2 # Bridge netfilter configuration
5 menu "Bridge: Netfilter Configuration"
6 depends on BRIDGE && NETFILTER
8 config BRIDGE_NF_EBTABLES
9 tristate "Ethernet Bridge tables (ebtables) support"
11 ebtables is a general, extensible frame/packet identification
12 framework. Say 'Y' or 'M' here if you want to do Ethernet
13 filtering/NAT/brouting on the Ethernet bridge.
17 config BRIDGE_EBT_BROUTE
18 tristate "ebt: broute table support"
19 depends on BRIDGE_NF_EBTABLES
21 The ebtables broute table is used to define rules that decide between
22 bridging and routing frames, giving Linux the functionality of a
23 brouter. See the man page for ebtables(8) and examples on the ebtables
26 To compile it as a module, choose M here. If unsure, say N.
28 config BRIDGE_EBT_T_FILTER
29 tristate "ebt: filter table support"
30 depends on BRIDGE_NF_EBTABLES
32 The ebtables filter table is used to define frame filtering rules at
33 local input, forwarding and local output. See the man page for
36 To compile it as a module, choose M here. If unsure, say N.
38 config BRIDGE_EBT_T_NAT
39 tristate "ebt: nat table support"
40 depends on BRIDGE_NF_EBTABLES
42 The ebtables nat table is used to define rules that alter the MAC
43 source address (MAC SNAT) or the MAC destination address (MAC DNAT).
44 See the man page for ebtables(8).
46 To compile it as a module, choose M here. If unsure, say N.
50 config BRIDGE_EBT_802_3
51 tristate "ebt: 802.3 filter support"
52 depends on BRIDGE_NF_EBTABLES
54 This option adds matching support for 802.3 Ethernet frames.
56 To compile it as a module, choose M here. If unsure, say N.
58 config BRIDGE_EBT_AMONG
59 tristate "ebt: among filter support"
60 depends on BRIDGE_NF_EBTABLES
62 This option adds the among match, which allows matching the MAC source
63 and/or destination address on a list of addresses. Optionally,
64 MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
66 To compile it as a module, choose M here. If unsure, say N.
69 tristate "ebt: ARP filter support"
70 depends on BRIDGE_NF_EBTABLES
72 This option adds the ARP match, which allows ARP and RARP header field
75 To compile it as a module, choose M here. If unsure, say N.
78 tristate "ebt: IP filter support"
79 depends on BRIDGE_NF_EBTABLES
81 This option adds the IP match, which allows basic IP header field
84 To compile it as a module, choose M here. If unsure, say N.
86 config BRIDGE_EBT_LIMIT
87 tristate "ebt: limit match support"
88 depends on BRIDGE_NF_EBTABLES
90 This option adds the limit match, which allows you to control
91 the rate at which a rule can be matched. This match is the
92 equivalent of the iptables limit match.
94 If you want to compile it as a module, say M here and read
95 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
97 config BRIDGE_EBT_MARK
98 tristate "ebt: mark filter support"
99 depends on BRIDGE_NF_EBTABLES
101 This option adds the mark match, which allows matching frames based on
102 the 'nfmark' value in the frame. This can be set by the mark target.
103 This value is the same as the one used in the iptables mark match and
106 To compile it as a module, choose M here. If unsure, say N.
108 config BRIDGE_EBT_PKTTYPE
109 tristate "ebt: packet type filter support"
110 depends on BRIDGE_NF_EBTABLES
112 This option adds the packet type match, which allows matching on the
113 type of packet based on its Ethernet "class" (as determined by
114 the generic networking code): broadcast, multicast,
115 for this host alone or for another host.
117 To compile it as a module, choose M here. If unsure, say N.
119 config BRIDGE_EBT_STP
120 tristate "ebt: STP filter support"
121 depends on BRIDGE_NF_EBTABLES
123 This option adds the Spanning Tree Protocol match, which
124 allows STP header field filtering.
126 To compile it as a module, choose M here. If unsure, say N.
128 config BRIDGE_EBT_VLAN
129 tristate "ebt: 802.1Q VLAN filter support"
130 depends on BRIDGE_NF_EBTABLES
132 This option adds the 802.1Q vlan match, which allows the filtering of
135 To compile it as a module, choose M here. If unsure, say N.
136 # CONFIG_MIPS_BRCM Begin Broadcom changed code.
137 config BRIDGE_EBT_TIME
138 tristate "ebt: time filter support"
139 depends on BRIDGE_NF_EBTABLES
141 This option adds the system time match, which allows the filtering
142 of system time when a frame arrives.
144 To compile it as a module, choose M here. If unsure, say N.
145 # CONFIG_MIPS_BRCM End Broadcom changed code.
149 config BRIDGE_EBT_ARPREPLY
150 tristate "ebt: arp reply target support"
151 depends on BRIDGE_NF_EBTABLES
153 This option adds the arp reply target, which allows
154 automatically sending arp replies to arp requests.
156 To compile it as a module, choose M here. If unsure, say N.
158 config BRIDGE_EBT_DNAT
159 tristate "ebt: dnat target support"
160 depends on BRIDGE_NF_EBTABLES
162 This option adds the MAC DNAT target, which allows altering the MAC
163 destination address of frames.
165 To compile it as a module, choose M here. If unsure, say N.
167 config BRIDGE_EBT_MARK_T
168 tristate "ebt: mark target support"
169 depends on BRIDGE_NF_EBTABLES
171 This option adds the mark target, which allows marking frames by
172 setting the 'nfmark' value in the frame.
173 This value is the same as the one used in the iptables mark match and
176 To compile it as a module, choose M here. If unsure, say N.
178 config BRIDGE_EBT_REDIRECT
179 tristate "ebt: redirect target support"
180 depends on BRIDGE_NF_EBTABLES
182 This option adds the MAC redirect target, which allows altering the MAC
183 destination address of a frame to that of the device it arrived on.
185 To compile it as a module, choose M here. If unsure, say N.
187 config BRIDGE_EBT_SNAT
188 tristate "ebt: snat target support"
189 depends on BRIDGE_NF_EBTABLES
191 This option adds the MAC SNAT target, which allows altering the MAC
192 source address of frames.
194 To compile it as a module, choose M here. If unsure, say N.
195 # CONFIG_MIPS_BRCM Begin Broadcom changed code.
196 config BRIDGE_EBT_FTOS_T
197 tristate "ebt: ftos target support"
198 depends on BRIDGE_NF_EBTABLES
200 This option adds the ftos target, which allows altering the full TOS byte
203 To compile it as a module, choose M here. If unsure, say N.
205 config BRIDGE_EBT_WMM_MARK
206 tristate "ebt: Wireless Wi-Fi WMM marking support"
207 depends on BRIDGE_NF_EBTABLES
209 This option adds the wmm-mark target, which allows to
210 mark Wi-Fi WMM priorities.
212 To compile it as a module, choose M here. If unsure, say N.
214 # CONFIG_MIPS_BRCM End Broadcom changed code.
218 config BRIDGE_EBT_LOG
219 tristate "ebt: log support"
220 depends on BRIDGE_NF_EBTABLES
222 This option adds the log target, that you can use in any rule in
223 any ebtables table. It records the frame header to the syslog.
225 To compile it as a module, choose M here. If unsure, say N.