1 menu "Core Netfilter Configuration"
2 depends on NET && NETFILTER
4 config NETFILTER_NETLINK
5 tristate "Netfilter netlink interface"
7 If this option is enabled, the kernel will include support
8 for the new netfilter netlink interface.
10 config NETFILTER_NETLINK_QUEUE
11 tristate "Netfilter NFQUEUE over NFNETLINK interface"
12 depends on NETFILTER_NETLINK
14 If this option is enabled, the kernel will include support
15 for queueing packets via NFNETLINK.
17 config NETFILTER_NETLINK_LOG
18 tristate "Netfilter LOG over NFNETLINK interface"
19 depends on NETFILTER_NETLINK
21 If this option is enabled, the kernel will include support
22 for logging packets via NFNETLINK.
24 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
25 and is also scheduled to replace the old syslog-based ipt_LOG
28 config NF_CONNTRACK_ENABLED
29 tristate "Netfilter connection tracking support"
31 Connection tracking keeps a record of what packets have passed
32 through your machine, in order to figure out how they are related
35 This is required to do Masquerading or other kinds of Network
36 Address Translation (except for Fast NAT). It can also be used to
37 enhance packet filtering (see `Connection state match support'
40 To compile it as a module, choose M here. If unsure, say N.
43 prompt "Netfilter connection tracking support"
44 depends on NF_CONNTRACK_ENABLED
46 config NF_CONNTRACK_SUPPORT
47 bool "Layer 3 Independent Connection tracking (EXPERIMENTAL)"
48 depends on EXPERIMENTAL
50 Layer 3 independent connection tracking is experimental scheme
51 which generalize ip_conntrack to support other layer 3 protocols.
53 This is required to do Masquerading or other kinds of Network
54 Address Translation (except for Fast NAT). It can also be used to
55 enhance packet filtering (see `Connection state match support'
58 config IP_NF_CONNTRACK_SUPPORT
59 bool "Layer 3 Dependent Connection tracking"
61 The old, Layer 3 dependent ip_conntrack subsystem of netfilter.
63 This is required to do Masquerading or other kinds of Network
64 Address Translation (except for Fast NAT). It can also be used to
65 enhance packet filtering (see `Connection state match support'
72 default m if NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=m
73 default y if NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=y
75 config IP_NF_CONNTRACK
77 default m if IP_NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=m
78 default y if IP_NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=y
81 bool "Connection tracking flow accounting"
82 depends on NF_CONNTRACK
84 If this option is enabled, the connection tracking code will
85 keep per-flow packet and byte counters.
87 Those counters can be used for flow-based accounting or the
92 config NF_CONNTRACK_MARK
93 bool 'Connection mark tracking support'
94 depends on NF_CONNTRACK
96 This option enables support for connection marks, used by the
97 `CONNMARK' target and `connmark' match. Similar to the mark value
98 of packets, but this mark value is kept in the conntrack session
99 instead of the individual packets.
101 config NF_CONNTRACK_SECMARK
102 bool 'Connection tracking security mark support'
103 depends on NF_CONNTRACK && NETWORK_SECMARK
105 This option enables security markings to be applied to
106 connections. Typically they are copied to connections from
107 packets using the CONNSECMARK target and copied back from
108 connections to packets with the same target, with the packets
109 being originally labeled via SECMARK.
113 config NF_CONNTRACK_EVENTS
114 bool "Connection tracking events (EXPERIMENTAL)"
115 depends on EXPERIMENTAL && NF_CONNTRACK
117 If this option is enabled, the connection tracking code will
118 provide a notifier chain that can be used by other kernel code
119 to get notified about changes in the connection tracking state.
123 config NF_CT_PROTO_SCTP
124 tristate 'SCTP protocol on new connection tracking support (EXPERIMENTAL)'
125 depends on EXPERIMENTAL && NF_CONNTRACK
128 With this option enabled, the layer 3 independent connection
129 tracking code will be able to do state tracking on SCTP connections.
131 If you want to compile it as a module, say M here and read
132 Documentation/modules.txt. If unsure, say `N'.
134 config NF_CONNTRACK_AMANDA
135 tristate "Amanda backup protocol support (EXPERIMENTAL)"
136 depends on EXPERIMENTAL && NF_CONNTRACK
138 select TEXTSEARCH_KMP
140 If you are running the Amanda backup package <http://www.amanda.org/>
141 on this machine or machines that will be MASQUERADED through this
142 machine, then you may want to enable this feature. This allows the
143 connection tracking and natting code to allow the sub-channels that
144 Amanda requires for communication of the backup data, messages and
147 To compile it as a module, choose M here. If unsure, say N.
149 config NF_CONNTRACK_FTP
150 tristate "FTP support on new connection tracking (EXPERIMENTAL)"
151 depends on EXPERIMENTAL && NF_CONNTRACK
153 Tracking FTP connections is problematic: special helpers are
154 required for tracking them, and doing masquerading and other forms
155 of Network Address Translation on them.
157 This is FTP support on Layer 3 independent connection tracking.
158 Layer 3 independent connection tracking is experimental scheme
159 which generalize ip_conntrack to support other layer 3 protocols.
161 To compile it as a module, choose M here. If unsure, say N.
164 tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
165 depends on EXPERIMENTAL && NF_CONNTRACK && NETFILTER_NETLINK
166 depends on NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
168 This option enables support for a netlink-based userspace interface
170 config NETFILTER_XTABLES
171 tristate "Netfilter Xtables support (required for ip_tables)"
173 This is required if you intend to use any of ip_tables,
174 ip6_tables or arp_tables.
176 # alphabetically ordered list of targets
178 config NETFILTER_XT_TARGET_CLASSIFY
179 tristate '"CLASSIFY" target support'
180 depends on NETFILTER_XTABLES
182 This option adds a `CLASSIFY' target, which enables the user to set
183 the priority of a packet. Some qdiscs can use this value for
184 classification, among these are:
186 atm, cbq, dsmark, pfifo_fast, htb, prio
188 To compile it as a module, choose M here. If unsure, say N.
190 config NETFILTER_XT_TARGET_CONNMARK
191 tristate '"CONNMARK" target support'
192 depends on NETFILTER_XTABLES
193 depends on IP_NF_MANGLE || IP6_NF_MANGLE
194 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
196 This option adds a `CONNMARK' target, which allows one to manipulate
197 the connection mark value. Similar to the MARK target, but
198 affects the connection mark value rather than the packet mark value.
200 If you want to compile it as a module, say M here and read
201 <file:Documentation/modules.txt>. The module will be called
202 ipt_CONNMARK.o. If unsure, say `N'.
204 config NETFILTER_XT_TARGET_DSCP
205 tristate '"DSCP" target support'
206 depends on NETFILTER_XTABLES
207 depends on IP_NF_MANGLE || IP6_NF_MANGLE
209 This option adds a `DSCP' target, which allows you to manipulate
210 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
212 The DSCP field can have any value between 0x0 and 0x3f inclusive.
214 To compile it as a module, choose M here. If unsure, say N.
216 config NETFILTER_XT_TARGET_MARK
217 tristate '"MARK" target support'
218 depends on NETFILTER_XTABLES
220 This option adds a `MARK' target, which allows you to create rules
221 in the `mangle' table which alter the netfilter mark (nfmark) field
222 associated with the packet prior to routing. This can change
223 the routing method (see `Use netfilter MARK value as routing
224 key') and can also be used by other subsystems to change their
227 To compile it as a module, choose M here. If unsure, say N.
229 config NETFILTER_XT_TARGET_NFQUEUE
230 tristate '"NFQUEUE" target Support'
231 depends on NETFILTER_XTABLES
233 This target replaced the old obsolete QUEUE target.
235 As opposed to QUEUE, it supports 65535 different queues,
238 To compile it as a module, choose M here. If unsure, say N.
240 config NETFILTER_XT_TARGET_NFLOG
241 tristate '"NFLOG" target support'
242 depends on NETFILTER_XTABLES
244 This option enables the NFLOG target, which allows to LOG
245 messages through the netfilter logging API, which can use
246 either the old LOG target, the old ULOG target or nfnetlink_log
249 To compile it as a module, choose M here. If unsure, say N.
251 config NETFILTER_XT_TARGET_NOTRACK
252 tristate '"NOTRACK" target support'
253 depends on NETFILTER_XTABLES
254 depends on IP_NF_RAW || IP6_NF_RAW
255 depends on IP_NF_CONNTRACK || NF_CONNTRACK
257 The NOTRACK target allows a select rule to specify
258 which packets *not* to enter the conntrack/NAT
259 subsystem with all the consequences (no ICMP error tracking,
260 no protocol helpers for the selected packets).
262 If you want to compile it as a module, say M here and read
263 <file:Documentation/modules.txt>. If unsure, say `N'.
265 config NETFILTER_XT_TARGET_SECMARK
266 tristate '"SECMARK" target support'
267 depends on NETFILTER_XTABLES && NETWORK_SECMARK
269 The SECMARK target allows security marking of network
270 packets, for use with security subsystems.
272 To compile it as a module, choose M here. If unsure, say N.
274 config NETFILTER_XT_TARGET_CONNSECMARK
275 tristate '"CONNSECMARK" target support'
276 depends on NETFILTER_XTABLES && \
277 ((NF_CONNTRACK && NF_CONNTRACK_SECMARK) || \
278 (IP_NF_CONNTRACK && IP_NF_CONNTRACK_SECMARK))
280 The CONNSECMARK target copies security markings from packets
281 to connections, and restores security markings from connections
282 to packets (if the packets are not already marked). This would
283 normally be used in conjunction with the SECMARK target.
285 To compile it as a module, choose M here. If unsure, say N.
287 config NETFILTER_XT_MATCH_COMMENT
288 tristate '"comment" match support'
289 depends on NETFILTER_XTABLES
291 This option adds a `comment' dummy-match, which allows you to put
292 comments in your iptables ruleset.
294 If you want to compile it as a module, say M here and read
295 <file:Documentation/modules.txt>. If unsure, say `N'.
297 config NETFILTER_XT_MATCH_CONNBYTES
298 tristate '"connbytes" per-connection counter match support'
299 depends on NETFILTER_XTABLES
300 depends on (IP_NF_CONNTRACK && IP_NF_CT_ACCT) || (NF_CT_ACCT && NF_CONNTRACK)
302 This option adds a `connbytes' match, which allows you to match the
303 number of bytes and/or packets for each direction within a connection.
305 If you want to compile it as a module, say M here and read
306 <file:Documentation/modules.txt>. If unsure, say `N'.
308 config NETFILTER_XT_MATCH_CONNMARK
309 tristate '"connmark" connection mark match support'
310 depends on NETFILTER_XTABLES
311 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
313 This option adds a `connmark' match, which allows you to match the
314 connection mark value previously set for the session by `CONNMARK'.
316 If you want to compile it as a module, say M here and read
317 <file:Documentation/modules.txt>. The module will be called
318 ipt_connmark.o. If unsure, say `N'.
320 config NETFILTER_XT_MATCH_CONNTRACK
321 tristate '"conntrack" connection tracking match support'
322 depends on NETFILTER_XTABLES
323 depends on IP_NF_CONNTRACK || NF_CONNTRACK
325 This is a general conntrack match module, a superset of the state match.
327 It allows matching on additional conntrack information, which is
328 useful in complex configurations, such as NAT gateways with multiple
329 internet links or tunnels.
331 To compile it as a module, choose M here. If unsure, say N.
333 config NETFILTER_XT_MATCH_DCCP
334 tristate '"DCCP" protocol match support'
335 depends on NETFILTER_XTABLES
337 With this option enabled, you will be able to use the iptables
338 `dccp' match in order to match on DCCP source/destination ports
341 If you want to compile it as a module, say M here and read
342 <file:Documentation/modules.txt>. If unsure, say `N'.
344 config NETFILTER_XT_MATCH_DSCP
345 tristate '"DSCP" match support'
346 depends on NETFILTER_XTABLES
348 This option adds a `DSCP' match, which allows you to match against
349 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
351 The DSCP field can have any value between 0x0 and 0x3f inclusive.
353 To compile it as a module, choose M here. If unsure, say N.
355 config NETFILTER_XT_MATCH_ESP
356 tristate '"ESP" match support'
357 depends on NETFILTER_XTABLES
359 This match extension allows you to match a range of SPIs
360 inside ESP header of IPSec packets.
362 To compile it as a module, choose M here. If unsure, say N.
364 config NETFILTER_XT_MATCH_HELPER
365 tristate '"helper" match support'
366 depends on NETFILTER_XTABLES
367 depends on IP_NF_CONNTRACK || NF_CONNTRACK
369 Helper matching allows you to match packets in dynamic connections
370 tracked by a conntrack-helper, ie. ip_conntrack_ftp
372 To compile it as a module, choose M here. If unsure, say Y.
374 config NETFILTER_XT_MATCH_LENGTH
375 tristate '"length" match support'
376 depends on NETFILTER_XTABLES
378 This option allows you to match the length of a packet against a
379 specific value or range of values.
381 To compile it as a module, choose M here. If unsure, say N.
383 config NETFILTER_XT_MATCH_LIMIT
384 tristate '"limit" match support'
385 depends on NETFILTER_XTABLES
387 limit matching allows you to control the rate at which a rule can be
388 matched: mainly useful in combination with the LOG target ("LOG
389 target support", below) and to avoid some Denial of Service attacks.
391 To compile it as a module, choose M here. If unsure, say N.
393 config NETFILTER_XT_MATCH_MAC
394 tristate '"mac" address match support'
395 depends on NETFILTER_XTABLES
397 MAC matching allows you to match packets based on the source
398 Ethernet address of the packet.
400 To compile it as a module, choose M here. If unsure, say N.
402 config NETFILTER_XT_MATCH_MARK
403 tristate '"mark" match support'
404 depends on NETFILTER_XTABLES
406 Netfilter mark matching allows you to match packets based on the
407 `nfmark' value in the packet. This can be set by the MARK target
410 To compile it as a module, choose M here. If unsure, say N.
412 config NETFILTER_XT_MATCH_POLICY
413 tristate 'IPsec "policy" match support'
414 depends on NETFILTER_XTABLES && XFRM
416 Policy matching allows you to match packets based on the
417 IPsec policy that was used during decapsulation/will
418 be used during encapsulation.
420 To compile it as a module, choose M here. If unsure, say N.
422 config NETFILTER_XT_MATCH_MULTIPORT
423 tristate "Multiple port match support"
424 depends on NETFILTER_XTABLES
426 Multiport matching allows you to match TCP or UDP packets based on
427 a series of source or destination ports: normally a rule can only
428 match a single range of ports.
430 To compile it as a module, choose M here. If unsure, say N.
432 config NETFILTER_XT_MATCH_PHYSDEV
433 tristate '"physdev" match support'
434 depends on NETFILTER_XTABLES && BRIDGE && BRIDGE_NETFILTER
436 Physdev packet matching matches against the physical bridge ports
437 the IP packet arrived on or will leave by.
439 To compile it as a module, choose M here. If unsure, say N.
441 config NETFILTER_XT_MATCH_PKTTYPE
442 tristate '"pkttype" packet type match support'
443 depends on NETFILTER_XTABLES
445 Packet type matching allows you to match a packet by
446 its "class", eg. BROADCAST, MULTICAST, ...
449 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
451 To compile it as a module, choose M here. If unsure, say N.
453 config NETFILTER_XT_MATCH_QUOTA
454 tristate '"quota" match support'
455 depends on NETFILTER_XTABLES
457 This option adds a `quota' match, which allows to match on a
460 If you want to compile it as a module, say M here and read
461 <file:Documentation/modules.txt>. If unsure, say `N'.
463 config NETFILTER_XT_MATCH_REALM
464 tristate '"realm" match support'
465 depends on NETFILTER_XTABLES
468 This option adds a `realm' match, which allows you to use the realm
469 key from the routing subsystem inside iptables.
471 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
474 If you want to compile it as a module, say M here and read
475 <file:Documentation/modules.txt>. If unsure, say `N'.
477 config NETFILTER_XT_MATCH_SCTP
478 tristate '"sctp" protocol match support (EXPERIMENTAL)'
479 depends on NETFILTER_XTABLES && EXPERIMENTAL
481 With this option enabled, you will be able to use the
482 `sctp' match in order to match on SCTP source/destination ports
483 and SCTP chunk types.
485 If you want to compile it as a module, say M here and read
486 <file:Documentation/modules.txt>. If unsure, say `N'.
488 config NETFILTER_XT_MATCH_STATE
489 tristate '"state" match support'
490 depends on NETFILTER_XTABLES
491 depends on IP_NF_CONNTRACK || NF_CONNTRACK
493 Connection state matching allows you to match packets based on their
494 relationship to a tracked connection (ie. previous packets). This
495 is a powerful tool for packet classification.
497 To compile it as a module, choose M here. If unsure, say N.
499 config NETFILTER_XT_MATCH_STATISTIC
500 tristate '"statistic" match support'
501 depends on NETFILTER_XTABLES
503 This option adds a `statistic' match, which allows you to match
504 on packets periodically or randomly with a given percentage.
506 To compile it as a module, choose M here. If unsure, say N.
508 config NETFILTER_XT_MATCH_STRING
509 tristate '"string" match support'
510 depends on NETFILTER_XTABLES
512 select TEXTSEARCH_KMP
514 select TEXTSEARCH_FSM
516 This option adds a `string' match, which allows you to look for
517 pattern matchings in packets.
519 To compile it as a module, choose M here. If unsure, say N.
521 config NETFILTER_XT_MATCH_TCPMSS
522 tristate '"tcpmss" match support'
523 depends on NETFILTER_XTABLES
525 This option adds a `tcpmss' match, which allows you to examine the
526 MSS value of TCP SYN packets, which control the maximum packet size
529 To compile it as a module, choose M here. If unsure, say N.
531 config NETFILTER_XT_MATCH_HASHLIMIT
532 tristate '"hashlimit" match support'
533 depends on NETFILTER_XTABLES
535 This option adds a `hashlimit' match.
537 As opposed to `limit', this match dynamically creates a hash table
538 of limit buckets, based on your selection of source/destination
539 addresses and/or ports.
541 It enables you to express policies like `10kpps for any given
542 destination address' or `500pps from any given source address'