which set the skbuff mark by means of hash calculation within a given
912 range. The nfmark can influence the routing method and can also be used
913 by other subsystems to change their behaviour.
915 To compile it as a module, choose M here. If unsure, say N.
917 config NETFILTER_XT_TARGET_IDLETIMER
918 tristate "IDLETIMER target support"
919 depends on NETFILTER_ADVANCED
922 This option adds the `IDLETIMER' target. Each matching packet
923 resets the timer associated with label specified when the rule is
924 added. When the timer expires, it triggers a sysfs notification.
925 The remaining time for expiration can be read via sysfs.
927 To compile it as a module, choose M here. If unsure, say N.
929 config NETFILTER_XT_TARGET_LED
930 tristate '"LED" target support'
931 depends on LEDS_CLASS && LEDS_TRIGGERS
932 depends on NETFILTER_ADVANCED
934 This option adds a `LED' target, which allows you to blink LEDs in
935 response to particular packets passing through your machine.
937 This can be used to turn a spare LED into a network activity LED,
938 which only flashes in response to FTP transfers, for example. Or
939 you could have an LED which lights up for a minute or two every time
940 somebody connects to your machine via SSH.
942 You will need support for the "led" class to make this work.
944 To create an LED trigger for incoming SSH traffic:
945 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
947 Then attach the new trigger to an LED on your system:
948 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
950 For more information on the LEDs available on your system, see
951 Documentation/leds/leds-class.rst
953 config NETFILTER_XT_TARGET_LOG
954 tristate "LOG target support"
956 select NF_LOG_IPV6 if IP6_NF_IPTABLES
957 default m if NETFILTER_ADVANCED=n
959 This option adds a `LOG' target, which allows you to create rules in
960 any iptables table which records the packet header to the syslog.
962 To compile it as a module, choose M here. If unsure, say N.
964 config NETFILTER_XT_TARGET_MARK
965 tristate '"MARK" target support'
966 depends on NETFILTER_ADVANCED
967 select NETFILTER_XT_MARK
969 This is a backwards-compat option for the user's convenience
970 (e.g. when running oldconfig). It selects
971 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
973 config NETFILTER_XT_NAT
974 tristate '"SNAT and DNAT" targets support'
977 This option enables the SNAT and DNAT targets.
979 To compile it as a module, choose M here. If unsure, say N.
981 config NETFILTER_XT_TARGET_NETMAP
982 tristate '"NETMAP" target support'
985 NETMAP is an implementation of static 1:1 NAT mapping of network
986 addresses. It maps the network address part, while keeping the host
989 To compile it as a module, choose M here. If unsure, say N.
991 config NETFILTER_XT_TARGET_NFLOG
992 tristate '"NFLOG" target support'
993 default m if NETFILTER_ADVANCED=n
994 select NETFILTER_NETLINK_LOG
996 This option enables the NFLOG target, which allows to LOG
997 messages through nfnetlink_log.
999 To compile it as a module, choose M here. If unsure, say N.
1001 config NETFILTER_XT_TARGET_NFQUEUE
1002 tristate '"NFQUEUE" target Support'
1003 depends on NETFILTER_ADVANCED
1004 select NETFILTER_NETLINK_QUEUE
1006 This target replaced the old obsolete QUEUE target.
1008 As opposed to QUEUE, it supports 65535 different queues,
1011 To compile it as a module, choose M here. If unsure, say N.
1013 config NETFILTER_XT_TARGET_NOTRACK
1014 tristate '"NOTRACK" target support (DEPRECATED)'
1015 depends on NF_CONNTRACK
1016 depends on IP_NF_RAW || IP6_NF_RAW
1017 depends on NETFILTER_ADVANCED
1018 select NETFILTER_XT_TARGET_CT
1020 config NETFILTER_XT_TARGET_RATEEST
1021 tristate '"RATEEST" target support'
1022 depends on NETFILTER_ADVANCED
1024 This option adds a `RATEEST' target, which allows to measure
1025 rates similar to TC estimators. The `rateest' match can be
1026 used to match on the measured rates.
1028 To compile it as a module, choose M here. If unsure, say N.
1030 config NETFILTER_XT_TARGET_REDIRECT
1031 tristate "REDIRECT target support"
1033 select NF_NAT_REDIRECT
1035 REDIRECT is a special case of NAT: all incoming connections are
1036 mapped onto the incoming interface's address, causing the packets to
1037 come to the local machine instead of passing through. This is
1038 useful for transparent proxies.
1040 To compile it as a module, choose M here. If unsure, say N.
1042 config NETFILTER_XT_TARGET_MASQUERADE
1043 tristate "MASQUERADE target support"
1045 default m if NETFILTER_ADVANCED=n
1046 select NF_NAT_MASQUERADE
1048 Masquerading is a special case of NAT: all outgoing connections are
1049 changed to seem to come from a particular interface's address, and
1050 if the interface goes down, those connections are lost. This is
1051 only useful for dialup accounts with dynamic IP address (ie. your IP
1052 address will be different on next dialup).
1054 To compile it as a module, choose M here. If unsure, say N.
1056 config NETFILTER_XT_TARGET_TEE
1057 tristate '"TEE" - packet cloning to alternate destination'
1058 depends on NETFILTER_ADVANCED
1059 depends on IPV6 || IPV6=n
1060 depends on !NF_CONNTRACK || NF_CONNTRACK
1061 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1063 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1065 This option adds a "TEE" target with which a packet can be cloned and
1066 this clone be rerouted to another nexthop.
1068 config NETFILTER_XT_TARGET_TPROXY
1069 tristate '"TPROXY" target transparent proxying support'
1070 depends on NETFILTER_XTABLES
1071 depends on NETFILTER_ADVANCED
1072 depends on IPV6 || IPV6=n
1073 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1074 depends on IP_NF_MANGLE
1075 select NF_DEFRAG_IPV4
1076 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1077 select NF_TPROXY_IPV4
1078 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1080 This option adds a `TPROXY' target, which is somewhat similar to
1081 REDIRECT. It can only be used in the mangle table and is useful
1082 to redirect traffic to a transparent proxy. It does _not_ depend
1083 on Netfilter connection tracking and NAT, unlike REDIRECT.
1084 For it to work you will have to configure certain iptables rules
1085 and use policy routing. For more information on how to set it up
1086 see Documentation/networking/tproxy.rst.
1088 To compile it as a module, choose M here. If unsure, say N.
1090 config NETFILTER_XT_TARGET_TRACE
1091 tristate '"TRACE" target support'
1092 depends on IP_NF_RAW || IP6_NF_RAW
1093 depends on NETFILTER_ADVANCED
1095 The TRACE target allows you to mark packets so that the kernel
1096 will log every rule which match the packets as those traverse
1097 the tables, chains, rules.
1099 If you want to compile it as a module, say M here and read
1100 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1102 config NETFILTER_XT_TARGET_SECMARK
1103 tristate '"SECMARK" target support'
1104 depends on NETWORK_SECMARK
1105 default m if NETFILTER_ADVANCED=n
1107 The SECMARK target allows security marking of network
1108 packets, for use with security subsystems.
1110 To compile it as a module, choose M here. If unsure, say N.
1112 config NETFILTER_XT_TARGET_TCPMSS
1113 tristate '"TCPMSS" target support'
1114 depends on IPV6 || IPV6=n
1115 default m if NETFILTER_ADVANCED=n
1117 This option adds a `TCPMSS' target, which allows you to alter the
1118 MSS value of TCP SYN packets, to control the maximum size for that
1119 connection (usually limiting it to your outgoing interface's MTU
1122 This is used to overcome criminally braindead ISPs or servers which
1123 block ICMP Fragmentation Needed packets. The symptoms of this
1124 problem are that everything works fine from your Linux
1125 firewall/router, but machines behind it can never exchange large
1127 1) Web browsers connect, then hang with no data received.
1128 2) Small mail works fine, but large emails hang.
1129 3) ssh works fine, but scp hangs after initial handshaking.
1131 Workaround: activate this option and add a rule to your firewall
1134 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1135 -j TCPMSS --clamp-mss-to-pmtu
1137 To compile it as a module, choose M here. If unsure, say N.
1139 config NETFILTER_XT_TARGET_TCPOPTSTRIP
1140 tristate '"TCPOPTSTRIP" target support'
1141 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1142 depends on NETFILTER_ADVANCED
1144 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1145 TCP options from TCP packets.
1147 # alphabetically ordered list of matches
1149 comment "Xtables matches"
1151 config NETFILTER_XT_MATCH_ADDRTYPE
1152 tristate '"addrtype" address type match support'
1153 default m if NETFILTER_ADVANCED=n
1155 This option allows you to match what routing thinks of an address,
1156 eg. UNICAST, LOCAL, BROADCAST, ...
1158 If you want to compile it as a module, say M here and read
1159 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1161 config NETFILTER_XT_MATCH_BPF
1162 tristate '"bpf" match support'
1163 depends on NETFILTER_ADVANCED
1165 BPF matching applies a linux socket filter to each packet and
1166 accepts those for which the filter returns non-zero.
1168 To compile it as a module, choose M here. If unsure, say N.
1170 config NETFILTER_XT_MATCH_CGROUP
1171 tristate '"control group" match support'
1172 depends on NETFILTER_ADVANCED
1174 select CGROUP_NET_CLASSID
1176 Socket/process control group matching allows you to match locally
1177 generated packets based on which net_cls control group processes
1180 config NETFILTER_XT_MATCH_CLUSTER
1181 tristate '"cluster" match support'
1182 depends on NF_CONNTRACK
1183 depends on NETFILTER_ADVANCED
1185 This option allows you to build work-load-sharing clusters of
1186 network servers/stateful firewalls without having a dedicated
1187 load-balancing router/server/switch. Basically, this match returns
1188 true when the packet must be handled by this cluster node. Thus,
1189 all nodes see all packets and this match decides which node handles
1190 what packets. The work-load sharing algorithm is based on source
1193 If you say Y or M here, try `iptables -m cluster --help` for
1196 config NETFILTER_XT_MATCH_COMMENT
1197 tristate '"comment" match support'
1198 depends on NETFILTER_ADVANCED
1200 This option adds a `comment' dummy-match, which allows you to put
1201 comments in your iptables ruleset.
1203 If you want to compile it as a module, say M here and read
1204 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1206 config NETFILTER_XT_MATCH_CONNBYTES
1207 tristate '"connbytes" per-connection counter match support'
1208 depends on NF_CONNTRACK
1209 depends on NETFILTER_ADVANCED
1211 This option adds a `connbytes' match, which allows you to match the
1212 number of bytes and/or packets for each direction within a connection.
1214 If you want to compile it as a module, say M here and read
1215 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1217 config NETFILTER_XT_MATCH_CONNLABEL
1218 tristate '"connlabel" match support'
1219 select NF_CONNTRACK_LABELS
1220 depends on NF_CONNTRACK
1221 depends on NETFILTER_ADVANCED
1223 This match allows you to test and assign userspace-defined labels names
1224 to a connection. The kernel only stores bit values - mapping
1225 names to bits is done by userspace.
1227 Unlike connmark, more than 32 flag bits may be assigned to a
1228 connection simultaneously.
1230 config NETFILTER_XT_MATCH_CONNLIMIT
1231 tristate '"connlimit" match support'
1232 depends on NF_CONNTRACK
1233 depends on NETFILTER_ADVANCED
1234 select NETFILTER_CONNCOUNT
1236 This match allows you to match against the number of parallel
1237 connections to a server per client IP address (or address block).
1239 config NETFILTER_XT_MATCH_CONNMARK
1240 tristate '"connmark" connection mark match support'
1241 depends on NF_CONNTRACK
1242 depends on NETFILTER_ADVANCED
1243 select NETFILTER_XT_CONNMARK
1245 This is a backwards-compat option for the user's convenience
1246 (e.g. when running oldconfig). It selects
1247 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1249 config NETFILTER_XT_MATCH_CONNTRACK
1250 tristate '"conntrack" connection tracking match support'
1251 depends on NF_CONNTRACK
1252 default m if NETFILTER_ADVANCED=n
1254 This is a general conntrack match module, a superset of the state match.
1256 It allows matching on additional conntrack information, which is
1257 useful in complex configurations, such as NAT gateways with multiple
1258 internet links or tunnels.
1260 To compile it as a module, choose M here. If unsure, say N.
1262 config NETFILTER_XT_MATCH_CPU
1263 tristate '"cpu" match support'
1264 depends on NETFILTER_ADVANCED
1266 CPU matching allows you to match packets based on the CPU
1267 currently handling the packet.
1269 To compile it as a module, choose M here. If unsure, say N.
1271 config NETFILTER_XT_MATCH_DCCP
1272 tristate '"dccp" protocol match support'
1273 depends on NETFILTER_ADVANCED
1276 With this option enabled, you will be able to use the iptables
1277 `dccp' match in order to match on DCCP source/destination ports
1280 If you want to compile it as a module, say M here and read
1281 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1283 config NETFILTER_XT_MATCH_DEVGROUP
1284 tristate '"devgroup" match support'
1285 depends on NETFILTER_ADVANCED
1287 This options adds a `devgroup' match, which allows to match on the
1288 device group a network device is assigned to.
1290 To compile it as a module, choose M here. If unsure, say N.
1292 config NETFILTER_XT_MATCH_DSCP
1293 tristate '"dscp" and "tos" match support'
1294 depends on NETFILTER_ADVANCED
1296 This option adds a `DSCP' match, which allows you to match against
1297 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1299 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1301 It will also add a "tos" match, which allows you to match packets
1302 based on the Type Of Service fields of the IPv4 packet (which share
1303 the same bits as DSCP).
1305 To compile it as a module, choose M here. If unsure, say N.
1307 config NETFILTER_XT_MATCH_ECN
1308 tristate '"ecn" match support'
1309 depends on NETFILTER_ADVANCED
1311 This option adds an "ECN" match, which allows you to match against
1312 the IPv4 and TCP header ECN fields.
1314 To compile it as a module, choose M here. If unsure, say N.
1316 config NETFILTER_XT_MATCH_ESP
1317 tristate '"esp" match support'
1318 depends on NETFILTER_ADVANCED
1320 This match extension allows you to match a range of SPIs
1321 inside ESP header of IPSec packets.
1323 To compile it as a module, choose M here. If unsure, say N.
1325 config NETFILTER_XT_MATCH_HASHLIMIT
1326 tristate '"hashlimit" match support'
1327 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1328 depends on NETFILTER_ADVANCED
1330 This option adds a `hashlimit' match.
1332 As opposed to `limit', this match dynamically creates a hash table
1333 of limit buckets, based on your selection of source/destination
1334 addresses and/or ports.
1336 It enables you to express policies like `10kpps for any given
1337 destination address' or `500pps from any given source address'
1340 config NETFILTER_XT_MATCH_HELPER
1341 tristate '"helper" match support'
1342 depends on NF_CONNTRACK
1343 depends on NETFILTER_ADVANCED
1345 Helper matching allows you to match packets in dynamic connections
1346 tracked by a conntrack-helper, ie. nf_conntrack_ftp
1348 To compile it as a module, choose M here. If unsure, say Y.
1350 config NETFILTER_XT_MATCH_HL
1351 tristate '"hl" hoplimit/TTL match support'
1352 depends on NETFILTER_ADVANCED
1354 HL matching allows you to match packets based on the hoplimit
1355 in the IPv6 header, or the time-to-live field in the IPv4
1356 header of the packet.
1358 config NETFILTER_XT_MATCH_IPCOMP
1359 tristate '"ipcomp" match support'
1360 depends on NETFILTER_ADVANCED
1362 This match extension allows you to match a range of CPIs(16 bits)
1363 inside IPComp header of IPSec packets.
1365 To compile it as a module, choose M here. If unsure, say N.
1367 config NETFILTER_XT_MATCH_IPRANGE
1368 tristate '"iprange" address range match support'
1369 depends on NETFILTER_ADVANCED
1371 This option adds a "iprange" match, which allows you to match based on
1372 an IP address range. (Normal iptables only matches on single addresses
1373 with an optional mask.)
1377 config NETFILTER_XT_MATCH_IPVS
1378 tristate '"ipvs" match support'
1380 depends on NETFILTER_ADVANCED
1381 depends on NF_CONNTRACK
1383 This option allows you to match against IPVS properties of a packet.
1387 config NETFILTER_XT_MATCH_L2TP
1388 tristate '"l2tp" match support'
1389 depends on NETFILTER_ADVANCED
1392 This option adds an "L2TP" match, which allows you to match against
1393 L2TP protocol header fields.
1395 To compile it as a module, choose M here. If unsure, say N.
1397 config NETFILTER_XT_MATCH_LENGTH
1398 tristate '"length" match support'
1399 depends on NETFILTER_ADVANCED
1401 This option allows you to match the length of a packet against a
1402 specific value or range of values.
1404 To compile it as a module, choose M here. If unsure, say N.
1406 config NETFILTER_XT_MATCH_LIMIT
1407 tristate '"limit" match support'
1408 depends on NETFILTER_ADVANCED
1410 limit matching allows you to control the rate at which a rule can be
1411 matched: mainly useful in combination with the LOG target ("LOG
1412 target support", below) and to avoid some Denial of Service attacks.
1414 To compile it as a module, choose M here. If unsure, say N.
1416 config NETFILTER_XT_MATCH_MAC
1417 tristate '"mac" address match support'
1418 depends on NETFILTER_ADVANCED
1420 MAC matching allows you to match packets based on the source
1421 Ethernet address of the packet.
1423 To compile it as a module, choose M here. If unsure, say N.
1425 config NETFILTER_XT_MATCH_MARK
1426 tristate '"mark" match support'
1427 depends on NETFILTER_ADVANCED
1428 select NETFILTER_XT_MARK
1430 This is a backwards-compat option for the user's convenience
1431 (e.g. when running oldconfig). It selects
1432 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1434 config NETFILTER_XT_MATCH_MULTIPORT
1435 tristate '"multiport" Multiple port match support'
1436 depends on NETFILTER_ADVANCED
1438 Multiport matching allows you to match TCP or UDP packets based on
1439 a series of source or destination ports: normally a rule can only
1440 match a single range of ports.
1442 To compile it as a module, choose M here. If unsure, say N.
1444 config NETFILTER_XT_MATCH_NFACCT
1445 tristate '"nfacct" match support'
1446 depends on NETFILTER_ADVANCED
1447 select NETFILTER_NETLINK_ACCT
1449 This option allows you to use the extended accounting through
1452 To compile it as a module, choose M here. If unsure, say N.
1454 config NETFILTER_XT_MATCH_OSF
1455 tristate '"osf" Passive OS fingerprint match'
1456 depends on NETFILTER_ADVANCED
1457 select NETFILTER_NETLINK_OSF
1459 This option selects the Passive OS Fingerprinting match module
1460 that allows to passively match the remote operating system by
1461 analyzing incoming TCP SYN packets.
1463 Rules and loading software can be downloaded from
1464 http://www.ioremap.net/projects/osf
1466 To compile it as a module, choose M here. If unsure, say N.
1468 config NETFILTER_XT_MATCH_OWNER
1469 tristate '"owner" match support'
1470 depends on NETFILTER_ADVANCED
1472 Socket owner matching allows you to match locally-generated packets
1473 based on who created the socket: the user or group. It is also
1474 possible to check whether a socket actually exists.
1476 config NETFILTER_XT_MATCH_POLICY
1477 tristate 'IPsec "policy" match support'
1479 default m if NETFILTER_ADVANCED=n
1481 Policy matching allows you to match packets based on the
1482 IPsec policy that was used during decapsulation/will
1483 be used during encapsulation.
1485 To compile it as a module, choose M here. If unsure, say N.
1487 config NETFILTER_XT_MATCH_PHYSDEV
1488 tristate '"physdev" match support'
1489 depends on BRIDGE && BRIDGE_NETFILTER
1490 depends on NETFILTER_ADVANCED
1492 Physdev packet matching matches against the physical bridge ports
1493 the IP packet arrived on or will leave by.
1495 To compile it as a module, choose M here. If unsure, say N.
1497 config NETFILTER_XT_MATCH_PKTTYPE
1498 tristate '"pkttype" packet type match support'
1499 depends on NETFILTER_ADVANCED
1501 Packet type matching allows you to match a packet by
1502 its "class", eg. BROADCAST, MULTICAST, ...
1505 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1507 To compile it as a module, choose M here. If unsure, say N.
1509 config NETFILTER_XT_MATCH_QUOTA
1510 tristate '"quota" match support'
1511 depends on NETFILTER_ADVANCED
1513 This option adds a `quota' match, which allows to match on a
1516 If you want to compile it as a module, say M here and read
1517 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1519 config NETFILTER_XT_MATCH_RATEEST
1520 tristate '"rateest" match support'
1521 depends on NETFILTER_ADVANCED
1522 select NETFILTER_XT_TARGET_RATEEST
1524 This option adds a `rateest' match, which allows to match on the
1525 rate estimated by the RATEEST target.
1527 To compile it as a module, choose M here. If unsure, say N.
1529 config NETFILTER_XT_MATCH_REALM
1530 tristate '"realm" match support'
1531 depends on NETFILTER_ADVANCED
1532 select IP_ROUTE_CLASSID
1534 This option adds a `realm' match, which allows you to use the realm
1535 key from the routing subsystem inside iptables.
1537 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1540 If you want to compile it as a module, say M here and read
1541 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1543 config NETFILTER_XT_MATCH_RECENT
1544 tristate '"recent" match support'
1545 depends on NETFILTER_ADVANCED
1547 This match is used for creating one or many lists of recently
1548 used addresses and then matching against that/those list(s).
1550 Short options are available by using 'iptables -m recent -h'
1551 Official Website: <http://snowman.net/projects/ipt_recent/>
1553 config NETFILTER_XT_MATCH_SCTP
1554 tristate '"sctp" protocol match support'
1555 depends on NETFILTER_ADVANCED
1558 With this option enabled, you will be able to use the
1559 `sctp' match in order to match on SCTP source/destination ports
1560 and SCTP chunk types.
1562 If you want to compile it as a module, say M here and read
1563 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1565 config NETFILTER_XT_MATCH_SOCKET
1566 tristate '"socket" match support'
1567 depends on NETFILTER_XTABLES
1568 depends on NETFILTER_ADVANCED
1569 depends on IPV6 || IPV6=n
1570 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1571 select NF_SOCKET_IPV4
1572 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1573 select NF_DEFRAG_IPV4
1574 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1576 This option adds a `socket' match, which can be used to match
1577 packets for which a TCP or UDP socket lookup finds a valid socket.
1578 It can be used in combination with the MARK target and policy
1579 routing to implement full featured non-locally bound sockets.
1581 To compile it as a module, choose M here. If unsure, say N.
1583 config NETFILTER_XT_MATCH_STATE
1584 tristate '"state" match support'
1585 depends on NF_CONNTRACK
1586 default m if NETFILTER_ADVANCED=n
1588 Connection state matching allows you to match packets based on their
1589 relationship to a tracked connection (ie. previous packets). This
1590 is a powerful tool for packet classification.
1592 To compile it as a module, choose M here. If unsure, say N.
1594 config NETFILTER_XT_MATCH_STATISTIC
1595 tristate '"statistic" match support'
1596 depends on NETFILTER_ADVANCED
1598 This option adds a `statistic' match, which allows you to match
1599 on packets periodically or randomly with a given percentage.
1601 To compile it as a module, choose M here. If unsure, say N.
1603 config NETFILTER_XT_MATCH_STRING
1604 tristate '"string" match support'
1605 depends on NETFILTER_ADVANCED
1607 select TEXTSEARCH_KMP
1608 select TEXTSEARCH_BM
1609 select TEXTSEARCH_FSM
1611 This option adds a `string' match, which allows you to look for
1612 pattern matchings in packets.
1614 To compile it as a module, choose M here. If unsure, say N.
1616 config NETFILTER_XT_MATCH_TCPMSS
1617 tristate '"tcpmss" match support'
1618 depends on NETFILTER_ADVANCED
1620 This option adds a `tcpmss' match, which allows you to examine the
1621 MSS value of TCP SYN packets, which control the maximum packet size
1622 for that connection.
1624 To compile it as a module, choose M here. If unsure, say N.
1626 config NETFILTER_XT_MATCH_TIME
1627 tristate '"time" match support'
1628 depends on NETFILTER_ADVANCED
1630 This option adds a "time" match, which allows you to match based on
1631 the packet arrival time (at the machine which netfilter is running)
1632 on) or departure time/date (for locally generated packets).
1634 If you say Y here, try `iptables -m time --help` for
1637 If you want to compile it as a module, say M here.
1640 config NETFILTER_XT_MATCH_U32
1641 tristate '"u32" match support'
1642 depends on NETFILTER_ADVANCED
1644 u32 allows you to extract quantities of up to 4 bytes from a packet,
1645 AND them with specified masks, shift them by specified amounts and
1646 test whether the results are in any of a set of specified ranges.
1647 The specification of what to extract is general enough to skip over
1648 headers with lengths stored in the packet, as in IP or TCP header
1651 Details and examples are in the kernel module source.
1653 endif # NETFILTER_XTABLES
1657 source "net/netfilter/ipset/Kconfig"
1659 source "net/netfilter/ipvs/Kconfig"