1 # SPDX-License-Identifier: GPL-2.0-only
2 menu "Core Netfilter Configuration"
3 depends on NET && INET && NETFILTER
5 config NETFILTER_INGRESS
6 bool "Netfilter ingress support"
10 This allows you to classify packets from ingress using the Netfilter
13 config NETFILTER_NETLINK
16 config NETFILTER_FAMILY_BRIDGE
19 config NETFILTER_FAMILY_ARP
22 config NETFILTER_NETLINK_ACCT
23 tristate "Netfilter NFACCT over NFNETLINK interface"
24 depends on NETFILTER_ADVANCED
25 select NETFILTER_NETLINK
27 If this option is enabled, the kernel will include support
28 for extended accounting via NFNETLINK.
30 config NETFILTER_NETLINK_QUEUE
31 tristate "Netfilter NFQUEUE over NFNETLINK interface"
32 depends on NETFILTER_ADVANCED
33 select NETFILTER_NETLINK
35 If this option is enabled, the kernel will include support
36 for queueing packets via NFNETLINK.
38 config NETFILTER_NETLINK_LOG
39 tristate "Netfilter LOG over NFNETLINK interface"
40 default m if NETFILTER_ADVANCED=n
41 select NETFILTER_NETLINK
43 If this option is enabled, the kernel will include support
44 for logging packets via NFNETLINK.
46 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
47 and is also scheduled to replace the old syslog-based ipt_LOG
50 config NETFILTER_NETLINK_OSF
51 tristate "Netfilter OSF over NFNETLINK interface"
52 depends on NETFILTER_ADVANCED
53 select NETFILTER_NETLINK
55 If this option is enabled, the kernel will include support
56 for passive OS fingerprint via NFNETLINK.
59 tristate "Netfilter connection tracking support"
60 default m if NETFILTER_ADVANCED=n
62 select NF_DEFRAG_IPV6 if IPV6 != n
64 Connection tracking keeps a record of what packets have passed
65 through your machine, in order to figure out how they are related
68 This is required to do Masquerading or other kinds of Network
69 Address Translation. It can also be used to enhance packet
70 filtering (see `Connection state match support' below).
72 To compile it as a module, choose M here. If unsure, say N.
78 tristate "Netdev packet logging"
82 config NETFILTER_CONNCOUNT
85 config NF_CONNTRACK_MARK
86 bool 'Connection mark tracking support'
87 depends on NETFILTER_ADVANCED
89 This option enables support for connection marks, used by the
90 `CONNMARK' target and `connmark' match. Similar to the mark value
91 of packets, but this mark value is kept in the conntrack session
92 instead of the individual packets.
94 config NF_CONNTRACK_SECMARK
95 bool 'Connection tracking security mark support'
96 depends on NETWORK_SECMARK
97 default m if NETFILTER_ADVANCED=n
99 This option enables security markings to be applied to
100 connections. Typically they are copied to connections from
101 packets using the CONNSECMARK target and copied back from
102 connections to packets with the same target, with the packets
103 being originally labeled via SECMARK.
107 config NF_CONNTRACK_ZONES
108 bool 'Connection tracking zones'
109 depends on NETFILTER_ADVANCED
111 This option enables support for connection tracking zones.
112 Normally, each connection needs to have a unique system wide
113 identity. Connection tracking zones allow to have multiple
114 connections using the same identity, as long as they are
115 contained in different zones.
119 config NF_CONNTRACK_PROCFS
120 bool "Supply CT list in procfs (OBSOLETE)"
124 This option enables for the list of known conntrack entries
125 to be shown in procfs under net/netfilter/nf_conntrack. This
126 is considered obsolete in favor of using the conntrack(8)
127 tool which uses Netlink.
129 config NF_CONNTRACK_EVENTS
130 bool "Connection tracking events"
131 depends on NETFILTER_ADVANCED
133 If this option is enabled, the connection tracking code will
134 provide a notifier chain that can be used by other kernel code
135 to get notified about changes in the connection tracking state.
139 config NF_CONNTRACK_TIMEOUT
140 bool 'Connection tracking timeout'
141 depends on NETFILTER_ADVANCED
143 This option enables support for connection tracking timeout
144 extension. This allows you to attach timeout policies to flow
149 config NF_CONNTRACK_TIMESTAMP
150 bool 'Connection tracking timestamping'
151 depends on NETFILTER_ADVANCED
153 This option enables support for connection tracking timestamping.
154 This allows you to store the flow start-time and to obtain
155 the flow-stop time (once it has been destroyed) via Connection
160 config NF_CONNTRACK_LABELS
161 bool "Connection tracking labels"
163 This option enables support for assigning user-defined flag bits
164 to connection tracking entries. It can be used with xtables connlabel
165 match and the nftables ct expression.
167 config NF_CT_PROTO_DCCP
168 bool 'DCCP protocol connection tracking support'
169 depends on NETFILTER_ADVANCED
172 With this option enabled, the layer 3 independent connection
173 tracking code will be able to do state tracking on DCCP connections.
177 config NF_CT_PROTO_GRE
180 config NF_CT_PROTO_SCTP
181 bool 'SCTP protocol connection tracking support'
182 depends on NETFILTER_ADVANCED
186 With this option enabled, the layer 3 independent connection
187 tracking code will be able to do state tracking on SCTP connections.
191 config NF_CT_PROTO_UDPLITE
192 bool 'UDP-Lite protocol connection tracking support'
193 depends on NETFILTER_ADVANCED
196 With this option enabled, the layer 3 independent connection
197 tracking code will be able to do state tracking on UDP-Lite
202 config NF_CONNTRACK_AMANDA
203 tristate "Amanda backup protocol support"
204 depends on NETFILTER_ADVANCED
206 select TEXTSEARCH_KMP
208 If you are running the Amanda backup package <http://www.amanda.org/>
209 on this machine or machines that will be MASQUERADED through this
210 machine, then you may want to enable this feature. This allows the
211 connection tracking and natting code to allow the sub-channels that
212 Amanda requires for communication of the backup data, messages and
215 To compile it as a module, choose M here. If unsure, say N.
217 config NF_CONNTRACK_FTP
218 tristate "FTP protocol support"
219 default m if NETFILTER_ADVANCED=n
221 Tracking FTP connections is problematic: special helpers are
222 required for tracking them, and doing masquerading and other forms
223 of Network Address Translation on them.
225 This is FTP support on Layer 3 independent connection tracking.
226 Layer 3 independent connection tracking is experimental scheme
227 which generalize ip_conntrack to support other layer 3 protocols.
229 To compile it as a module, choose M here. If unsure, say N.
231 config NF_CONNTRACK_H323
232 tristate "H.323 protocol support"
233 depends on IPV6 || IPV6=n
234 depends on NETFILTER_ADVANCED
236 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
237 important VoIP protocols, it is widely used by voice hardware and
238 software including voice gateways, IP phones, Netmeeting, OpenPhone,
241 With this module you can support H.323 on a connection tracking/NAT
244 This module supports RAS, Fast Start, H.245 Tunnelling, Call
245 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
246 whiteboard, file transfer, etc. For more information, please
247 visit http://nath323.sourceforge.net/.
249 To compile it as a module, choose M here. If unsure, say N.
251 config NF_CONNTRACK_IRC
252 tristate "IRC protocol support"
253 default m if NETFILTER_ADVANCED=n
255 There is a commonly-used extension to IRC called
256 Direct Client-to-Client Protocol (DCC). This enables users to send
257 files to each other, and also chat to each other without the need
258 of a server. DCC Sending is used anywhere you send files over IRC,
259 and DCC Chat is most commonly used by Eggdrop bots. If you are
260 using NAT, this extension will enable you to send files and initiate
261 chats. Note that you do NOT need this extension to get files or
262 have others initiate chats, or everything else in IRC.
264 To compile it as a module, choose M here. If unsure, say N.
266 config NF_CONNTRACK_BROADCAST
269 config NF_CONNTRACK_NETBIOS_NS
270 tristate "NetBIOS name service protocol support"
271 select NF_CONNTRACK_BROADCAST
273 NetBIOS name service requests are sent as broadcast messages from an
274 unprivileged port and responded to with unicast messages to the
275 same port. This make them hard to firewall properly because connection
276 tracking doesn't deal with broadcasts. This helper tracks locally
277 originating NetBIOS name service requests and the corresponding
278 responses. It relies on correct IP address configuration, specifically
279 netmask and broadcast address. When properly configured, the output
280 of "ip address show" should look similar to this:
282 $ ip -4 address show eth0
283 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
284 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
286 To compile it as a module, choose M here. If unsure, say N.
288 config NF_CONNTRACK_SNMP
289 tristate "SNMP service protocol support"
290 depends on NETFILTER_ADVANCED
291 select NF_CONNTRACK_BROADCAST
293 SNMP service requests are sent as broadcast messages from an
294 unprivileged port and responded to with unicast messages to the
295 same port. This make them hard to firewall properly because connection
296 tracking doesn't deal with broadcasts. This helper tracks locally
297 originating SNMP service requests and the corresponding
298 responses. It relies on correct IP address configuration, specifically
299 netmask and broadcast address.
301 To compile it as a module, choose M here. If unsure, say N.
303 config NF_CONNTRACK_PPTP
304 tristate "PPtP protocol support"
305 depends on NETFILTER_ADVANCED
306 select NF_CT_PROTO_GRE
308 This module adds support for PPTP (Point to Point Tunnelling
309 Protocol, RFC2637) connection tracking and NAT.
311 If you are running PPTP sessions over a stateful firewall or NAT
312 box, you may want to enable this feature.
314 Please note that not all PPTP modes of operation are supported yet.
315 Specifically these limitations exist:
316 - Blindly assumes that control connections are always established
317 in PNS->PAC direction. This is a violation of RFC2637.
318 - Only supports a single call within each session
320 To compile it as a module, choose M here. If unsure, say N.
322 config NF_CONNTRACK_SANE
323 tristate "SANE protocol support"
324 depends on NETFILTER_ADVANCED
326 SANE is a protocol for remote access to scanners as implemented
327 by the 'saned' daemon. Like FTP, it uses separate control and
330 With this module you can support SANE on a connection tracking
333 To compile it as a module, choose M here. If unsure, say N.
335 config NF_CONNTRACK_SIP
336 tristate "SIP protocol support"
337 default m if NETFILTER_ADVANCED=n
339 SIP is an application-layer control protocol that can establish,
340 modify, and terminate multimedia sessions (conferences) such as
341 Internet telephony calls. With the ip_conntrack_sip and
342 the nf_nat_sip modules you can support the protocol on a connection
343 tracking/NATing firewall.
345 To compile it as a module, choose M here. If unsure, say N.
347 config NF_CONNTRACK_TFTP
348 tristate "TFTP protocol support"
349 depends on NETFILTER_ADVANCED
351 TFTP connection tracking helper, this is required depending
352 on how restrictive your ruleset is.
353 If you are using a tftp client behind -j SNAT or -j MASQUERADING
356 To compile it as a module, choose M here. If unsure, say N.
359 tristate 'Connection tracking netlink interface'
360 select NETFILTER_NETLINK
361 default m if NETFILTER_ADVANCED=n
363 This option enables support for a netlink-based userspace interface
365 config NF_CT_NETLINK_TIMEOUT
366 tristate 'Connection tracking timeout tuning via Netlink'
367 select NETFILTER_NETLINK
368 depends on NETFILTER_ADVANCED
369 depends on NF_CONNTRACK_TIMEOUT
371 This option enables support for connection tracking timeout
372 fine-grain tuning. This allows you to attach specific timeout
373 policies to flows, instead of using the global timeout policy.
377 config NF_CT_NETLINK_HELPER
378 tristate 'Connection tracking helpers in user-space via Netlink'
379 select NETFILTER_NETLINK
380 depends on NF_CT_NETLINK
381 depends on NETFILTER_NETLINK_QUEUE
382 depends on NETFILTER_NETLINK_GLUE_CT
383 depends on NETFILTER_ADVANCED
385 This option enables the user-space connection tracking helpers
390 config NETFILTER_NETLINK_GLUE_CT
391 bool "NFQUEUE and NFLOG integration with Connection Tracking"
393 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
395 If this option is enabled, NFQUEUE and NFLOG can include
396 Connection Tracking information together with the packet is
397 the enqueued via NFNETLINK.
400 tristate "Network Address Translation support"
401 depends on NF_CONNTRACK
402 default m if NETFILTER_ADVANCED=n
404 The NAT option allows masquerading, port forwarding and other
405 forms of full Network Address Port Translation. This can be
406 controlled by iptables, ip6tables or nft.
410 depends on NF_CONNTRACK && NF_NAT
411 default NF_NAT && NF_CONNTRACK_AMANDA
415 depends on NF_CONNTRACK && NF_NAT
416 default NF_NAT && NF_CONNTRACK_FTP
420 depends on NF_CONNTRACK && NF_NAT
421 default NF_NAT && NF_CONNTRACK_IRC
425 depends on NF_CONNTRACK && NF_NAT
426 default NF_NAT && NF_CONNTRACK_SIP
430 depends on NF_CONNTRACK && NF_NAT
431 default NF_NAT && NF_CONNTRACK_TFTP
433 config NF_NAT_REDIRECT
436 config NF_NAT_MASQUERADE
439 config NETFILTER_SYNPROXY
445 select NETFILTER_NETLINK
446 tristate "Netfilter nf_tables support"
448 nftables is the new packet classification framework that intends to
449 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
450 provides a pseudo-state machine with an extensible instruction-set
451 (also known as expressions) that the userspace 'nft' utility
452 (http://www.netfilter.org/projects/nftables) uses to build the
453 rule-set. It also comes with the generic set infrastructure that
454 allows you to construct mappings between matchings and actions
455 for performance lookups.
457 To compile it as a module, choose M here.
462 tristate "Netfilter nf_tables set infrastructure"
464 This option enables the nf_tables set infrastructure that allows to
465 look up for elements in a set and to build one-way mappings between
466 matchings and actions.
468 config NF_TABLES_INET
470 select NF_TABLES_IPV4
471 select NF_TABLES_IPV6
472 bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
474 This option enables support for a mixed IPv4/IPv6 "inet" table.
476 config NF_TABLES_NETDEV
477 bool "Netfilter nf_tables netdev tables support"
479 This option enables support for the "netdev" table.
482 tristate "Netfilter nf_tables number generator module"
484 This option adds the number generator expression used to perform
485 incremental counting and random numbers bound to a upper limit.
488 depends on NF_CONNTRACK
489 tristate "Netfilter nf_tables conntrack module"
491 This option adds the "ct" expression that you can use to match
492 connection tracking information such as the flow state.
494 config NFT_FLOW_OFFLOAD
495 depends on NF_CONNTRACK && NF_FLOW_TABLE
496 tristate "Netfilter nf_tables hardware flow offload module"
498 This option adds the "flow_offload" expression that you can use to
499 choose what flows are placed into the hardware.
502 tristate "Netfilter nf_tables counter module"
504 This option adds the "counter" expression that you can use to
505 include packet and byte counters in a rule.
508 tristate "Netfilter nf_tables connlimit module"
509 depends on NF_CONNTRACK
510 depends on NETFILTER_ADVANCED
511 select NETFILTER_CONNCOUNT
513 This option adds the "connlimit" expression that you can use to
514 ratelimit rule matchings per connections.
517 tristate "Netfilter nf_tables log module"
519 This option adds the "log" expression that you can use to log
520 packets matching some criteria.
523 tristate "Netfilter nf_tables limit module"
525 This option adds the "limit" expression that you can use to
526 ratelimit rule matchings.
529 depends on NF_CONNTRACK
531 select NF_NAT_MASQUERADE
532 tristate "Netfilter nf_tables masquerade support"
534 This option adds the "masquerade" expression that you can use
535 to perform NAT in the masquerade flavour.
538 depends on NF_CONNTRACK
540 tristate "Netfilter nf_tables redirect support"
541 select NF_NAT_REDIRECT
543 This options adds the "redirect" expression that you can use
544 to perform NAT in the redirect flavour.
547 depends on NF_CONNTRACK
549 depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
550 tristate "Netfilter nf_tables nat module"
552 This option adds the "nat" expression that you can use to perform
553 typical Network Address Translation (NAT) packet transformations.
556 tristate "Netfilter nf_tables tunnel module"
558 This option adds the "tunnel" expression that you can use to set
562 tristate "Netfilter nf_tables stateful object reference module"
564 This option adds the "objref" expression that allows you to refer to
565 stateful objects, such as counters and quotas.
568 depends on NETFILTER_NETLINK_QUEUE
569 tristate "Netfilter nf_tables queue module"
571 This is required if you intend to use the userspace queueing
572 infrastructure (also known as NFQUEUE) from nftables.
575 tristate "Netfilter nf_tables quota module"
577 This option adds the "quota" expression that you can use to match
578 enforce bytes quotas.
581 default m if NETFILTER_ADVANCED=n
582 tristate "Netfilter nf_tables reject support"
583 depends on !NF_TABLES_INET || (IPV6!=m || m)
585 This option adds the "reject" expression that you can use to
586 explicitly deny and notify via TCP reset/ICMP informational errors
589 config NFT_REJECT_INET
590 depends on NF_TABLES_INET
595 depends on NETFILTER_XTABLES
596 tristate "Netfilter x_tables over nf_tables module"
598 This is required if you intend to use any of existing
599 x_tables match/target extensions over the nf_tables
603 tristate "Netfilter nf_tables hash module"
605 This option adds the "hash" expression that you can use to perform
606 a hash operation on registers.
612 depends on NF_TABLES_INET
613 depends on NFT_FIB_IPV4
614 depends on NFT_FIB_IPV6
615 tristate "Netfilter nf_tables fib inet support"
617 This option allows using the FIB expression from the inet table.
618 The lookup will be delegated to the IPv4 or IPv6 FIB depending
619 on the protocol of the packet.
622 tristate "Netfilter nf_tables xfrm/IPSec security association matching"
625 This option adds an expression that you can use to extract properties
626 of a packets security association.
629 tristate "Netfilter nf_tables socket match support"
630 depends on IPV6 || IPV6=n
631 select NF_SOCKET_IPV4
632 select NF_SOCKET_IPV6 if NF_TABLES_IPV6
634 This option allows matching for the presence or absence of a
635 corresponding socket and its attributes.
638 tristate "Netfilter nf_tables passive OS fingerprint support"
639 depends on NETFILTER_ADVANCED
640 select NETFILTER_NETLINK_OSF
642 This option allows matching packets from an specific OS.
645 tristate "Netfilter nf_tables tproxy support"
646 depends on IPV6 || IPV6=n
647 select NF_DEFRAG_IPV4
648 select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
649 select NF_TPROXY_IPV4
650 select NF_TPROXY_IPV6 if NF_TABLES_IPV6
652 This makes transparent proxy support available in nftables.
655 tristate "Netfilter nf_tables SYNPROXY expression support"
656 depends on NF_CONNTRACK && NETFILTER_ADVANCED
657 select NETFILTER_SYNPROXY
660 The SYNPROXY expression allows you to intercept TCP connections and
661 establish them using syncookies before they are passed on to the
662 server. This allows to avoid conntrack and server resource usage
663 during SYN-flood attacks.
668 tristate "Netfilter packet duplication support"
670 This option enables the generic packet duplication infrastructure
673 config NFT_DUP_NETDEV
674 tristate "Netfilter nf_tables netdev packet duplication support"
677 This option enables packet duplication for the "netdev" family.
679 config NFT_FWD_NETDEV
680 tristate "Netfilter nf_tables netdev packet forwarding support"
683 This option enables packet forwarding for the "netdev" family.
685 config NFT_FIB_NETDEV
686 depends on NFT_FIB_IPV4
687 depends on NFT_FIB_IPV6
688 tristate "Netfilter nf_tables netdev fib lookups support"
690 This option allows using the FIB expression from the netdev table.
691 The lookup will be delegated to the IPv4 or IPv6 FIB depending
692 on the protocol of the packet.
694 endif # NF_TABLES_NETDEV
698 config NF_FLOW_TABLE_INET
699 tristate "Netfilter flow table mixed IPv4/IPv6 module"
700 depends on NF_FLOW_TABLE
702 This option adds the flow table mixed IPv4/IPv6 support.
704 To compile it as a module, choose M here.
707 tristate "Netfilter flow table module"
708 depends on NETFILTER_INGRESS
709 depends on NF_CONNTRACK
712 This option adds the flow table core infrastructure.
714 To compile it as a module, choose M here.
716 config NETFILTER_XTABLES
717 tristate "Netfilter Xtables support (required for ip_tables)"
718 default m if NETFILTER_ADVANCED=n
720 This is required if you intend to use any of ip_tables,
721 ip6_tables or arp_tables.
725 comment "Xtables combined modules"
727 config NETFILTER_XT_MARK
728 tristate 'nfmark target and match support'
729 default m if NETFILTER_ADVANCED=n
731 This option adds the "MARK" target and "mark" match.
733 Netfilter mark matching allows you to match packets based on the
734 "nfmark" value in the packet.
735 The target allows you to create rules in the "mangle" table which alter
736 the netfilter mark (nfmark) field associated with the packet.
738 Prior to routing, the nfmark can influence the routing method and can
739 also be used by other subsystems to change their behavior.
741 config NETFILTER_XT_CONNMARK
742 tristate 'ctmark target and match support'
743 depends on NF_CONNTRACK
744 depends on NETFILTER_ADVANCED
745 select NF_CONNTRACK_MARK
747 This option adds the "CONNMARK" target and "connmark" match.
749 Netfilter allows you to store a mark value per connection (a.k.a.
750 ctmark), similarly to the packet mark (nfmark). Using this
751 target and match, you can set and match on this mark.
753 config NETFILTER_XT_SET
754 tristate 'set target and match support'
756 depends on NETFILTER_ADVANCED
758 This option adds the "SET" target and "set" match.
760 Using this target and match, you can add/delete and match
761 elements in the sets created by ipset(8).
763 To compile it as a module, choose M here. If unsure, say N.
765 # alphabetically ordered list of targets
767 comment "Xtables targets"
769 config NETFILTER_XT_TARGET_AUDIT
770 tristate "AUDIT target support"
772 depends on NETFILTER_ADVANCED
774 This option adds a 'AUDIT' target, which can be used to create
775 audit records for packets dropped/accepted.
777 To compileit as a module, choose M here. If unsure, say N.
779 config NETFILTER_XT_TARGET_CHECKSUM
780 tristate "CHECKSUM target support"
781 depends on IP_NF_MANGLE || IP6_NF_MANGLE
782 depends on NETFILTER_ADVANCED
784 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
785 table to work around buggy DHCP clients in virtualized environments.
787 Some old DHCP clients drop packets because they are not aware
788 that the checksum would normally be offloaded to hardware and
789 thus should be considered valid.
790 This target can be used to fill in the checksum using iptables
791 when such packets are sent via a virtual network device.
793 To compile it as a module, choose M here. If unsure, say N.
795 config NETFILTER_XT_TARGET_CLASSIFY
796 tristate '"CLASSIFY" target support'
797 depends on NETFILTER_ADVANCED
799 This option adds a `CLASSIFY' target, which enables the user to set
800 the priority of a packet. Some qdiscs can use this value for
801 classification, among these are:
803 atm, cbq, dsmark, pfifo_fast, htb, prio
805 To compile it as a module, choose M here. If unsure, say N.
807 config NETFILTER_XT_TARGET_CONNMARK
808 tristate '"CONNMARK" target support'
809 depends on NF_CONNTRACK
810 depends on NETFILTER_ADVANCED
811 select NETFILTER_XT_CONNMARK
813 This is a backwards-compat option for the user's convenience
814 (e.g. when running oldconfig). It selects
815 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
817 config NETFILTER_XT_TARGET_CONNSECMARK
818 tristate '"CONNSECMARK" target support'
819 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
820 default m if NETFILTER_ADVANCED=n
822 The CONNSECMARK target copies security markings from packets
823 to connections, and restores security markings from connections
824 to packets (if the packets are not already marked). This would
825 normally be used in conjunction with the SECMARK target.
827 To compile it as a module, choose M here. If unsure, say N.
829 config NETFILTER_XT_TARGET_CT
830 tristate '"CT" target support'
831 depends on NF_CONNTRACK
832 depends on IP_NF_RAW || IP6_NF_RAW
833 depends on NETFILTER_ADVANCED
835 This options adds a `CT' target, which allows to specify initial
836 connection tracking parameters like events to be delivered and
837 the helper to be used.
839 To compile it as a module, choose M here. If unsure, say N.
841 config NETFILTER_XT_TARGET_DSCP
842 tristate '"DSCP" and "TOS" target support'
843 depends on IP_NF_MANGLE || IP6_NF_MANGLE
844 depends on NETFILTER_ADVANCED
846 This option adds a `DSCP' target, which allows you to manipulate
847 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
849 The DSCP field can have any value between 0x0 and 0x3f inclusive.
851 It also adds the "TOS" target, which allows you to create rules in
852 the "mangle" table which alter the Type Of Service field of an IPv4
853 or the Priority field of an IPv6 packet, prior to routing.
855 To compile it as a module, choose M here. If unsure, say N.
857 config NETFILTER_XT_TARGET_HL
858 tristate '"HL" hoplimit target support'
859 depends on IP_NF_MANGLE || IP6_NF_MANGLE
860 depends on NETFILTER_ADVANCED
862 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
863 targets, which enable the user to change the
864 hoplimit/time-to-live value of the IP header.
866 While it is safe to decrement the hoplimit/TTL value, the
867 modules also allow to increment and set the hoplimit value of
868 the header to arbitrary values. This is EXTREMELY DANGEROUS
869 since you can easily create immortal packets that loop
870 forever on the network.
872 config NETFILTER_XT_TARGET_HMARK
873 tristate '"HMARK" target support'
874 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
875 depends on NETFILTER_ADVANCED
877 This option adds the "HMARK" target.
879 The target allows you to create rules in the "raw" and "mangle" tables
880 which set the skbuff mark by means of hash calculation within a given
881 range. The nfmark can influence the routing method and can also be used
882 by other subsystems to change their behaviour.
884 To compile it as a module, choose M here. If unsure, say N.
886 config NETFILTER_XT_TARGET_IDLETIMER
887 tristate "IDLETIMER target support"
888 depends on NETFILTER_ADVANCED
891 This option adds the `IDLETIMER' target. Each matching packet
892 resets the timer associated with label specified when the rule is
893 added. When the timer expires, it triggers a sysfs notification.
894 The remaining time for expiration can be read via sysfs.
896 To compile it as a module, choose M here. If unsure, say N.
898 config NETFILTER_XT_TARGET_LED
899 tristate '"LED" target support'
900 depends on LEDS_CLASS && LEDS_TRIGGERS
901 depends on NETFILTER_ADVANCED
903 This option adds a `LED' target, which allows you to blink LEDs in
904 response to particular packets passing through your machine.
906 This can be used to turn a spare LED into a network activity LED,
907 which only flashes in response to FTP transfers, for example. Or
908 you could have an LED which lights up for a minute or two every time
909 somebody connects to your machine via SSH.
911 You will need support for the "led" class to make this work.
913 To create an LED trigger for incoming SSH traffic:
914 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
916 Then attach the new trigger to an LED on your system:
917 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
919 For more information on the LEDs available on your system, see
920 Documentation/leds/leds-class.rst
922 config NETFILTER_XT_TARGET_LOG
923 tristate "LOG target support"
926 select NF_LOG_IPV6 if IP6_NF_IPTABLES
927 default m if NETFILTER_ADVANCED=n
929 This option adds a `LOG' target, which allows you to create rules in
930 any iptables table which records the packet header to the syslog.
932 To compile it as a module, choose M here. If unsure, say N.
934 config NETFILTER_XT_TARGET_MARK
935 tristate '"MARK" target support'
936 depends on NETFILTER_ADVANCED
937 select NETFILTER_XT_MARK
939 This is a backwards-compat option for the user's convenience
940 (e.g. when running oldconfig). It selects
941 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
943 config NETFILTER_XT_NAT
944 tristate '"SNAT and DNAT" targets support'
947 This option enables the SNAT and DNAT targets.
949 To compile it as a module, choose M here. If unsure, say N.
951 config NETFILTER_XT_TARGET_NETMAP
952 tristate '"NETMAP" target support'
955 NETMAP is an implementation of static 1:1 NAT mapping of network
956 addresses. It maps the network address part, while keeping the host
959 To compile it as a module, choose M here. If unsure, say N.
961 config NETFILTER_XT_TARGET_NFLOG
962 tristate '"NFLOG" target support'
963 default m if NETFILTER_ADVANCED=n
964 select NETFILTER_NETLINK_LOG
966 This option enables the NFLOG target, which allows to LOG
967 messages through nfnetlink_log.
969 To compile it as a module, choose M here. If unsure, say N.
971 config NETFILTER_XT_TARGET_NFQUEUE
972 tristate '"NFQUEUE" target Support'
973 depends on NETFILTER_ADVANCED
974 select NETFILTER_NETLINK_QUEUE
976 This target replaced the old obsolete QUEUE target.
978 As opposed to QUEUE, it supports 65535 different queues,
981 To compile it as a module, choose M here. If unsure, say N.
983 config NETFILTER_XT_TARGET_NOTRACK
984 tristate '"NOTRACK" target support (DEPRECATED)'
985 depends on NF_CONNTRACK
986 depends on IP_NF_RAW || IP6_NF_RAW
987 depends on NETFILTER_ADVANCED
988 select NETFILTER_XT_TARGET_CT
990 config NETFILTER_XT_TARGET_RATEEST
991 tristate '"RATEEST" target support'
992 depends on NETFILTER_ADVANCED
994 This option adds a `RATEEST' target, which allows to measure
995 rates similar to TC estimators. The `rateest' match can be
996 used to match on the measured rates.
998 To compile it as a module, choose M here. If unsure, say N.
1000 config NETFILTER_XT_TARGET_REDIRECT
1001 tristate "REDIRECT target support"
1003 select NF_NAT_REDIRECT
1005 REDIRECT is a special case of NAT: all incoming connections are
1006 mapped onto the incoming interface's address, causing the packets to
1007 come to the local machine instead of passing through. This is
1008 useful for transparent proxies.
1010 To compile it as a module, choose M here. If unsure, say N.
1012 config NETFILTER_XT_TARGET_MASQUERADE
1013 tristate "MASQUERADE target support"
1015 default m if NETFILTER_ADVANCED=n
1016 select NF_NAT_MASQUERADE
1018 Masquerading is a special case of NAT: all outgoing connections are
1019 changed to seem to come from a particular interface's address, and
1020 if the interface goes down, those connections are lost. This is
1021 only useful for dialup accounts with dynamic IP address (ie. your IP
1022 address will be different on next dialup).
1024 To compile it as a module, choose M here. If unsure, say N.
1026 config NETFILTER_XT_TARGET_TEE
1027 tristate '"TEE" - packet cloning to alternate destination'
1028 depends on NETFILTER_ADVANCED
1029 depends on IPV6 || IPV6=n
1030 depends on !NF_CONNTRACK || NF_CONNTRACK
1031 depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1033 select NF_DUP_IPV6 if IP6_NF_IPTABLES
1035 This option adds a "TEE" target with which a packet can be cloned and
1036 this clone be rerouted to another nexthop.
1038 config NETFILTER_XT_TARGET_TPROXY
1039 tristate '"TPROXY" target transparent proxying support'
1040 depends on NETFILTER_XTABLES
1041 depends on NETFILTER_ADVANCED
1042 depends on IPV6 || IPV6=n
1043 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1044 depends on IP_NF_MANGLE
1045 select NF_DEFRAG_IPV4
1046 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1047 select NF_TPROXY_IPV4
1048 select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1050 This option adds a `TPROXY' target, which is somewhat similar to
1051 REDIRECT. It can only be used in the mangle table and is useful
1052 to redirect traffic to a transparent proxy. It does _not_ depend
1053 on Netfilter connection tracking and NAT, unlike REDIRECT.
1054 For it to work you will have to configure certain iptables rules
1055 and use policy routing. For more information on how to set it up
1056 see Documentation/networking/tproxy.txt.
1058 To compile it as a module, choose M here. If unsure, say N.
1060 config NETFILTER_XT_TARGET_TRACE
1061 tristate '"TRACE" target support'
1062 depends on IP_NF_RAW || IP6_NF_RAW
1063 depends on NETFILTER_ADVANCED
1065 The TRACE target allows you to mark packets so that the kernel
1066 will log every rule which match the packets as those traverse
1067 the tables, chains, rules.
1069 If you want to compile it as a module, say M here and read
1070 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1072 config NETFILTER_XT_TARGET_SECMARK
1073 tristate '"SECMARK" target support'
1074 depends on NETWORK_SECMARK
1075 default m if NETFILTER_ADVANCED=n
1077 The SECMARK target allows security marking of network
1078 packets, for use with security subsystems.
1080 To compile it as a module, choose M here. If unsure, say N.
1082 config NETFILTER_XT_TARGET_TCPMSS
1083 tristate '"TCPMSS" target support'
1084 depends on IPV6 || IPV6=n
1085 default m if NETFILTER_ADVANCED=n
1087 This option adds a `TCPMSS' target, which allows you to alter the
1088 MSS value of TCP SYN packets, to control the maximum size for that
1089 connection (usually limiting it to your outgoing interface's MTU
1092 This is used to overcome criminally braindead ISPs or servers which
1093 block ICMP Fragmentation Needed packets. The symptoms of this
1094 problem are that everything works fine from your Linux
1095 firewall/router, but machines behind it can never exchange large
1097 1) Web browsers connect, then hang with no data received.
1098 2) Small mail works fine, but large emails hang.
1099 3) ssh works fine, but scp hangs after initial handshaking.
1101 Workaround: activate this option and add a rule to your firewall
1104 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1105 -j TCPMSS --clamp-mss-to-pmtu
1107 To compile it as a module, choose M here. If unsure, say N.
1109 config NETFILTER_XT_TARGET_TCPOPTSTRIP
1110 tristate '"TCPOPTSTRIP" target support'
1111 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1112 depends on NETFILTER_ADVANCED
1114 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1115 TCP options from TCP packets.
1117 # alphabetically ordered list of matches
1119 comment "Xtables matches"
1121 config NETFILTER_XT_MATCH_ADDRTYPE
1122 tristate '"addrtype" address type match support'
1123 default m if NETFILTER_ADVANCED=n
1125 This option allows you to match what routing thinks of an address,
1126 eg. UNICAST, LOCAL, BROADCAST, ...
1128 If you want to compile it as a module, say M here and read
1129 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1131 config NETFILTER_XT_MATCH_BPF
1132 tristate '"bpf" match support'
1133 depends on NETFILTER_ADVANCED
1135 BPF matching applies a linux socket filter to each packet and
1136 accepts those for which the filter returns non-zero.
1138 To compile it as a module, choose M here. If unsure, say N.
1140 config NETFILTER_XT_MATCH_CGROUP
1141 tristate '"control group" match support'
1142 depends on NETFILTER_ADVANCED
1144 select CGROUP_NET_CLASSID
1146 Socket/process control group matching allows you to match locally
1147 generated packets based on which net_cls control group processes
1150 config NETFILTER_XT_MATCH_CLUSTER
1151 tristate '"cluster" match support'
1152 depends on NF_CONNTRACK
1153 depends on NETFILTER_ADVANCED
1155 This option allows you to build work-load-sharing clusters of
1156 network servers/stateful firewalls without having a dedicated
1157 load-balancing router/server/switch. Basically, this match returns
1158 true when the packet must be handled by this cluster node. Thus,
1159 all nodes see all packets and this match decides which node handles
1160 what packets. The work-load sharing algorithm is based on source
1163 If you say Y or M here, try `iptables -m cluster --help` for
1166 config NETFILTER_XT_MATCH_COMMENT
1167 tristate '"comment" match support'
1168 depends on NETFILTER_ADVANCED
1170 This option adds a `comment' dummy-match, which allows you to put
1171 comments in your iptables ruleset.
1173 If you want to compile it as a module, say M here and read
1174 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1176 config NETFILTER_XT_MATCH_CONNBYTES
1177 tristate '"connbytes" per-connection counter match support'
1178 depends on NF_CONNTRACK
1179 depends on NETFILTER_ADVANCED
1181 This option adds a `connbytes' match, which allows you to match the
1182 number of bytes and/or packets for each direction within a connection.
1184 If you want to compile it as a module, say M here and read
1185 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1187 config NETFILTER_XT_MATCH_CONNLABEL
1188 tristate '"connlabel" match support'
1189 select NF_CONNTRACK_LABELS
1190 depends on NF_CONNTRACK
1191 depends on NETFILTER_ADVANCED
1193 This match allows you to test and assign userspace-defined labels names
1194 to a connection. The kernel only stores bit values - mapping
1195 names to bits is done by userspace.
1197 Unlike connmark, more than 32 flag bits may be assigned to a
1198 connection simultaneously.
1200 config NETFILTER_XT_MATCH_CONNLIMIT
1201 tristate '"connlimit" match support'
1202 depends on NF_CONNTRACK
1203 depends on NETFILTER_ADVANCED
1204 select NETFILTER_CONNCOUNT
1206 This match allows you to match against the number of parallel
1207 connections to a server per client IP address (or address block).
1209 config NETFILTER_XT_MATCH_CONNMARK
1210 tristate '"connmark" connection mark match support'
1211 depends on NF_CONNTRACK
1212 depends on NETFILTER_ADVANCED
1213 select NETFILTER_XT_CONNMARK
1215 This is a backwards-compat option for the user's convenience
1216 (e.g. when running oldconfig). It selects
1217 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1219 config NETFILTER_XT_MATCH_CONNTRACK
1220 tristate '"conntrack" connection tracking match support'
1221 depends on NF_CONNTRACK
1222 default m if NETFILTER_ADVANCED=n
1224 This is a general conntrack match module, a superset of the state match.
1226 It allows matching on additional conntrack information, which is
1227 useful in complex configurations, such as NAT gateways with multiple
1228 internet links or tunnels.
1230 To compile it as a module, choose M here. If unsure, say N.
1232 config NETFILTER_XT_MATCH_CPU
1233 tristate '"cpu" match support'
1234 depends on NETFILTER_ADVANCED
1236 CPU matching allows you to match packets based on the CPU
1237 currently handling the packet.
1239 To compile it as a module, choose M here. If unsure, say N.
1241 config NETFILTER_XT_MATCH_DCCP
1242 tristate '"dccp" protocol match support'
1243 depends on NETFILTER_ADVANCED
1246 With this option enabled, you will be able to use the iptables
1247 `dccp' match in order to match on DCCP source/destination ports
1250 If you want to compile it as a module, say M here and read
1251 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1253 config NETFILTER_XT_MATCH_DEVGROUP
1254 tristate '"devgroup" match support'
1255 depends on NETFILTER_ADVANCED
1257 This options adds a `devgroup' match, which allows to match on the
1258 device group a network device is assigned to.
1260 To compile it as a module, choose M here. If unsure, say N.
1262 config NETFILTER_XT_MATCH_DSCP
1263 tristate '"dscp" and "tos" match support'
1264 depends on NETFILTER_ADVANCED
1266 This option adds a `DSCP' match, which allows you to match against
1267 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1269 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1271 It will also add a "tos" match, which allows you to match packets
1272 based on the Type Of Service fields of the IPv4 packet (which share
1273 the same bits as DSCP).
1275 To compile it as a module, choose M here. If unsure, say N.
1277 config NETFILTER_XT_MATCH_ECN
1278 tristate '"ecn" match support'
1279 depends on NETFILTER_ADVANCED
1281 This option adds an "ECN" match, which allows you to match against
1282 the IPv4 and TCP header ECN fields.
1284 To compile it as a module, choose M here. If unsure, say N.
1286 config NETFILTER_XT_MATCH_ESP
1287 tristate '"esp" match support'
1288 depends on NETFILTER_ADVANCED
1290 This match extension allows you to match a range of SPIs
1291 inside ESP header of IPSec packets.
1293 To compile it as a module, choose M here. If unsure, say N.
1295 config NETFILTER_XT_MATCH_HASHLIMIT
1296 tristate '"hashlimit" match support'
1297 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1298 depends on NETFILTER_ADVANCED
1300 This option adds a `hashlimit' match.
1302 As opposed to `limit', this match dynamically creates a hash table
1303 of limit buckets, based on your selection of source/destination
1304 addresses and/or ports.
1306 It enables you to express policies like `10kpps for any given
1307 destination address' or `500pps from any given source address'
1310 config NETFILTER_XT_MATCH_HELPER
1311 tristate '"helper" match support'
1312 depends on NF_CONNTRACK
1313 depends on NETFILTER_ADVANCED
1315 Helper matching allows you to match packets in dynamic connections
1316 tracked by a conntrack-helper, ie. ip_conntrack_ftp
1318 To compile it as a module, choose M here. If unsure, say Y.
1320 config NETFILTER_XT_MATCH_HL
1321 tristate '"hl" hoplimit/TTL match support'
1322 depends on NETFILTER_ADVANCED
1324 HL matching allows you to match packets based on the hoplimit
1325 in the IPv6 header, or the time-to-live field in the IPv4
1326 header of the packet.
1328 config NETFILTER_XT_MATCH_IPCOMP
1329 tristate '"ipcomp" match support'
1330 depends on NETFILTER_ADVANCED
1332 This match extension allows you to match a range of CPIs(16 bits)
1333 inside IPComp header of IPSec packets.
1335 To compile it as a module, choose M here. If unsure, say N.
1337 config NETFILTER_XT_MATCH_IPRANGE
1338 tristate '"iprange" address range match support'
1339 depends on NETFILTER_ADVANCED
1341 This option adds a "iprange" match, which allows you to match based on
1342 an IP address range. (Normal iptables only matches on single addresses
1343 with an optional mask.)
1347 config NETFILTER_XT_MATCH_IPVS
1348 tristate '"ipvs" match support'
1350 depends on NETFILTER_ADVANCED
1351 depends on NF_CONNTRACK
1353 This option allows you to match against IPVS properties of a packet.
1357 config NETFILTER_XT_MATCH_L2TP
1358 tristate '"l2tp" match support'
1359 depends on NETFILTER_ADVANCED
1362 This option adds an "L2TP" match, which allows you to match against
1363 L2TP protocol header fields.
1365 To compile it as a module, choose M here. If unsure, say N.
1367 config NETFILTER_XT_MATCH_LENGTH
1368 tristate '"length" match support'
1369 depends on NETFILTER_ADVANCED
1371 This option allows you to match the length of a packet against a
1372 specific value or range of values.
1374 To compile it as a module, choose M here. If unsure, say N.
1376 config NETFILTER_XT_MATCH_LIMIT
1377 tristate '"limit" match support'
1378 depends on NETFILTER_ADVANCED
1380 limit matching allows you to control the rate at which a rule can be
1381 matched: mainly useful in combination with the LOG target ("LOG
1382 target support", below) and to avoid some Denial of Service attacks.
1384 To compile it as a module, choose M here. If unsure, say N.
1386 config NETFILTER_XT_MATCH_MAC
1387 tristate '"mac" address match support'
1388 depends on NETFILTER_ADVANCED
1390 MAC matching allows you to match packets based on the source
1391 Ethernet address of the packet.
1393 To compile it as a module, choose M here. If unsure, say N.
1395 config NETFILTER_XT_MATCH_MARK
1396 tristate '"mark" match support'
1397 depends on NETFILTER_ADVANCED
1398 select NETFILTER_XT_MARK
1400 This is a backwards-compat option for the user's convenience
1401 (e.g. when running oldconfig). It selects
1402 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1404 config NETFILTER_XT_MATCH_MULTIPORT
1405 tristate '"multiport" Multiple port match support'
1406 depends on NETFILTER_ADVANCED
1408 Multiport matching allows you to match TCP or UDP packets based on
1409 a series of source or destination ports: normally a rule can only
1410 match a single range of ports.
1412 To compile it as a module, choose M here. If unsure, say N.
1414 config NETFILTER_XT_MATCH_NFACCT
1415 tristate '"nfacct" match support'
1416 depends on NETFILTER_ADVANCED
1417 select NETFILTER_NETLINK_ACCT
1419 This option allows you to use the extended accounting through
1422 To compile it as a module, choose M here. If unsure, say N.
1424 config NETFILTER_XT_MATCH_OSF
1425 tristate '"osf" Passive OS fingerprint match'
1426 depends on NETFILTER_ADVANCED
1427 select NETFILTER_NETLINK_OSF
1429 This option selects the Passive OS Fingerprinting match module
1430 that allows to passively match the remote operating system by
1431 analyzing incoming TCP SYN packets.
1433 Rules and loading software can be downloaded from
1434 http://www.ioremap.net/projects/osf
1436 To compile it as a module, choose M here. If unsure, say N.
1438 config NETFILTER_XT_MATCH_OWNER
1439 tristate '"owner" match support'
1440 depends on NETFILTER_ADVANCED
1442 Socket owner matching allows you to match locally-generated packets
1443 based on who created the socket: the user or group. It is also
1444 possible to check whether a socket actually exists.
1446 config NETFILTER_XT_MATCH_POLICY
1447 tristate 'IPsec "policy" match support'
1449 default m if NETFILTER_ADVANCED=n
1451 Policy matching allows you to match packets based on the
1452 IPsec policy that was used during decapsulation/will
1453 be used during encapsulation.
1455 To compile it as a module, choose M here. If unsure, say N.
1457 config NETFILTER_XT_MATCH_PHYSDEV
1458 tristate '"physdev" match support'
1459 depends on BRIDGE && BRIDGE_NETFILTER
1460 depends on NETFILTER_ADVANCED
1462 Physdev packet matching matches against the physical bridge ports
1463 the IP packet arrived on or will leave by.
1465 To compile it as a module, choose M here. If unsure, say N.
1467 config NETFILTER_XT_MATCH_PKTTYPE
1468 tristate '"pkttype" packet type match support'
1469 depends on NETFILTER_ADVANCED
1471 Packet type matching allows you to match a packet by
1472 its "class", eg. BROADCAST, MULTICAST, ...
1475 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1477 To compile it as a module, choose M here. If unsure, say N.
1479 config NETFILTER_XT_MATCH_QUOTA
1480 tristate '"quota" match support'
1481 depends on NETFILTER_ADVANCED
1483 This option adds a `quota' match, which allows to match on a
1486 If you want to compile it as a module, say M here and read
1487 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1489 config NETFILTER_XT_MATCH_RATEEST
1490 tristate '"rateest" match support'
1491 depends on NETFILTER_ADVANCED
1492 select NETFILTER_XT_TARGET_RATEEST
1494 This option adds a `rateest' match, which allows to match on the
1495 rate estimated by the RATEEST target.
1497 To compile it as a module, choose M here. If unsure, say N.
1499 config NETFILTER_XT_MATCH_REALM
1500 tristate '"realm" match support'
1501 depends on NETFILTER_ADVANCED
1502 select IP_ROUTE_CLASSID
1504 This option adds a `realm' match, which allows you to use the realm
1505 key from the routing subsystem inside iptables.
1507 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1510 If you want to compile it as a module, say M here and read
1511 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1513 config NETFILTER_XT_MATCH_RECENT
1514 tristate '"recent" match support'
1515 depends on NETFILTER_ADVANCED
1517 This match is used for creating one or many lists of recently
1518 used addresses and then matching against that/those list(s).
1520 Short options are available by using 'iptables -m recent -h'
1521 Official Website: <http://snowman.net/projects/ipt_recent/>
1523 config NETFILTER_XT_MATCH_SCTP
1524 tristate '"sctp" protocol match support'
1525 depends on NETFILTER_ADVANCED
1528 With this option enabled, you will be able to use the
1529 `sctp' match in order to match on SCTP source/destination ports
1530 and SCTP chunk types.
1532 If you want to compile it as a module, say M here and read
1533 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
1535 config NETFILTER_XT_MATCH_SOCKET
1536 tristate '"socket" match support'
1537 depends on NETFILTER_XTABLES
1538 depends on NETFILTER_ADVANCED
1539 depends on IPV6 || IPV6=n
1540 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1541 select NF_SOCKET_IPV4
1542 select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1543 select NF_DEFRAG_IPV4
1544 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1546 This option adds a `socket' match, which can be used to match
1547 packets for which a TCP or UDP socket lookup finds a valid socket.
1548 It can be used in combination with the MARK target and policy
1549 routing to implement full featured non-locally bound sockets.
1551 To compile it as a module, choose M here. If unsure, say N.
1553 config NETFILTER_XT_MATCH_STATE
1554 tristate '"state" match support'
1555 depends on NF_CONNTRACK
1556 default m if NETFILTER_ADVANCED=n
1558 Connection state matching allows you to match packets based on their
1559 relationship to a tracked connection (ie. previous packets). This
1560 is a powerful tool for packet classification.
1562 To compile it as a module, choose M here. If unsure, say N.
1564 config NETFILTER_XT_MATCH_STATISTIC
1565 tristate '"statistic" match support'
1566 depends on NETFILTER_ADVANCED
1568 This option adds a `statistic' match, which allows you to match
1569 on packets periodically or randomly with a given percentage.
1571 To compile it as a module, choose M here. If unsure, say N.
1573 config NETFILTER_XT_MATCH_STRING
1574 tristate '"string" match support'
1575 depends on NETFILTER_ADVANCED
1577 select TEXTSEARCH_KMP
1578 select TEXTSEARCH_BM
1579 select TEXTSEARCH_FSM
1581 This option adds a `string' match, which allows you to look for
1582 pattern matchings in packets.
1584 To compile it as a module, choose M here. If unsure, say N.
1586 config NETFILTER_XT_MATCH_TCPMSS
1587 tristate '"tcpmss" match support'
1588 depends on NETFILTER_ADVANCED
1590 This option adds a `tcpmss' match, which allows you to examine the
1591 MSS value of TCP SYN packets, which control the maximum packet size
1592 for that connection.
1594 To compile it as a module, choose M here. If unsure, say N.
1596 config NETFILTER_XT_MATCH_TIME
1597 tristate '"time" match support'
1598 depends on NETFILTER_ADVANCED
1600 This option adds a "time" match, which allows you to match based on
1601 the packet arrival time (at the machine which netfilter is running)
1602 on) or departure time/date (for locally generated packets).
1604 If you say Y here, try `iptables -m time --help` for
1607 If you want to compile it as a module, say M here.
1610 config NETFILTER_XT_MATCH_U32
1611 tristate '"u32" match support'
1612 depends on NETFILTER_ADVANCED
1614 u32 allows you to extract quantities of up to 4 bytes from a packet,
1615 AND them with specified masks, shift them by specified amounts and
1616 test whether the results are in any of a set of specified ranges.
1617 The specification of what to extract is general enough to skip over
1618 headers with lengths stored in the packet, as in IP or TCP header
1621 Details and examples are in the kernel module source.
1623 endif # NETFILTER_XTABLES
1627 source "net/netfilter/ipset/Kconfig"
1629 source "net/netfilter/ipvs/Kconfig"