1 menu "Core Netfilter Configuration"
2 depends on NET && INET && NETFILTER
4 config NETFILTER_INGRESS
5 bool "Netfilter ingress support"
9 This allows you to classify packets from ingress using the Netfilter
12 config NETFILTER_NETLINK
15 config NETFILTER_FAMILY_BRIDGE
18 config NETFILTER_FAMILY_ARP
21 config NETFILTER_NETLINK_ACCT
22 tristate "Netfilter NFACCT over NFNETLINK interface"
23 depends on NETFILTER_ADVANCED
24 select NETFILTER_NETLINK
26 If this option is enabled, the kernel will include support
27 for extended accounting via NFNETLINK.
29 config NETFILTER_NETLINK_QUEUE
30 tristate "Netfilter NFQUEUE over NFNETLINK interface"
31 depends on NETFILTER_ADVANCED
32 select NETFILTER_NETLINK
34 If this option is enabled, the kernel will include support
35 for queueing packets via NFNETLINK.
37 config NETFILTER_NETLINK_LOG
38 tristate "Netfilter LOG over NFNETLINK interface"
39 default m if NETFILTER_ADVANCED=n
40 select NETFILTER_NETLINK
42 If this option is enabled, the kernel will include support
43 for logging packets via NFNETLINK.
45 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
46 and is also scheduled to replace the old syslog-based ipt_LOG
49 config NETFILTER_NETLINK_OSF
50 tristate "Netfilter OSF over NFNETLINK interface"
51 depends on NETFILTER_ADVANCED
52 select NETFILTER_NETLINK
54 If this option is enabled, the kernel will include support
55 for passive OS fingerprint via NFNETLINK.
58 tristate "Netfilter connection tracking support"
59 default m if NETFILTER_ADVANCED=n
61 select NF_DEFRAG_IPV6 if IPV6 != n
63 Connection tracking keeps a record of what packets have passed
64 through your machine, in order to figure out how they are related
67 This is required to do Masquerading or other kinds of Network
68 Address Translation. It can also be used to enhance packet
69 filtering (see `Connection state match support' below).
71 To compile it as a module, choose M here. If unsure, say N.
77 tristate "Netdev packet logging"
81 config NETFILTER_CONNCOUNT
84 config NF_CONNTRACK_MARK
85 bool 'Connection mark tracking support'
86 depends on NETFILTER_ADVANCED
88 This option enables support for connection marks, used by the
89 `CONNMARK' target and `connmark' match. Similar to the mark value
90 of packets, but this mark value is kept in the conntrack session
91 instead of the individual packets.
93 config NF_CONNTRACK_SECMARK
94 bool 'Connection tracking security mark support'
95 depends on NETWORK_SECMARK
96 default m if NETFILTER_ADVANCED=n
98 This option enables security markings to be applied to
99 connections. Typically they are copied to connections from
100 packets using the CONNSECMARK target and copied back from
101 connections to packets with the same target, with the packets
102 being originally labeled via SECMARK.
106 config NF_CONNTRACK_ZONES
107 bool 'Connection tracking zones'
108 depends on NETFILTER_ADVANCED
110 This option enables support for connection tracking zones.
111 Normally, each connection needs to have a unique system wide
112 identity. Connection tracking zones allow to have multiple
113 connections using the same identity, as long as they are
114 contained in different zones.
118 config NF_CONNTRACK_PROCFS
119 bool "Supply CT list in procfs (OBSOLETE)"
123 This option enables for the list of known conntrack entries
124 to be shown in procfs under net/netfilter/nf_conntrack. This
125 is considered obsolete in favor of using the conntrack(8)
126 tool which uses Netlink.
128 config NF_CONNTRACK_EVENTS
129 bool "Connection tracking events"
130 depends on NETFILTER_ADVANCED
132 If this option is enabled, the connection tracking code will
133 provide a notifier chain that can be used by other kernel code
134 to get notified about changes in the connection tracking state.
138 config NF_CONNTRACK_TIMEOUT
139 bool 'Connection tracking timeout'
140 depends on NETFILTER_ADVANCED
142 This option enables support for connection tracking timeout
143 extension. This allows you to attach timeout policies to flow
148 config NF_CONNTRACK_TIMESTAMP
149 bool 'Connection tracking timestamping'
150 depends on NETFILTER_ADVANCED
152 This option enables support for connection tracking timestamping.
153 This allows you to store the flow start-time and to obtain
154 the flow-stop time (once it has been destroyed) via Connection
159 config NF_CONNTRACK_LABELS
160 bool "Connection tracking labels"
162 This option enables support for assigning user-defined flag bits
163 to connection tracking entries. It can be used with xtables connlabel
164 match and the nftables ct expression.
166 config NF_CT_PROTO_DCCP
167 bool 'DCCP protocol connection tracking support'
168 depends on NETFILTER_ADVANCED
171 With this option enabled, the layer 3 independent connection
172 tracking code will be able to do state tracking on DCCP connections.
176 config NF_CT_PROTO_GRE
179 config NF_CT_PROTO_SCTP
180 bool 'SCTP protocol connection tracking support'
181 depends on NETFILTER_ADVANCED
185 With this option enabled, the layer 3 independent connection
186 tracking code will be able to do state tracking on SCTP connections.
190 config NF_CT_PROTO_UDPLITE
191 bool 'UDP-Lite protocol connection tracking support'
192 depends on NETFILTER_ADVANCED
195 With this option enabled, the layer 3 independent connection
196 tracking code will be able to do state tracking on UDP-Lite
201 config NF_CONNTRACK_AMANDA
202 tristate "Amanda backup protocol support"
203 depends on NETFILTER_ADVANCED
205 select TEXTSEARCH_KMP
207 If you are running the Amanda backup package <http://www.amanda.org/>
208 on this machine or machines that will be MASQUERADED through this
209 machine, then you may want to enable this feature. This allows the
210 connection tracking and natting code to allow the sub-channels that
211 Amanda requires for communication of the backup data, messages and
214 To compile it as a module, choose M here. If unsure, say N.
216 config NF_CONNTRACK_FTP
217 tristate "FTP protocol support"
218 default m if NETFILTER_ADVANCED=n
220 Tracking FTP connections is problematic: special helpers are
221 required for tracking them, and doing masquerading and other forms
222 of Network Address Translation on them.
224 This is FTP support on Layer 3 independent connection tracking.
225 Layer 3 independent connection tracking is experimental scheme
226 which generalize ip_conntrack to support other layer 3 protocols.
228 To compile it as a module, choose M here. If unsure, say N.
230 config NF_CONNTRACK_H323
231 tristate "H.323 protocol support"
232 depends on IPV6 || IPV6=n
233 depends on NETFILTER_ADVANCED
235 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
236 important VoIP protocols, it is widely used by voice hardware and
237 software including voice gateways, IP phones, Netmeeting, OpenPhone,
240 With this module you can support H.323 on a connection tracking/NAT
243 This module supports RAS, Fast Start, H.245 Tunnelling, Call
244 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
245 whiteboard, file transfer, etc. For more information, please
246 visit http://nath323.sourceforge.net/.
248 To compile it as a module, choose M here. If unsure, say N.
250 config NF_CONNTRACK_IRC
251 tristate "IRC protocol support"
252 default m if NETFILTER_ADVANCED=n
254 There is a commonly-used extension to IRC called
255 Direct Client-to-Client Protocol (DCC). This enables users to send
256 files to each other, and also chat to each other without the need
257 of a server. DCC Sending is used anywhere you send files over IRC,
258 and DCC Chat is most commonly used by Eggdrop bots. If you are
259 using NAT, this extension will enable you to send files and initiate
260 chats. Note that you do NOT need this extension to get files or
261 have others initiate chats, or everything else in IRC.
263 To compile it as a module, choose M here. If unsure, say N.
265 config NF_CONNTRACK_BROADCAST
268 config NF_CONNTRACK_NETBIOS_NS
269 tristate "NetBIOS name service protocol support"
270 select NF_CONNTRACK_BROADCAST
272 NetBIOS name service requests are sent as broadcast messages from an
273 unprivileged port and responded to with unicast messages to the
274 same port. This make them hard to firewall properly because connection
275 tracking doesn't deal with broadcasts. This helper tracks locally
276 originating NetBIOS name service requests and the corresponding
277 responses. It relies on correct IP address configuration, specifically
278 netmask and broadcast address. When properly configured, the output
279 of "ip address show" should look similar to this:
281 $ ip -4 address show eth0
282 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
283 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
285 To compile it as a module, choose M here. If unsure, say N.
287 config NF_CONNTRACK_SNMP
288 tristate "SNMP service protocol support"
289 depends on NETFILTER_ADVANCED
290 select NF_CONNTRACK_BROADCAST
292 SNMP service requests are sent as broadcast messages from an
293 unprivileged port and responded to with unicast messages to the
294 same port. This make them hard to firewall properly because connection
295 tracking doesn't deal with broadcasts. This helper tracks locally
296 originating SNMP service requests and the corresponding
297 responses. It relies on correct IP address configuration, specifically
298 netmask and broadcast address.
300 To compile it as a module, choose M here. If unsure, say N.
302 config NF_CONNTRACK_PPTP
303 tristate "PPtP protocol support"
304 depends on NETFILTER_ADVANCED
305 select NF_CT_PROTO_GRE
307 This module adds support for PPTP (Point to Point Tunnelling
308 Protocol, RFC2637) connection tracking and NAT.
310 If you are running PPTP sessions over a stateful firewall or NAT
311 box, you may want to enable this feature.
313 Please note that not all PPTP modes of operation are supported yet.
314 Specifically these limitations exist:
315 - Blindly assumes that control connections are always established
316 in PNS->PAC direction. This is a violation of RFC2637.
317 - Only supports a single call within each session
319 To compile it as a module, choose M here. If unsure, say N.
321 config NF_CONNTRACK_SANE
322 tristate "SANE protocol support"
323 depends on NETFILTER_ADVANCED
325 SANE is a protocol for remote access to scanners as implemented
326 by the 'saned' daemon. Like FTP, it uses separate control and
329 With this module you can support SANE on a connection tracking
332 To compile it as a module, choose M here. If unsure, say N.
334 config NF_CONNTRACK_SIP
335 tristate "SIP protocol support"
336 default m if NETFILTER_ADVANCED=n
338 SIP is an application-layer control protocol that can establish,
339 modify, and terminate multimedia sessions (conferences) such as
340 Internet telephony calls. With the ip_conntrack_sip and
341 the nf_nat_sip modules you can support the protocol on a connection
342 tracking/NATing firewall.
344 To compile it as a module, choose M here. If unsure, say N.
346 config NF_CONNTRACK_TFTP
347 tristate "TFTP protocol support"
348 depends on NETFILTER_ADVANCED
350 TFTP connection tracking helper, this is required depending
351 on how restrictive your ruleset is.
352 If you are using a tftp client behind -j SNAT or -j MASQUERADING
355 To compile it as a module, choose M here. If unsure, say N.
358 tristate 'Connection tracking netlink interface'
359 select NETFILTER_NETLINK
360 default m if NETFILTER_ADVANCED=n
362 This option enables support for a netlink-based userspace interface
364 config NF_CT_NETLINK_TIMEOUT
365 tristate 'Connection tracking timeout tuning via Netlink'
366 select NETFILTER_NETLINK
367 depends on NETFILTER_ADVANCED
368 depends on NF_CONNTRACK_TIMEOUT
370 This option enables support for connection tracking timeout
371 fine-grain tuning. This allows you to attach specific timeout
372 policies to flows, instead of using the global timeout policy.
376 config NF_CT_NETLINK_HELPER
377 tristate 'Connection tracking helpers in user-space via Netlink'
378 select NETFILTER_NETLINK
379 depends on NF_CT_NETLINK
380 depends on NETFILTER_NETLINK_QUEUE
381 depends on NETFILTER_NETLINK_GLUE_CT
382 depends on NETFILTER_ADVANCED
384 This option enables the user-space connection tracking helpers
389 config NETFILTER_NETLINK_GLUE_CT
390 bool "NFQUEUE and NFLOG integration with Connection Tracking"
392 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
394 If this option is enabled, NFQUEUE and NFLOG can include
395 Connection Tracking information together with the packet is
396 the enqueued via NFNETLINK.
408 depends on NF_CONNTRACK && NF_NAT
409 default NF_NAT && NF_CONNTRACK_AMANDA
413 depends on NF_CONNTRACK && NF_NAT
414 default NF_NAT && NF_CONNTRACK_FTP
418 depends on NF_CONNTRACK && NF_NAT
419 default NF_NAT && NF_CONNTRACK_IRC
423 depends on NF_CONNTRACK && NF_NAT
424 default NF_NAT && NF_CONNTRACK_SIP
428 depends on NF_CONNTRACK && NF_NAT
429 default NF_NAT && NF_CONNTRACK_TFTP
431 config NF_NAT_REDIRECT
434 config NETFILTER_SYNPROXY
440 select NETFILTER_NETLINK
441 tristate "Netfilter nf_tables support"
443 nftables is the new packet classification framework that intends to
444 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
445 provides a pseudo-state machine with an extensible instruction-set
446 (also known as expressions) that the userspace 'nft' utility
447 (http://www.netfilter.org/projects/nftables) uses to build the
448 rule-set. It also comes with the generic set infrastructure that
449 allows you to construct mappings between matchings and actions
450 for performance lookups.
452 To compile it as a module, choose M here.
457 tristate "Netfilter nf_tables set infrastructure"
459 This option enables the nf_tables set infrastructure that allows to
460 look up for elements in a set and to build one-way mappings between
461 matchings and actions.
463 config NF_TABLES_INET
465 select NF_TABLES_IPV4
466 select NF_TABLES_IPV6
467 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
469 This option enables support for a mixed IPv4/IPv6 "inet" table.
471 config NF_TABLES_NETDEV
472 bool "Netfilter nf_tables netdev tables support"
474 This option enables support for the "netdev" table.
477 tristate "Netfilter nf_tables number generator module"
479 This option adds the number generator expression used to perform
480 incremental counting and random numbers bound to a upper limit.
483 depends on NF_CONNTRACK
484 tristate "Netfilter nf_tables conntrack module"
486 This option adds the "ct" expression that you can use to match
487 connection tracking information such as the flow state.
489 config NFT_FLOW_OFFLOAD
490 depends on NF_CONNTRACK && NF_FLOW_TABLE
491 tristate "Netfilter nf_tables hardware flow offload module"
493 This option adds the "flow_offload" expression that you can use to
494 choose what flows are placed into the hardware.
497 tristate "Netfilter nf_tables counter module"
499 This option adds the "counter" expression that you can use to
500 include packet and byte counters in a rule.
503 tristate "Netfilter nf_tables connlimit module"
504 depends on NF_CONNTRACK
505 depends on NETFILTER_ADVANCED
506 select NETFILTER_CONNCOUNT
508 This option adds the "connlimit" expression that you can use to
509 ratelimit rule matchings per connections.
512 tristate "Netfilter nf_tables log module"
514 This option adds the "log" expression that you can use to log
515 packets matching some criteria.
518 tristate "Netfilter nf_tables limit module"
520 This option adds the "limit" expression that you can use to
521 ratelimit rule matchings.
524 depends on NF_CONNTRACK
526 tristate "Netfilter nf_tables masquerade support"
528 This option adds the "masquerade" expression that you can use
529 to perform NAT in the masquerade flavour.
532 depends on NF_CONNTRACK
534 tristate "Netfilter nf_tables redirect support"
536 This options adds the "redirect" expression that you can use
537 to perform NAT in the redirect flavour.
540 depends on NF_CONNTRACK
542 tristate "Netfilter nf_tables nat module"
544 This option adds the "nat" expression that you can use to perform
545 typical Network Address Translation (NAT) packet transformations.
548 tristate "Netfilter nf_tables tunnel module"
550 This option adds the "tunnel" expression that you can use to set
554 tristate "Netfilter nf_tables stateful object reference module"
556 This option adds the "objref" expression that allows you to refer to
557 stateful objects, such as counters and quotas.
560 depends on NETFILTER_NETLINK_QUEUE
561 tristate "Netfilter nf_tables queue module"
563 This is required if you intend to use the userspace queueing
564 infrastructure (also known as NFQUEUE) from nftables.
567 tristate "Netfilter nf_tables quota module"
569 This option adds the "quota" expression that you can use to match
570 enforce bytes quotas.
573 default m if NETFILTER_ADVANCED=n
574 tristate "Netfilter nf_tables reject support"
575 depends on !NF_TABLES_INET || (IPV6!=m || m)
577 This option adds the "reject" expression that you can use to
578 explicitly deny and notify via TCP reset/ICMP informational errors
581 config NFT_REJECT_INET
582 depends on NF_TABLES_INET
587 depends on NETFILTER_XTABLES
588 tristate "Netfilter x_tables over nf_tables module"
590 This is required if you intend to use any of existing
591 x_tables match/target extensions over the nf_tables
595 tristate "Netfilter nf_tables hash module"
597 This option adds the "hash" expression that you can use to perform
598 a hash operation on registers.
604 depends on NF_TABLES_INET
605 depends on NFT_FIB_IPV4
606 depends on NFT_FIB_IPV6
607 tristate "Netfilter nf_tables fib inet support"
609 This option allows using the FIB expression from the inet table.
610 The lookup will be delegated to the IPv4 or IPv6 FIB depending
611 on the protocol of the packet.
614 tristate "Netfilter nf_tables xfrm/IPSec security association matching"
617 This option adds an expression that you can use to extract properties
618 of a packets security association.
621 tristate "Netfilter nf_tables socket match support"
622 depends on IPV6 || IPV6=n
623 select NF_SOCKET_IPV4
624 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
626 This option allows matching for the presence or absence of a
627 corresponding socket and its attributes.
630 tristate "Netfilter nf_tables passive OS fingerprint support"
631 depends on NETFILTER_ADVANCED
632 select NETFILTER_NETLINK_OSF
634 This option allows matching packets from an specific OS.
637 tristate "Netfilter nf_tables tproxy support"
638 depends on IPV6 || IPV6=n
639 select NF_DEFRAG_IPV4
640 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
641 select NF_TPROXY_IPV4
642 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
644 This makes transparent proxy support available in nftables.
649 tristate "Netfilter packet duplication support"
651 This option enables the generic packet duplication infrastructure
654 config NFT_DUP_NETDEV
655 tristate "Netfilter nf_tables netdev packet duplication support"
658 This option enables packet duplication for the "netdev" family.
660 config NFT_FWD_NETDEV
661 tristate "Netfilter nf_tables netdev packet forwarding support"
664 This option enables packet forwarding for the "netdev" family.
666 config NFT_FIB_NETDEV
667 depends on NFT_FIB_IPV4
668 depends on NFT_FIB_IPV6
669 tristate "Netfilter nf_tables netdev fib lookups support"
671 This option allows using the FIB expression from the netdev table.
672 The lookup will be delegated to the IPv4 or IPv6 FIB depending
673 on the protocol of the packet.
675 endif # NF_TABLES_NETDEV
679 config NF_FLOW_TABLE_INET
680 tristate "Netfilter flow table mixed IPv4/IPv6 module"
681 depends on NF_FLOW_TABLE
683 This option adds the flow table mixed IPv4/IPv6 support.
685 To compile it as a module, choose M here.
688 tristate "Netfilter flow table module"
689 depends on NETFILTER_INGRESS
690 depends on NF_CONNTRACK
693 This option adds the flow table core infrastructure.
695 To compile it as a module, choose M here.
697 config NETFILTER_XTABLES
698 tristate "Netfilter Xtables support (required for ip_tables)"
699 default m if NETFILTER_ADVANCED=n
701 This is required if you intend to use any of ip_tables,
702 ip6_tables or arp_tables.
706 comment "Xtables combined modules"
708 config NETFILTER_XT_MARK
709 tristate 'nfmark target and match support'
710 default m if NETFILTER_ADVANCED=n
712 This option adds the "MARK" target and "mark" match.
714 Netfilter mark matching allows you to match packets based on the
715 "nfmark" value in the packet.
716 The target allows you to create rules in the "mangle" table which alter
717 the netfilter mark (nfmark) field associated with the packet.
719 Prior to routing, the nfmark can influence the routing method and can
720 also be used by other subsystems to change their behavior.
722 config NETFILTER_XT_CONNMARK
723 tristate 'ctmark target and match support'
724 depends on NF_CONNTRACK
725 depends on NETFILTER_ADVANCED
726 select NF_CONNTRACK_MARK
728 This option adds the "CONNMARK" target and "connmark" match.
730 Netfilter allows you to store a mark value per connection (a.k.a.
731 ctmark), similarly to the packet mark (nfmark). Using this
732 target and match, you can set and match on this mark.
734 config NETFILTER_XT_SET
735 tristate 'set target and match support'
737 depends on NETFILTER_ADVANCED
739 This option adds the "SET" target and "set" match.
741 Using this target and match, you can add/delete and match
742 elements in the sets created by ipset(8).
744 To compile it as a module, choose M here. If unsure, say N.
746 # alphabetically ordered list of targets
748 comment "Xtables targets"
750 config NETFILTER_XT_TARGET_AUDIT
751 tristate "AUDIT target support"
753 depends on NETFILTER_ADVANCED
755 This option adds a 'AUDIT' target, which can be used to create
756 audit records for packets dropped/accepted.
758 To compileit as a module, choose M here. If unsure, say N.
760 config NETFILTER_XT_TARGET_CHECKSUM
761 tristate "CHECKSUM target support"
762 depends on IP_NF_MANGLE || IP6_NF_MANGLE
763 depends on NETFILTER_ADVANCED
765 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
766 table to work around buggy DHCP clients in virtualized environments.
768 Some old DHCP clients drop packets because they are not aware
769 that the checksum would normally be offloaded to hardware and
770 thus should be considered valid.
771 This target can be used to fill in the checksum using iptables
772 when such packets are sent via a virtual network device.
774 To compile it as a module, choose M here. If unsure, say N.
776 config NETFILTER_XT_TARGET_CLASSIFY
777 tristate '"CLASSIFY" target support'
778 depends on NETFILTER_ADVANCED
780 This option adds a `CLASSIFY' target, which enables the user to set
781 the priority of a packet. Some qdiscs can use this value for
782 classification, among these are:
784 atm, cbq, dsmark, pfifo_fast, htb, prio
786 To compile it as a module, choose M here. If unsure, say N.
788 config NETFILTER_XT_TARGET_CONNMARK
789 tristate '"CONNMARK" target support'
790 depends on NF_CONNTRACK
791 depends on NETFILTER_ADVANCED
792 select NETFILTER_XT_CONNMARK
794 This is a backwards-compat option for the user's convenience
795 (e.g. when running oldconfig). It selects
796 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
798 config NETFILTER_XT_TARGET_CONNSECMARK
799 tristate '"CONNSECMARK" target support'
800 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
801 default m if NETFILTER_ADVANCED=n
803 The CONNSECMARK target copies security markings from packets
804 to connections, and restores security markings from connections
805 to packets (if the packets are not already marked). This would
806 normally be used in conjunction with the SECMARK target.
808 To compile it as a module, choose M here. If unsure, say N.
810 config NETFILTER_XT_TARGET_CT
811 tristate '"CT" target support'
812 depends on NF_CONNTRACK
813 depends on IP_NF_RAW || IP6_NF_RAW
814 depends on NETFILTER_ADVANCED
816 This options adds a `CT' target, which allows to specify initial
817 connection tracking parameters like events to be delivered and
818 the helper to be used.
820 To compile it as a module, choose M here. If unsure, say N.
822 config NETFILTER_XT_TARGET_DSCP
823 tristate '"DSCP" and "TOS" target support'
824 depends on IP_NF_MANGLE || IP6_NF_MANGLE
825 depends on NETFILTER_ADVANCED
827 This option adds a `DSCP' target, which allows you to manipulate
828 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
830 The DSCP field can have any value between 0x0 and 0x3f inclusive.
832 It also adds the "TOS" target, which allows you to create rules in
833 the "mangle" table which alter the Type Of Service field of an IPv4
834 or the Priority field of an IPv6 packet, prior to routing.
836 To compile it as a module, choose M here. If unsure, say N.
838 config NETFILTER_XT_TARGET_HL
839 tristate '"HL" hoplimit target support'
840 depends on IP_NF_MANGLE || IP6_NF_MANGLE
841 depends on NETFILTER_ADVANCED
843 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
844 targets, which enable the user to change the
845 hoplimit/time-to-live value of the IP header.
847 While it is safe to decrement the hoplimit/TTL value, the
848 modules also allow to increment and set the hoplimit value of
849 the header to arbitrary values. This is EXTREMELY DANGEROUS
850 since you can easily create immortal packets that loop
851 forever on the network.
853 config NETFILTER_XT_TARGET_HMARK
854 tristate '"HMARK" target support'
855 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
856 depends on NETFILTER_ADVANCED
858 This option adds the "HMARK" target.
860 The target allows you to create rules in the "raw" and "mangle" tables
861 which set the skbuff mark by means of hash calculation within a given
862 range. The nfmark can influence the routing method and can also be used
863 by other subsystems to change their behaviour.
865 To compile it as a module, choose M here. If unsure, say N.
867 config NETFILTER_XT_TARGET_IDLETIMER
868 tristate "IDLETIMER target support"
869 depends on NETFILTER_ADVANCED
872 This option adds the `IDLETIMER' target. Each matching packet
873 resets the timer associated with label specified when the rule is
874 added. When the timer expires, it triggers a sysfs notification.
875 The remaining time for expiration can be read via sysfs.
877 To compile it as a module, choose M here. If unsure, say N.
879 config NETFILTER_XT_TARGET_LED
880 tristate '"LED" target support'
881 depends on LEDS_CLASS && LEDS_TRIGGERS
882 depends on NETFILTER_ADVANCED
884 This option adds a `LED' target, which allows you to blink LEDs in
885 response to particular packets passing through your machine.
887 This can be used to turn a spare LED into a network activity LED,
888 which only flashes in response to FTP transfers, for example. Or
889 you could have an LED which lights up for a minute or two every time
890 somebody connects to your machine via SSH.
892 You will need support for the "led" class to make this work.
894 To create an LED trigger for incoming SSH traffic:
895 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
897 Then attach the new trigger to an LED on your system:
898 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
900 For more information on the LEDs available on your system, see
901 Documentation/leds/leds-class.txt
903 config NETFILTER_XT_TARGET_LOG
904 tristate "LOG target support"
907 select NF_LOG_IPV6 if IP6_NF_IPTABLES
908 default m if NETFILTER_ADVANCED=n
910 This option adds a `LOG' target, which allows you to create rules in
911 any iptables table which records the packet header to the syslog.
913 To compile it as a module, choose M here. If unsure, say N.
915 config NETFILTER_XT_TARGET_MARK
916 tristate '"MARK" target support'
917 depends on NETFILTER_ADVANCED
918 select NETFILTER_XT_MARK
920 This is a backwards-compat option for the user's convenience
921 (e.g. when running oldconfig). It selects
922 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
924 config NETFILTER_XT_NAT
925 tristate '"SNAT and DNAT" targets support'
928 This option enables the SNAT and DNAT targets.
930 To compile it as a module, choose M here. If unsure, say N.
932 config NETFILTER_XT_TARGET_NETMAP
933 tristate '"NETMAP" target support'
936 NETMAP is an implementation of static 1:1 NAT mapping of network
937 addresses. It maps the network address part, while keeping the host
940 To compile it as a module, choose M here. If unsure, say N.
942 config NETFILTER_XT_TARGET_NFLOG
943 tristate '"NFLOG" target support'
944 default m if NETFILTER_ADVANCED=n
945 select NETFILTER_NETLINK_LOG
947 This option enables the NFLOG target, which allows to LOG
948 messages through nfnetlink_log.
950 To compile it as a module, choose M here. If unsure, say N.
952 config NETFILTER_XT_TARGET_NFQUEUE
953 tristate '"NFQUEUE" target Support'
954 depends on NETFILTER_ADVANCED
955 select NETFILTER_NETLINK_QUEUE
957 This target replaced the old obsolete QUEUE target.
959 As opposed to QUEUE, it supports 65535 different queues,
962 To compile it as a module, choose M here. If unsure, say N.
964 config NETFILTER_XT_TARGET_NOTRACK
965 tristate '"NOTRACK" target support (DEPRECATED)'
966 depends on NF_CONNTRACK
967 depends on IP_NF_RAW || IP6_NF_RAW
968 depends on NETFILTER_ADVANCED
969 select NETFILTER_XT_TARGET_CT
971 config NETFILTER_XT_TARGET_RATEEST
972 tristate '"RATEEST" target support'
973 depends on NETFILTER_ADVANCED
975 This option adds a `RATEEST' target, which allows to measure
976 rates similar to TC estimators. The `rateest' match can be
977 used to match on the measured rates.
979 To compile it as a module, choose M here. If unsure, say N.
981 config NETFILTER_XT_TARGET_REDIRECT
982 tristate "REDIRECT target support"
984 select NF_NAT_REDIRECT
986 REDIRECT is a special case of NAT: all incoming connections are
987 mapped onto the incoming interface's address, causing the packets to
988 come to the local machine instead of passing through. This is
989 useful for transparent proxies.
991 To compile it as a module, choose M here. If unsure, say N.
993 config NETFILTER_XT_TARGET_TEE
994 tristate '"TEE" - packet cloning to alternate destination'
995 depends on NETFILTER_ADVANCED
996 depends on IPV6 || IPV6=n
997 depends on !NF_CONNTRACK || NF_CONNTRACK
999 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1001 This option adds a "TEE" target with which a packet can be cloned and
1002 this clone be rerouted to another nexthop.
1004 config NETFILTER_XT_TARGET_TPROXY
1005 tristate '"TPROXY" target transparent proxying support'
1006 depends on NETFILTER_XTABLES
1007 depends on NETFILTER_ADVANCED
1008 depends on IPV6 || IPV6=n
1009 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1010 depends on IP_NF_MANGLE
1011 select NF_DEFRAG_IPV4
1012 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1013 select NF_TPROXY_IPV4
1014 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1016 This option adds a `TPROXY' target, which is somewhat similar to
1017 REDIRECT. It can only be used in the mangle table and is useful
1018 to redirect traffic to a transparent proxy. It does _not_ depend
1019 on Netfilter connection tracking and NAT, unlike REDIRECT.
1020 For it to work you will have to configure certain iptables rules
1021 and use policy routing. For more information on how to set it up
1022 see Documentation/networking/tproxy.txt.
1024 To compile it as a module, choose M here. If unsure, say N.
1026 config NETFILTER_XT_TARGET_TRACE
1027 tristate '"TRACE" target support'
1028 depends on IP_NF_RAW || IP6_NF_RAW
1029 depends on NETFILTER_ADVANCED
1031 The TRACE target allows you to mark packets so that the kernel
1032 will log every rule which match the packets as those traverse
1033 the tables, chains, rules.
1035 If you want to compile it as a module, say M here and read
1036 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1038 config NETFILTER_XT_TARGET_SECMARK
1039 tristate '"SECMARK" target support'
1040 depends on NETWORK_SECMARK
1041 default m if NETFILTER_ADVANCED=n
1043 The SECMARK target allows security marking of network
1044 packets, for use with security subsystems.
1046 To compile it as a module, choose M here. If unsure, say N.
1048 config NETFILTER_XT_TARGET_TCPMSS
1049 tristate '"TCPMSS" target support'
1050 depends on IPV6 || IPV6=n
1051 default m if NETFILTER_ADVANCED=n
1053 This option adds a `TCPMSS' target, which allows you to alter the
1054 MSS value of TCP SYN packets, to control the maximum size for that
1055 connection (usually limiting it to your outgoing interface's MTU
1058 This is used to overcome criminally braindead ISPs or servers which
1059 block ICMP Fragmentation Needed packets. The symptoms of this
1060 problem are that everything works fine from your Linux
1061 firewall/router, but machines behind it can never exchange large
1063 1) Web browsers connect, then hang with no data received.
1064 2) Small mail works fine, but large emails hang.
1065 3) ssh works fine, but scp hangs after initial handshaking.
1067 Workaround: activate this option and add a rule to your firewall
1070 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1071 -j TCPMSS --clamp-mss-to-pmtu
1073 To compile it as a module, choose M here. If unsure, say N.
1075 config NETFILTER_XT_TARGET_TCPOPTSTRIP
1076 tristate '"TCPOPTSTRIP" target support'
1077 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1078 depends on NETFILTER_ADVANCED
1080 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1081 TCP options from TCP packets.
1083 # alphabetically ordered list of matches
1085 comment "Xtables matches"
1087 config NETFILTER_XT_MATCH_ADDRTYPE
1088 tristate '"addrtype" address type match support'
1089 default m if NETFILTER_ADVANCED=n
1091 This option allows you to match what routing thinks of an address,
1092 eg. UNICAST, LOCAL, BROADCAST, ...
1094 If you want to compile it as a module, say M here and read
1095 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1097 config NETFILTER_XT_MATCH_BPF
1098 tristate '"bpf" match support'
1099 depends on NETFILTER_ADVANCED
1101 BPF matching applies a linux socket filter to each packet and
1102 accepts those for which the filter returns non-zero.
1104 To compile it as a module, choose M here. If unsure, say N.
1106 config NETFILTER_XT_MATCH_CGROUP
1107 tristate '"control group" match support'
1108 depends on NETFILTER_ADVANCED
1110 select CGROUP_NET_CLASSID
1112 Socket/process control group matching allows you to match locally
1113 generated packets based on which net_cls control group processes
1116 config NETFILTER_XT_MATCH_CLUSTER
1117 tristate '"cluster" match support'
1118 depends on NF_CONNTRACK
1119 depends on NETFILTER_ADVANCED
1121 This option allows you to build work-load-sharing clusters of
1122 network servers/stateful firewalls without having a dedicated
1123 load-balancing router/server/switch. Basically, this match returns
1124 true when the packet must be handled by this cluster node. Thus,
1125 all nodes see all packets and this match decides which node handles
1126 what packets. The work-load sharing algorithm is based on source
1129 If you say Y or M here, try `iptables -m cluster --help` for
1132 config NETFILTER_XT_MATCH_COMMENT
1133 tristate '"comment" match support'
1134 depends on NETFILTER_ADVANCED
1136 This option adds a `comment' dummy-match, which allows you to put
1137 comments in your iptables ruleset.
1139 If you want to compile it as a module, say M here and read
1140 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1142 config NETFILTER_XT_MATCH_CONNBYTES
1143 tristate '"connbytes" per-connection counter match support'
1144 depends on NF_CONNTRACK
1145 depends on NETFILTER_ADVANCED
1147 This option adds a `connbytes' match, which allows you to match the
1148 number of bytes and/or packets for each direction within a connection.
1150 If you want to compile it as a module, say M here and read
1151 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1153 config NETFILTER_XT_MATCH_CONNLABEL
1154 tristate '"connlabel" match support'
1155 select NF_CONNTRACK_LABELS
1156 depends on NF_CONNTRACK
1157 depends on NETFILTER_ADVANCED
1159 This match allows you to test and assign userspace-defined labels names
1160 to a connection. The kernel only stores bit values - mapping
1161 names to bits is done by userspace.
1163 Unlike connmark, more than 32 flag bits may be assigned to a
1164 connection simultaneously.
1166 config NETFILTER_XT_MATCH_CONNLIMIT
1167 tristate '"connlimit" match support'
1168 depends on NF_CONNTRACK
1169 depends on NETFILTER_ADVANCED
1170 select NETFILTER_CONNCOUNT
1172 This match allows you to match against the number of parallel
1173 connections to a server per client IP address (or address block).
1175 config NETFILTER_XT_MATCH_CONNMARK
1176 tristate '"connmark" connection mark match support'
1177 depends on NF_CONNTRACK
1178 depends on NETFILTER_ADVANCED
1179 select NETFILTER_XT_CONNMARK
1181 This is a backwards-compat option for the user's convenience
1182 (e.g. when running oldconfig). It selects
1183 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1185 config NETFILTER_XT_MATCH_CONNTRACK
1186 tristate '"conntrack" connection tracking match support'
1187 depends on NF_CONNTRACK
1188 default m if NETFILTER_ADVANCED=n
1190 This is a general conntrack match module, a superset of the state match.
1192 It allows matching on additional conntrack information, which is
1193 useful in complex configurations, such as NAT gateways with multiple
1194 internet links or tunnels.
1196 To compile it as a module, choose M here. If unsure, say N.
1198 config NETFILTER_XT_MATCH_CPU
1199 tristate '"cpu" match support'
1200 depends on NETFILTER_ADVANCED
1202 CPU matching allows you to match packets based on the CPU
1203 currently handling the packet.
1205 To compile it as a module, choose M here. If unsure, say N.
1207 config NETFILTER_XT_MATCH_DCCP
1208 tristate '"dccp" protocol match support'
1209 depends on NETFILTER_ADVANCED
1212 With this option enabled, you will be able to use the iptables
1213 `dccp' match in order to match on DCCP source/destination ports
1216 If you want to compile it as a module, say M here and read
1217 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1219 config NETFILTER_XT_MATCH_DEVGROUP
1220 tristate '"devgroup" match support'
1221 depends on NETFILTER_ADVANCED
1223 This options adds a `devgroup' match, which allows to match on the
1224 device group a network device is assigned to.
1226 To compile it as a module, choose M here. If unsure, say N.
1228 config NETFILTER_XT_MATCH_DSCP
1229 tristate '"dscp" and "tos" match support'
1230 depends on NETFILTER_ADVANCED
1232 This option adds a `DSCP' match, which allows you to match against
1233 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1235 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1237 It will also add a "tos" match, which allows you to match packets
1238 based on the Type Of Service fields of the IPv4 packet (which share
1239 the same bits as DSCP).
1241 To compile it as a module, choose M here. If unsure, say N.
1243 config NETFILTER_XT_MATCH_ECN
1244 tristate '"ecn" match support'
1245 depends on NETFILTER_ADVANCED
1247 This option adds an "ECN" match, which allows you to match against
1248 the IPv4 and TCP header ECN fields.
1250 To compile it as a module, choose M here. If unsure, say N.
1252 config NETFILTER_XT_MATCH_ESP
1253 tristate '"esp" match support'
1254 depends on NETFILTER_ADVANCED
1256 This match extension allows you to match a range of SPIs
1257 inside ESP header of IPSec packets.
1259 To compile it as a module, choose M here. If unsure, say N.
1261 config NETFILTER_XT_MATCH_HASHLIMIT
1262 tristate '"hashlimit" match support'
1263 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1264 depends on NETFILTER_ADVANCED
1266 This option adds a `hashlimit' match.
1268 As opposed to `limit', this match dynamically creates a hash table
1269 of limit buckets, based on your selection of source/destination
1270 addresses and/or ports.
1272 It enables you to express policies like `10kpps for any given
1273 destination address' or `500pps from any given source address'
1276 config NETFILTER_XT_MATCH_HELPER
1277 tristate '"helper" match support'
1278 depends on NF_CONNTRACK
1279 depends on NETFILTER_ADVANCED
1281 Helper matching allows you to match packets in dynamic connections
1282 tracked by a conntrack-helper, ie. ip_conntrack_ftp
1284 To compile it as a module, choose M here. If unsure, say Y.
1286 config NETFILTER_XT_MATCH_HL
1287 tristate '"hl" hoplimit/TTL match support'
1288 depends on NETFILTER_ADVANCED
1290 HL matching allows you to match packets based on the hoplimit
1291 in the IPv6 header, or the time-to-live field in the IPv4
1292 header of the packet.
1294 config NETFILTER_XT_MATCH_IPCOMP
1295 tristate '"ipcomp" match support'
1296 depends on NETFILTER_ADVANCED
1298 This match extension allows you to match a range of CPIs(16 bits)
1299 inside IPComp header of IPSec packets.
1301 To compile it as a module, choose M here. If unsure, say N.
1303 config NETFILTER_XT_MATCH_IPRANGE
1304 tristate '"iprange" address range match support'
1305 depends on NETFILTER_ADVANCED
1307 This option adds a "iprange" match, which allows you to match based on
1308 an IP address range. (Normal iptables only matches on single addresses
1309 with an optional mask.)
1313 config NETFILTER_XT_MATCH_IPVS
1314 tristate '"ipvs" match support'
1316 depends on NETFILTER_ADVANCED
1317 depends on NF_CONNTRACK
1319 This option allows you to match against IPVS properties of a packet.
1323 config NETFILTER_XT_MATCH_L2TP
1324 tristate '"l2tp" match support'
1325 depends on NETFILTER_ADVANCED
1328 This option adds an "L2TP" match, which allows you to match against
1329 L2TP protocol header fields.
1331 To compile it as a module, choose M here. If unsure, say N.
1333 config NETFILTER_XT_MATCH_LENGTH
1334 tristate '"length" match support'
1335 depends on NETFILTER_ADVANCED
1337 This option allows you to match the length of a packet against a
1338 specific value or range of values.
1340 To compile it as a module, choose M here. If unsure, say N.
1342 config NETFILTER_XT_MATCH_LIMIT
1343 tristate '"limit" match support'
1344 depends on NETFILTER_ADVANCED
1346 limit matching allows you to control the rate at which a rule can be
1347 matched: mainly useful in combination with the LOG target ("LOG
1348 target support", below) and to avoid some Denial of Service attacks.
1350 To compile it as a module, choose M here. If unsure, say N.
1352 config NETFILTER_XT_MATCH_MAC
1353 tristate '"mac" address match support'
1354 depends on NETFILTER_ADVANCED
1356 MAC matching allows you to match packets based on the source
1357 Ethernet address of the packet.
1359 To compile it as a module, choose M here. If unsure, say N.
1361 config NETFILTER_XT_MATCH_MARK
1362 tristate '"mark" match support'
1363 depends on NETFILTER_ADVANCED
1364 select NETFILTER_XT_MARK
1366 This is a backwards-compat option for the user's convenience
1367 (e.g. when running oldconfig). It selects
1368 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1370 config NETFILTER_XT_MATCH_MULTIPORT
1371 tristate '"multiport" Multiple port match support'
1372 depends on NETFILTER_ADVANCED
1374 Multiport matching allows you to match TCP or UDP packets based on
1375 a series of source or destination ports: normally a rule can only
1376 match a single range of ports.
1378 To compile it as a module, choose M here. If unsure, say N.
1380 config NETFILTER_XT_MATCH_NFACCT
1381 tristate '"nfacct" match support'
1382 depends on NETFILTER_ADVANCED
1383 select NETFILTER_NETLINK_ACCT
1385 This option allows you to use the extended accounting through
1388 To compile it as a module, choose M here. If unsure, say N.
1390 config NETFILTER_XT_MATCH_OSF
1391 tristate '"osf" Passive OS fingerprint match'
1392 depends on NETFILTER_ADVANCED
1393 select NETFILTER_NETLINK_OSF
1395 This option selects the Passive OS Fingerprinting match module
1396 that allows to passively match the remote operating system by
1397 analyzing incoming TCP SYN packets.
1399 Rules and loading software can be downloaded from
1400 http://www.ioremap.net/projects/osf
1402 To compile it as a module, choose M here. If unsure, say N.
1404 config NETFILTER_XT_MATCH_OWNER
1405 tristate '"owner" match support'
1406 depends on NETFILTER_ADVANCED
1408 Socket owner matching allows you to match locally-generated packets
1409 based on who created the socket: the user or group. It is also
1410 possible to check whether a socket actually exists.
1412 config NETFILTER_XT_MATCH_POLICY
1413 tristate 'IPsec "policy" match support'
1415 default m if NETFILTER_ADVANCED=n
1417 Policy matching allows you to match packets based on the
1418 IPsec policy that was used during decapsulation/will
1419 be used during encapsulation.
1421 To compile it as a module, choose M here. If unsure, say N.
1423 config NETFILTER_XT_MATCH_PHYSDEV
1424 tristate '"physdev" match support'
1425 depends on BRIDGE && BRIDGE_NETFILTER
1426 depends on NETFILTER_ADVANCED
1428 Physdev packet matching matches against the physical bridge ports
1429 the IP packet arrived on or will leave by.
1431 To compile it as a module, choose M here. If unsure, say N.
1433 config NETFILTER_XT_MATCH_PKTTYPE
1434 tristate '"pkttype" packet type match support'
1435 depends on NETFILTER_ADVANCED
1437 Packet type matching allows you to match a packet by
1438 its "class", eg. BROADCAST, MULTICAST, ...
1441 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1443 To compile it as a module, choose M here. If unsure, say N.
1445 config NETFILTER_XT_MATCH_QUOTA
1446 tristate '"quota" match support'
1447 depends on NETFILTER_ADVANCED
1449 This option adds a `quota' match, which allows to match on a
1452 If you want to compile it as a module, say M here and read
1453 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1455 config NETFILTER_XT_MATCH_RATEEST
1456 tristate '"rateest" match support'
1457 depends on NETFILTER_ADVANCED
1458 select NETFILTER_XT_TARGET_RATEEST
1460 This option adds a `rateest' match, which allows to match on the
1461 rate estimated by the RATEEST target.
1463 To compile it as a module, choose M here. If unsure, say N.
1465 config NETFILTER_XT_MATCH_REALM
1466 tristate '"realm" match support'
1467 depends on NETFILTER_ADVANCED
1468 select IP_ROUTE_CLASSID
1470 This option adds a `realm' match, which allows you to use the realm
1471 key from the routing subsystem inside iptables.
1473 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1476 If you want to compile it as a module, say M here and read
1477 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1479 config NETFILTER_XT_MATCH_RECENT
1480 tristate '"recent" match support'
1481 depends on NETFILTER_ADVANCED
1483 This match is used for creating one or many lists of recently
1484 used addresses and then matching against that/those list(s).
1486 Short options are available by using 'iptables -m recent -h'
1487 Official Website: <http://snowman.net/projects/ipt_recent/>
1489 config NETFILTER_XT_MATCH_SCTP
1490 tristate '"sctp" protocol match support'
1491 depends on NETFILTER_ADVANCED
1494 With this option enabled, you will be able to use the
1495 `sctp' match in order to match on SCTP source/destination ports
1496 and SCTP chunk types.
1498 If you want to compile it as a module, say M here and read
1499 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1501 config NETFILTER_XT_MATCH_SOCKET
1502 tristate '"socket" match support'
1503 depends on NETFILTER_XTABLES
1504 depends on NETFILTER_ADVANCED
1505 depends on IPV6 || IPV6=n
1506 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1507 select NF_SOCKET_IPV4
1508 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1509 select NF_DEFRAG_IPV4
1510 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1512 This option adds a `socket' match, which can be used to match
1513 packets for which a TCP or UDP socket lookup finds a valid socket.
1514 It can be used in combination with the MARK target and policy
1515 routing to implement full featured non-locally bound sockets.
1517 To compile it as a module, choose M here. If unsure, say N.
1519 config NETFILTER_XT_MATCH_STATE
1520 tristate '"state" match support'
1521 depends on NF_CONNTRACK
1522 default m if NETFILTER_ADVANCED=n
1524 Connection state matching allows you to match packets based on their
1525 relationship to a tracked connection (ie. previous packets). This
1526 is a powerful tool for packet classification.
1528 To compile it as a module, choose M here. If unsure, say N.
1530 config NETFILTER_XT_MATCH_STATISTIC
1531 tristate '"statistic" match support'
1532 depends on NETFILTER_ADVANCED
1534 This option adds a `statistic' match, which allows you to match
1535 on packets periodically or randomly with a given percentage.
1537 To compile it as a module, choose M here. If unsure, say N.
1539 config NETFILTER_XT_MATCH_STRING
1540 tristate '"string" match support'
1541 depends on NETFILTER_ADVANCED
1543 select TEXTSEARCH_KMP
1544 select TEXTSEARCH_BM
1545 select TEXTSEARCH_FSM
1547 This option adds a `string' match, which allows you to look for
1548 pattern matchings in packets.
1550 To compile it as a module, choose M here. If unsure, say N.
1552 config NETFILTER_XT_MATCH_TCPMSS
1553 tristate '"tcpmss" match support'
1554 depends on NETFILTER_ADVANCED
1556 This option adds a `tcpmss' match, which allows you to examine the
1557 MSS value of TCP SYN packets, which control the maximum packet size
1558 for that connection.
1560 To compile it as a module, choose M here. If unsure, say N.
1562 config NETFILTER_XT_MATCH_TIME
1563 tristate '"time" match support'
1564 depends on NETFILTER_ADVANCED
1566 This option adds a "time" match, which allows you to match based on
1567 the packet arrival time (at the machine which netfilter is running)
1568 on) or departure time/date (for locally generated packets).
1570 If you say Y here, try `iptables -m time --help` for
1573 If you want to compile it as a module, say M here.
1576 config NETFILTER_XT_MATCH_U32
1577 tristate '"u32" match support'
1578 depends on NETFILTER_ADVANCED
1580 u32 allows you to extract quantities of up to 4 bytes from a packet,
1581 AND them with specified masks, shift them by specified amounts and
1582 test whether the results are in any of a set of specified ranges.
1583 The specification of what to extract is general enough to skip over
1584 headers with lengths stored in the packet, as in IP or TCP header
1587 Details and examples are in the kernel module source.
1589 endif # NETFILTER_XTABLES
1593 source "net/netfilter/ipset/Kconfig"
1595 source "net/netfilter/ipvs/Kconfig"