1 menu "Core Netfilter Configuration"
2 depends on NET && NETFILTER
4 config NETFILTER_NETLINK
5 tristate "Netfilter netlink interface"
7 If this option is enabled, the kernel will include support
8 for the new netfilter netlink interface.
10 config NETFILTER_NETLINK_QUEUE
11 tristate "Netfilter NFQUEUE over NFNETLINK interface"
12 depends on NETFILTER_NETLINK
14 If this option is enabled, the kernel will include support
15 for queueing packets via NFNETLINK.
17 config NETFILTER_NETLINK_LOG
18 tristate "Netfilter LOG over NFNETLINK interface"
19 depends on NETFILTER_NETLINK
21 If this option is enabled, the kernel will include support
22 for logging packets via NFNETLINK.
24 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
25 and is also scheduled to replace the old syslog-based ipt_LOG
28 config NF_CONNTRACK_ENABLED
29 tristate "Netfilter connection tracking support"
31 Connection tracking keeps a record of what packets have passed
32 through your machine, in order to figure out how they are related
35 This is required to do Masquerading or other kinds of Network
36 Address Translation (except for Fast NAT). It can also be used to
37 enhance packet filtering (see `Connection state match support'
40 To compile it as a module, choose M here. If unsure, say N.
43 prompt "Netfilter connection tracking support"
44 depends on NF_CONNTRACK_ENABLED
46 config NF_CONNTRACK_SUPPORT
47 bool "Layer 3 Independent Connection tracking (EXPERIMENTAL)"
48 depends on EXPERIMENTAL
50 Layer 3 independent connection tracking is experimental scheme
51 which generalize ip_conntrack to support other layer 3 protocols.
53 This is required to do Masquerading or other kinds of Network
54 Address Translation (except for Fast NAT). It can also be used to
55 enhance packet filtering (see `Connection state match support'
58 config IP_NF_CONNTRACK_SUPPORT
59 bool "Layer 3 Dependent Connection tracking"
61 The old, Layer 3 dependent ip_conntrack subsystem of netfilter.
63 This is required to do Masquerading or other kinds of Network
64 Address Translation (except for Fast NAT). It can also be used to
65 enhance packet filtering (see `Connection state match support'
72 default m if NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=m
73 default y if NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=y
75 config IP_NF_CONNTRACK
77 default m if IP_NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=m
78 default y if IP_NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=y
81 bool "Connection tracking flow accounting"
82 depends on NF_CONNTRACK
84 If this option is enabled, the connection tracking code will
85 keep per-flow packet and byte counters.
87 Those counters can be used for flow-based accounting or the
92 config NF_CONNTRACK_MARK
93 bool 'Connection mark tracking support'
94 depends on NF_CONNTRACK
96 This option enables support for connection marks, used by the
97 `CONNMARK' target and `connmark' match. Similar to the mark value
98 of packets, but this mark value is kept in the conntrack session
99 instead of the individual packets.
101 config NF_CONNTRACK_SECMARK
102 bool 'Connection tracking security mark support'
103 depends on NF_CONNTRACK && NETWORK_SECMARK
105 This option enables security markings to be applied to
106 connections. Typically they are copied to connections from
107 packets using the CONNSECMARK target and copied back from
108 connections to packets with the same target, with the packets
109 being originally labeled via SECMARK.
113 config NF_CONNTRACK_EVENTS
114 bool "Connection tracking events (EXPERIMENTAL)"
115 depends on EXPERIMENTAL && NF_CONNTRACK
117 If this option is enabled, the connection tracking code will
118 provide a notifier chain that can be used by other kernel code
119 to get notified about changes in the connection tracking state.
123 config NF_CT_PROTO_SCTP
124 tristate 'SCTP protocol on new connection tracking support (EXPERIMENTAL)'
125 depends on EXPERIMENTAL && NF_CONNTRACK
128 With this option enabled, the layer 3 independent connection
129 tracking code will be able to do state tracking on SCTP connections.
131 If you want to compile it as a module, say M here and read
132 Documentation/modules.txt. If unsure, say `N'.
134 config NF_CONNTRACK_AMANDA
135 tristate "Amanda backup protocol support (EXPERIMENTAL)"
136 depends on EXPERIMENTAL && NF_CONNTRACK
138 select TEXTSEARCH_KMP
140 If you are running the Amanda backup package <http://www.amanda.org/>
141 on this machine or machines that will be MASQUERADED through this
142 machine, then you may want to enable this feature. This allows the
143 connection tracking and natting code to allow the sub-channels that
144 Amanda requires for communication of the backup data, messages and
147 To compile it as a module, choose M here. If unsure, say N.
149 config NF_CONNTRACK_FTP
150 tristate "FTP support on new connection tracking (EXPERIMENTAL)"
151 depends on EXPERIMENTAL && NF_CONNTRACK
153 Tracking FTP connections is problematic: special helpers are
154 required for tracking them, and doing masquerading and other forms
155 of Network Address Translation on them.
157 This is FTP support on Layer 3 independent connection tracking.
158 Layer 3 independent connection tracking is experimental scheme
159 which generalize ip_conntrack to support other layer 3 protocols.
161 To compile it as a module, choose M here. If unsure, say N.
163 config NF_CONNTRACK_H323
164 tristate "H.323 protocol support (EXPERIMENTAL)"
165 depends on EXPERIMENTAL && NF_CONNTRACK
167 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
168 important VoIP protocols, it is widely used by voice hardware and
169 software including voice gateways, IP phones, Netmeeting, OpenPhone,
172 With this module you can support H.323 on a connection tracking/NAT
175 This module supports RAS, Fast Start, H.245 Tunnelling, Call
176 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
177 whiteboard, file transfer, etc. For more information, please
178 visit http://nath323.sourceforge.net/.
180 To compile it as a module, choose M here. If unsure, say N.
183 tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
184 depends on EXPERIMENTAL && NF_CONNTRACK && NETFILTER_NETLINK
185 depends on NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
187 This option enables support for a netlink-based userspace interface
189 config NETFILTER_XTABLES
190 tristate "Netfilter Xtables support (required for ip_tables)"
192 This is required if you intend to use any of ip_tables,
193 ip6_tables or arp_tables.
195 # alphabetically ordered list of targets
197 config NETFILTER_XT_TARGET_CLASSIFY
198 tristate '"CLASSIFY" target support'
199 depends on NETFILTER_XTABLES
201 This option adds a `CLASSIFY' target, which enables the user to set
202 the priority of a packet. Some qdiscs can use this value for
203 classification, among these are:
205 atm, cbq, dsmark, pfifo_fast, htb, prio
207 To compile it as a module, choose M here. If unsure, say N.
209 config NETFILTER_XT_TARGET_CONNMARK
210 tristate '"CONNMARK" target support'
211 depends on NETFILTER_XTABLES
212 depends on IP_NF_MANGLE || IP6_NF_MANGLE
213 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
215 This option adds a `CONNMARK' target, which allows one to manipulate
216 the connection mark value. Similar to the MARK target, but
217 affects the connection mark value rather than the packet mark value.
219 If you want to compile it as a module, say M here and read
220 <file:Documentation/modules.txt>. The module will be called
221 ipt_CONNMARK.o. If unsure, say `N'.
223 config NETFILTER_XT_TARGET_DSCP
224 tristate '"DSCP" target support'
225 depends on NETFILTER_XTABLES
226 depends on IP_NF_MANGLE || IP6_NF_MANGLE
228 This option adds a `DSCP' target, which allows you to manipulate
229 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
231 The DSCP field can have any value between 0x0 and 0x3f inclusive.
233 To compile it as a module, choose M here. If unsure, say N.
235 config NETFILTER_XT_TARGET_MARK
236 tristate '"MARK" target support'
237 depends on NETFILTER_XTABLES
239 This option adds a `MARK' target, which allows you to create rules
240 in the `mangle' table which alter the netfilter mark (nfmark) field
241 associated with the packet prior to routing. This can change
242 the routing method (see `Use netfilter MARK value as routing
243 key') and can also be used by other subsystems to change their
246 To compile it as a module, choose M here. If unsure, say N.
248 config NETFILTER_XT_TARGET_NFQUEUE
249 tristate '"NFQUEUE" target Support'
250 depends on NETFILTER_XTABLES
252 This target replaced the old obsolete QUEUE target.
254 As opposed to QUEUE, it supports 65535 different queues,
257 To compile it as a module, choose M here. If unsure, say N.
259 config NETFILTER_XT_TARGET_NFLOG
260 tristate '"NFLOG" target support'
261 depends on NETFILTER_XTABLES
263 This option enables the NFLOG target, which allows to LOG
264 messages through the netfilter logging API, which can use
265 either the old LOG target, the old ULOG target or nfnetlink_log
268 To compile it as a module, choose M here. If unsure, say N.
270 config NETFILTER_XT_TARGET_NOTRACK
271 tristate '"NOTRACK" target support'
272 depends on NETFILTER_XTABLES
273 depends on IP_NF_RAW || IP6_NF_RAW
274 depends on IP_NF_CONNTRACK || NF_CONNTRACK
276 The NOTRACK target allows a select rule to specify
277 which packets *not* to enter the conntrack/NAT
278 subsystem with all the consequences (no ICMP error tracking,
279 no protocol helpers for the selected packets).
281 If you want to compile it as a module, say M here and read
282 <file:Documentation/modules.txt>. If unsure, say `N'.
284 config NETFILTER_XT_TARGET_SECMARK
285 tristate '"SECMARK" target support'
286 depends on NETFILTER_XTABLES && NETWORK_SECMARK
288 The SECMARK target allows security marking of network
289 packets, for use with security subsystems.
291 To compile it as a module, choose M here. If unsure, say N.
293 config NETFILTER_XT_TARGET_CONNSECMARK
294 tristate '"CONNSECMARK" target support'
295 depends on NETFILTER_XTABLES && \
296 ((NF_CONNTRACK && NF_CONNTRACK_SECMARK) || \
297 (IP_NF_CONNTRACK && IP_NF_CONNTRACK_SECMARK))
299 The CONNSECMARK target copies security markings from packets
300 to connections, and restores security markings from connections
301 to packets (if the packets are not already marked). This would
302 normally be used in conjunction with the SECMARK target.
304 To compile it as a module, choose M here. If unsure, say N.
306 config NETFILTER_XT_MATCH_COMMENT
307 tristate '"comment" match support'
308 depends on NETFILTER_XTABLES
310 This option adds a `comment' dummy-match, which allows you to put
311 comments in your iptables ruleset.
313 If you want to compile it as a module, say M here and read
314 <file:Documentation/modules.txt>. If unsure, say `N'.
316 config NETFILTER_XT_MATCH_CONNBYTES
317 tristate '"connbytes" per-connection counter match support'
318 depends on NETFILTER_XTABLES
319 depends on (IP_NF_CONNTRACK && IP_NF_CT_ACCT) || (NF_CT_ACCT && NF_CONNTRACK)
321 This option adds a `connbytes' match, which allows you to match the
322 number of bytes and/or packets for each direction within a connection.
324 If you want to compile it as a module, say M here and read
325 <file:Documentation/modules.txt>. If unsure, say `N'.
327 config NETFILTER_XT_MATCH_CONNMARK
328 tristate '"connmark" connection mark match support'
329 depends on NETFILTER_XTABLES
330 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
332 This option adds a `connmark' match, which allows you to match the
333 connection mark value previously set for the session by `CONNMARK'.
335 If you want to compile it as a module, say M here and read
336 <file:Documentation/modules.txt>. The module will be called
337 ipt_connmark.o. If unsure, say `N'.
339 config NETFILTER_XT_MATCH_CONNTRACK
340 tristate '"conntrack" connection tracking match support'
341 depends on NETFILTER_XTABLES
342 depends on IP_NF_CONNTRACK || NF_CONNTRACK
344 This is a general conntrack match module, a superset of the state match.
346 It allows matching on additional conntrack information, which is
347 useful in complex configurations, such as NAT gateways with multiple
348 internet links or tunnels.
350 To compile it as a module, choose M here. If unsure, say N.
352 config NETFILTER_XT_MATCH_DCCP
353 tristate '"DCCP" protocol match support'
354 depends on NETFILTER_XTABLES
356 With this option enabled, you will be able to use the iptables
357 `dccp' match in order to match on DCCP source/destination ports
360 If you want to compile it as a module, say M here and read
361 <file:Documentation/modules.txt>. If unsure, say `N'.
363 config NETFILTER_XT_MATCH_DSCP
364 tristate '"DSCP" match support'
365 depends on NETFILTER_XTABLES
367 This option adds a `DSCP' match, which allows you to match against
368 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
370 The DSCP field can have any value between 0x0 and 0x3f inclusive.
372 To compile it as a module, choose M here. If unsure, say N.
374 config NETFILTER_XT_MATCH_ESP
375 tristate '"ESP" match support'
376 depends on NETFILTER_XTABLES
378 This match extension allows you to match a range of SPIs
379 inside ESP header of IPSec packets.
381 To compile it as a module, choose M here. If unsure, say N.
383 config NETFILTER_XT_MATCH_HELPER
384 tristate '"helper" match support'
385 depends on NETFILTER_XTABLES
386 depends on IP_NF_CONNTRACK || NF_CONNTRACK
388 Helper matching allows you to match packets in dynamic connections
389 tracked by a conntrack-helper, ie. ip_conntrack_ftp
391 To compile it as a module, choose M here. If unsure, say Y.
393 config NETFILTER_XT_MATCH_LENGTH
394 tristate '"length" match support'
395 depends on NETFILTER_XTABLES
397 This option allows you to match the length of a packet against a
398 specific value or range of values.
400 To compile it as a module, choose M here. If unsure, say N.
402 config NETFILTER_XT_MATCH_LIMIT
403 tristate '"limit" match support'
404 depends on NETFILTER_XTABLES
406 limit matching allows you to control the rate at which a rule can be
407 matched: mainly useful in combination with the LOG target ("LOG
408 target support", below) and to avoid some Denial of Service attacks.
410 To compile it as a module, choose M here. If unsure, say N.
412 config NETFILTER_XT_MATCH_MAC
413 tristate '"mac" address match support'
414 depends on NETFILTER_XTABLES
416 MAC matching allows you to match packets based on the source
417 Ethernet address of the packet.
419 To compile it as a module, choose M here. If unsure, say N.
421 config NETFILTER_XT_MATCH_MARK
422 tristate '"mark" match support'
423 depends on NETFILTER_XTABLES
425 Netfilter mark matching allows you to match packets based on the
426 `nfmark' value in the packet. This can be set by the MARK target
429 To compile it as a module, choose M here. If unsure, say N.
431 config NETFILTER_XT_MATCH_POLICY
432 tristate 'IPsec "policy" match support'
433 depends on NETFILTER_XTABLES && XFRM
435 Policy matching allows you to match packets based on the
436 IPsec policy that was used during decapsulation/will
437 be used during encapsulation.
439 To compile it as a module, choose M here. If unsure, say N.
441 config NETFILTER_XT_MATCH_MULTIPORT
442 tristate "Multiple port match support"
443 depends on NETFILTER_XTABLES
445 Multiport matching allows you to match TCP or UDP packets based on
446 a series of source or destination ports: normally a rule can only
447 match a single range of ports.
449 To compile it as a module, choose M here. If unsure, say N.
451 config NETFILTER_XT_MATCH_PHYSDEV
452 tristate '"physdev" match support'
453 depends on NETFILTER_XTABLES && BRIDGE && BRIDGE_NETFILTER
455 Physdev packet matching matches against the physical bridge ports
456 the IP packet arrived on or will leave by.
458 To compile it as a module, choose M here. If unsure, say N.
460 config NETFILTER_XT_MATCH_PKTTYPE
461 tristate '"pkttype" packet type match support'
462 depends on NETFILTER_XTABLES
464 Packet type matching allows you to match a packet by
465 its "class", eg. BROADCAST, MULTICAST, ...
468 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
470 To compile it as a module, choose M here. If unsure, say N.
472 config NETFILTER_XT_MATCH_QUOTA
473 tristate '"quota" match support'
474 depends on NETFILTER_XTABLES
476 This option adds a `quota' match, which allows to match on a
479 If you want to compile it as a module, say M here and read
480 <file:Documentation/modules.txt>. If unsure, say `N'.
482 config NETFILTER_XT_MATCH_REALM
483 tristate '"realm" match support'
484 depends on NETFILTER_XTABLES
487 This option adds a `realm' match, which allows you to use the realm
488 key from the routing subsystem inside iptables.
490 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
493 If you want to compile it as a module, say M here and read
494 <file:Documentation/modules.txt>. If unsure, say `N'.
496 config NETFILTER_XT_MATCH_SCTP
497 tristate '"sctp" protocol match support (EXPERIMENTAL)'
498 depends on NETFILTER_XTABLES && EXPERIMENTAL
500 With this option enabled, you will be able to use the
501 `sctp' match in order to match on SCTP source/destination ports
502 and SCTP chunk types.
504 If you want to compile it as a module, say M here and read
505 <file:Documentation/modules.txt>. If unsure, say `N'.
507 config NETFILTER_XT_MATCH_STATE
508 tristate '"state" match support'
509 depends on NETFILTER_XTABLES
510 depends on IP_NF_CONNTRACK || NF_CONNTRACK
512 Connection state matching allows you to match packets based on their
513 relationship to a tracked connection (ie. previous packets). This
514 is a powerful tool for packet classification.
516 To compile it as a module, choose M here. If unsure, say N.
518 config NETFILTER_XT_MATCH_STATISTIC
519 tristate '"statistic" match support'
520 depends on NETFILTER_XTABLES
522 This option adds a `statistic' match, which allows you to match
523 on packets periodically or randomly with a given percentage.
525 To compile it as a module, choose M here. If unsure, say N.
527 config NETFILTER_XT_MATCH_STRING
528 tristate '"string" match support'
529 depends on NETFILTER_XTABLES
531 select TEXTSEARCH_KMP
533 select TEXTSEARCH_FSM
535 This option adds a `string' match, which allows you to look for
536 pattern matchings in packets.
538 To compile it as a module, choose M here. If unsure, say N.
540 config NETFILTER_XT_MATCH_TCPMSS
541 tristate '"tcpmss" match support'
542 depends on NETFILTER_XTABLES
544 This option adds a `tcpmss' match, which allows you to examine the
545 MSS value of TCP SYN packets, which control the maximum packet size
548 To compile it as a module, choose M here. If unsure, say N.
550 config NETFILTER_XT_MATCH_HASHLIMIT
551 tristate '"hashlimit" match support'
552 depends on NETFILTER_XTABLES
554 This option adds a `hashlimit' match.
556 As opposed to `limit', this match dynamically creates a hash table
557 of limit buckets, based on your selection of source/destination
558 addresses and/or ports.
560 It enables you to express policies like `10kpps for any given
561 destination address' or `500pps from any given source address'