1 menu "Core Netfilter Configuration"
2 depends on NET && NETFILTER
4 config NETFILTER_NETLINK
5 tristate "Netfilter netlink interface"
7 If this option is enabled, the kernel will include support
8 for the new netfilter netlink interface.
10 config NETFILTER_NETLINK_QUEUE
11 tristate "Netfilter NFQUEUE over NFNETLINK interface"
12 depends on NETFILTER_NETLINK
14 If this option is enabled, the kernel will include support
15 for queueing packets via NFNETLINK.
17 config NETFILTER_NETLINK_LOG
18 tristate "Netfilter LOG over NFNETLINK interface"
19 depends on NETFILTER_NETLINK
21 If this option is enabled, the kernel will include support
22 for logging packets via NFNETLINK.
24 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
25 and is also scheduled to replace the old syslog-based ipt_LOG
29 tristate "Layer 3 Independent Connection tracking (EXPERIMENTAL)"
30 depends on EXPERIMENTAL && IP_NF_CONNTRACK=n
33 Connection tracking keeps a record of what packets have passed
34 through your machine, in order to figure out how they are related
37 Layer 3 independent connection tracking is experimental scheme
38 which generalize ip_conntrack to support other layer 3 protocols.
40 To compile it as a module, choose M here. If unsure, say N.
43 bool "Connection tracking flow accounting"
44 depends on NF_CONNTRACK
46 If this option is enabled, the connection tracking code will
47 keep per-flow packet and byte counters.
49 Those counters can be used for flow-based accounting or the
54 config NF_CONNTRACK_MARK
55 bool 'Connection mark tracking support'
56 depends on NF_CONNTRACK
58 This option enables support for connection marks, used by the
59 `CONNMARK' target and `connmark' match. Similar to the mark value
60 of packets, but this mark value is kept in the conntrack session
61 instead of the individual packets.
63 config NF_CONNTRACK_SECMARK
64 bool 'Connection tracking security mark support'
65 depends on NF_CONNTRACK && NETWORK_SECMARK
67 This option enables security markings to be applied to
68 connections. Typically they are copied to connections from
69 packets using the CONNSECMARK target and copied back from
70 connections to packets with the same target, with the packets
71 being originally labeled via SECMARK.
75 config NF_CONNTRACK_EVENTS
76 bool "Connection tracking events (EXPERIMENTAL)"
77 depends on EXPERIMENTAL && NF_CONNTRACK
79 If this option is enabled, the connection tracking code will
80 provide a notifier chain that can be used by other kernel code
81 to get notified about changes in the connection tracking state.
85 config NF_CT_PROTO_SCTP
86 tristate 'SCTP protocol on new connection tracking support (EXPERIMENTAL)'
87 depends on EXPERIMENTAL && NF_CONNTRACK
90 With this option enabled, the layer 3 independent connection
91 tracking code will be able to do state tracking on SCTP connections.
93 If you want to compile it as a module, say M here and read
94 Documentation/modules.txt. If unsure, say `N'.
96 config NF_CONNTRACK_FTP
97 tristate "FTP support on new connection tracking (EXPERIMENTAL)"
98 depends on EXPERIMENTAL && NF_CONNTRACK
100 Tracking FTP connections is problematic: special helpers are
101 required for tracking them, and doing masquerading and other forms
102 of Network Address Translation on them.
104 This is FTP support on Layer 3 independent connection tracking.
105 Layer 3 independent connection tracking is experimental scheme
106 which generalize ip_conntrack to support other layer 3 protocols.
108 To compile it as a module, choose M here. If unsure, say N.
111 tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
112 depends on EXPERIMENTAL && NF_CONNTRACK && NETFILTER_NETLINK
113 depends on NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
115 This option enables support for a netlink-based userspace interface
117 config NETFILTER_XTABLES
118 tristate "Netfilter Xtables support (required for ip_tables)"
120 This is required if you intend to use any of ip_tables,
121 ip6_tables or arp_tables.
123 # alphabetically ordered list of targets
125 config NETFILTER_XT_TARGET_CLASSIFY
126 tristate '"CLASSIFY" target support'
127 depends on NETFILTER_XTABLES
129 This option adds a `CLASSIFY' target, which enables the user to set
130 the priority of a packet. Some qdiscs can use this value for
131 classification, among these are:
133 atm, cbq, dsmark, pfifo_fast, htb, prio
135 To compile it as a module, choose M here. If unsure, say N.
137 config NETFILTER_XT_TARGET_CONNMARK
138 tristate '"CONNMARK" target support'
139 depends on NETFILTER_XTABLES
140 depends on IP_NF_MANGLE || IP6_NF_MANGLE
141 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
143 This option adds a `CONNMARK' target, which allows one to manipulate
144 the connection mark value. Similar to the MARK target, but
145 affects the connection mark value rather than the packet mark value.
147 If you want to compile it as a module, say M here and read
148 <file:Documentation/modules.txt>. The module will be called
149 ipt_CONNMARK.o. If unsure, say `N'.
151 config NETFILTER_XT_TARGET_MARK
152 tristate '"MARK" target support'
153 depends on NETFILTER_XTABLES
155 This option adds a `MARK' target, which allows you to create rules
156 in the `mangle' table which alter the netfilter mark (nfmark) field
157 associated with the packet prior to routing. This can change
158 the routing method (see `Use netfilter MARK value as routing
159 key') and can also be used by other subsystems to change their
162 To compile it as a module, choose M here. If unsure, say N.
164 config NETFILTER_XT_TARGET_NFQUEUE
165 tristate '"NFQUEUE" target Support'
166 depends on NETFILTER_XTABLES
168 This target replaced the old obsolete QUEUE target.
170 As opposed to QUEUE, it supports 65535 different queues,
173 To compile it as a module, choose M here. If unsure, say N.
175 config NETFILTER_XT_TARGET_NOTRACK
176 tristate '"NOTRACK" target support'
177 depends on NETFILTER_XTABLES
178 depends on IP_NF_RAW || IP6_NF_RAW
179 depends on IP_NF_CONNTRACK || NF_CONNTRACK
181 The NOTRACK target allows a select rule to specify
182 which packets *not* to enter the conntrack/NAT
183 subsystem with all the consequences (no ICMP error tracking,
184 no protocol helpers for the selected packets).
186 If you want to compile it as a module, say M here and read
187 <file:Documentation/modules.txt>. If unsure, say `N'.
189 config NETFILTER_XT_TARGET_SECMARK
190 tristate '"SECMARK" target support'
191 depends on NETFILTER_XTABLES && NETWORK_SECMARK
193 The SECMARK target allows security marking of network
194 packets, for use with security subsystems.
196 To compile it as a module, choose M here. If unsure, say N.
198 config NETFILTER_XT_MATCH_COMMENT
199 tristate '"comment" match support'
200 depends on NETFILTER_XTABLES
202 This option adds a `comment' dummy-match, which allows you to put
203 comments in your iptables ruleset.
205 If you want to compile it as a module, say M here and read
206 <file:Documentation/modules.txt>. If unsure, say `N'.
208 config NETFILTER_XT_MATCH_CONNBYTES
209 tristate '"connbytes" per-connection counter match support'
210 depends on NETFILTER_XTABLES
211 depends on (IP_NF_CONNTRACK && IP_NF_CT_ACCT) || (NF_CT_ACCT && NF_CONNTRACK)
213 This option adds a `connbytes' match, which allows you to match the
214 number of bytes and/or packets for each direction within a connection.
216 If you want to compile it as a module, say M here and read
217 <file:Documentation/modules.txt>. If unsure, say `N'.
219 config NETFILTER_XT_MATCH_CONNMARK
220 tristate '"connmark" connection mark match support'
221 depends on NETFILTER_XTABLES
222 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
224 This option adds a `connmark' match, which allows you to match the
225 connection mark value previously set for the session by `CONNMARK'.
227 If you want to compile it as a module, say M here and read
228 <file:Documentation/modules.txt>. The module will be called
229 ipt_connmark.o. If unsure, say `N'.
231 config NETFILTER_XT_MATCH_CONNTRACK
232 tristate '"conntrack" connection tracking match support'
233 depends on NETFILTER_XTABLES
234 depends on IP_NF_CONNTRACK || NF_CONNTRACK
236 This is a general conntrack match module, a superset of the state match.
238 It allows matching on additional conntrack information, which is
239 useful in complex configurations, such as NAT gateways with multiple
240 internet links or tunnels.
242 To compile it as a module, choose M here. If unsure, say N.
244 config NETFILTER_XT_MATCH_DCCP
245 tristate '"DCCP" protocol match support'
246 depends on NETFILTER_XTABLES
248 With this option enabled, you will be able to use the iptables
249 `dccp' match in order to match on DCCP source/destination ports
252 If you want to compile it as a module, say M here and read
253 <file:Documentation/modules.txt>. If unsure, say `N'.
255 config NETFILTER_XT_MATCH_ESP
256 tristate '"ESP" match support'
257 depends on NETFILTER_XTABLES
259 This match extension allows you to match a range of SPIs
260 inside ESP header of IPSec packets.
262 To compile it as a module, choose M here. If unsure, say N.
264 config NETFILTER_XT_MATCH_HELPER
265 tristate '"helper" match support'
266 depends on NETFILTER_XTABLES
267 depends on IP_NF_CONNTRACK || NF_CONNTRACK
269 Helper matching allows you to match packets in dynamic connections
270 tracked by a conntrack-helper, ie. ip_conntrack_ftp
272 To compile it as a module, choose M here. If unsure, say Y.
274 config NETFILTER_XT_MATCH_LENGTH
275 tristate '"length" match support'
276 depends on NETFILTER_XTABLES
278 This option allows you to match the length of a packet against a
279 specific value or range of values.
281 To compile it as a module, choose M here. If unsure, say N.
283 config NETFILTER_XT_MATCH_LIMIT
284 tristate '"limit" match support'
285 depends on NETFILTER_XTABLES
287 limit matching allows you to control the rate at which a rule can be
288 matched: mainly useful in combination with the LOG target ("LOG
289 target support", below) and to avoid some Denial of Service attacks.
291 To compile it as a module, choose M here. If unsure, say N.
293 config NETFILTER_XT_MATCH_MAC
294 tristate '"mac" address match support'
295 depends on NETFILTER_XTABLES
297 MAC matching allows you to match packets based on the source
298 Ethernet address of the packet.
300 To compile it as a module, choose M here. If unsure, say N.
302 config NETFILTER_XT_MATCH_MARK
303 tristate '"mark" match support'
304 depends on NETFILTER_XTABLES
306 Netfilter mark matching allows you to match packets based on the
307 `nfmark' value in the packet. This can be set by the MARK target
310 To compile it as a module, choose M here. If unsure, say N.
312 config NETFILTER_XT_MATCH_POLICY
313 tristate 'IPsec "policy" match support'
314 depends on NETFILTER_XTABLES && XFRM
316 Policy matching allows you to match packets based on the
317 IPsec policy that was used during decapsulation/will
318 be used during encapsulation.
320 To compile it as a module, choose M here. If unsure, say N.
322 config NETFILTER_XT_MATCH_MULTIPORT
323 tristate "Multiple port match support"
324 depends on NETFILTER_XTABLES
326 Multiport matching allows you to match TCP or UDP packets based on
327 a series of source or destination ports: normally a rule can only
328 match a single range of ports.
330 To compile it as a module, choose M here. If unsure, say N.
332 config NETFILTER_XT_MATCH_PHYSDEV
333 tristate '"physdev" match support'
334 depends on NETFILTER_XTABLES && BRIDGE_NETFILTER
336 Physdev packet matching matches against the physical bridge ports
337 the IP packet arrived on or will leave by.
339 To compile it as a module, choose M here. If unsure, say N.
341 config NETFILTER_XT_MATCH_PKTTYPE
342 tristate '"pkttype" packet type match support'
343 depends on NETFILTER_XTABLES
345 Packet type matching allows you to match a packet by
346 its "class", eg. BROADCAST, MULTICAST, ...
349 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
351 To compile it as a module, choose M here. If unsure, say N.
353 config NETFILTER_XT_MATCH_QUOTA
354 tristate '"quota" match support'
355 depends on NETFILTER_XTABLES
357 This option adds a `quota' match, which allows to match on a
360 If you want to compile it as a module, say M here and read
361 <file:Documentation/modules.txt>. If unsure, say `N'.
363 config NETFILTER_XT_MATCH_REALM
364 tristate '"realm" match support'
365 depends on NETFILTER_XTABLES
368 This option adds a `realm' match, which allows you to use the realm
369 key from the routing subsystem inside iptables.
371 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
374 If you want to compile it as a module, say M here and read
375 <file:Documentation/modules.txt>. If unsure, say `N'.
377 config NETFILTER_XT_MATCH_SCTP
378 tristate '"sctp" protocol match support'
379 depends on NETFILTER_XTABLES
381 With this option enabled, you will be able to use the
382 `sctp' match in order to match on SCTP source/destination ports
383 and SCTP chunk types.
385 If you want to compile it as a module, say M here and read
386 <file:Documentation/modules.txt>. If unsure, say `N'.
388 config NETFILTER_XT_MATCH_STATE
389 tristate '"state" match support'
390 depends on NETFILTER_XTABLES
391 depends on IP_NF_CONNTRACK || NF_CONNTRACK
393 Connection state matching allows you to match packets based on their
394 relationship to a tracked connection (ie. previous packets). This
395 is a powerful tool for packet classification.
397 To compile it as a module, choose M here. If unsure, say N.
399 config NETFILTER_XT_MATCH_STATISTIC
400 tristate '"statistic" match support'
401 depends on NETFILTER_XTABLES
405 config NETFILTER_XT_MATCH_STRING
406 tristate '"string" match support'
407 depends on NETFILTER_XTABLES
409 select TEXTSEARCH_KMP
411 select TEXTSEARCH_FSM
413 This option adds a `string' match, which allows you to look for
414 pattern matchings in packets.
416 To compile it as a module, choose M here. If unsure, say N.
418 config NETFILTER_XT_MATCH_TCPMSS
419 tristate '"tcpmss" match support'
420 depends on NETFILTER_XTABLES
422 This option adds a `tcpmss' match, which allows you to examine the
423 MSS value of TCP SYN packets, which control the maximum packet size
426 To compile it as a module, choose M here. If unsure, say N.