1 menu "Core Netfilter Configuration"
2 depends on NET && INET && NETFILTER
4 config NETFILTER_NETLINK
5 tristate "Netfilter netlink interface"
7 If this option is enabled, the kernel will include support
8 for the new netfilter netlink interface.
10 config NETFILTER_NETLINK_QUEUE
11 tristate "Netfilter NFQUEUE over NFNETLINK interface"
12 depends on NETFILTER_NETLINK
14 If this option is enabled, the kernel will include support
15 for queueing packets via NFNETLINK.
17 config NETFILTER_NETLINK_LOG
18 tristate "Netfilter LOG over NFNETLINK interface"
19 depends on NETFILTER_NETLINK
21 If this option is enabled, the kernel will include support
22 for logging packets via NFNETLINK.
24 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
25 and is also scheduled to replace the old syslog-based ipt_LOG
28 config NF_CONNTRACK_ENABLED
29 tristate "Netfilter connection tracking support"
31 Connection tracking keeps a record of what packets have passed
32 through your machine, in order to figure out how they are related
35 This is required to do Masquerading or other kinds of Network
36 Address Translation (except for Fast NAT). It can also be used to
37 enhance packet filtering (see `Connection state match support'
40 To compile it as a module, choose M here. If unsure, say N.
43 prompt "Netfilter connection tracking support"
44 depends on NF_CONNTRACK_ENABLED
46 config NF_CONNTRACK_SUPPORT
47 bool "Layer 3 Independent Connection tracking"
49 Layer 3 independent connection tracking is experimental scheme
50 which generalize ip_conntrack to support other layer 3 protocols.
52 This is required to do Masquerading or other kinds of Network
53 Address Translation (except for Fast NAT). It can also be used to
54 enhance packet filtering (see `Connection state match support'
57 config IP_NF_CONNTRACK_SUPPORT
58 bool "Layer 3 Dependent Connection tracking (OBSOLETE)"
60 The old, Layer 3 dependent ip_conntrack subsystem of netfilter.
62 This is required to do Masquerading or other kinds of Network
63 Address Translation (except for Fast NAT). It can also be used to
64 enhance packet filtering (see `Connection state match support'
71 default m if NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=m
72 default y if NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=y
74 config IP_NF_CONNTRACK
76 default m if IP_NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=m
77 default y if IP_NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=y
80 bool "Connection tracking flow accounting"
81 depends on NF_CONNTRACK
83 If this option is enabled, the connection tracking code will
84 keep per-flow packet and byte counters.
86 Those counters can be used for flow-based accounting or the
91 config NF_CONNTRACK_MARK
92 bool 'Connection mark tracking support'
93 depends on NF_CONNTRACK
95 This option enables support for connection marks, used by the
96 `CONNMARK' target and `connmark' match. Similar to the mark value
97 of packets, but this mark value is kept in the conntrack session
98 instead of the individual packets.
100 config NF_CONNTRACK_SECMARK
101 bool 'Connection tracking security mark support'
102 depends on NF_CONNTRACK && NETWORK_SECMARK
104 This option enables security markings to be applied to
105 connections. Typically they are copied to connections from
106 packets using the CONNSECMARK target and copied back from
107 connections to packets with the same target, with the packets
108 being originally labeled via SECMARK.
112 config NF_CONNTRACK_EVENTS
113 bool "Connection tracking events (EXPERIMENTAL)"
114 depends on EXPERIMENTAL && NF_CONNTRACK
116 If this option is enabled, the connection tracking code will
117 provide a notifier chain that can be used by other kernel code
118 to get notified about changes in the connection tracking state.
122 config NF_CT_PROTO_GRE
124 depends on NF_CONNTRACK
126 config NF_CT_PROTO_SCTP
127 tristate 'SCTP protocol connection tracking support (EXPERIMENTAL)'
128 depends on EXPERIMENTAL && NF_CONNTRACK
131 With this option enabled, the layer 3 independent connection
132 tracking code will be able to do state tracking on SCTP connections.
134 If you want to compile it as a module, say M here and read
135 Documentation/modules.txt. If unsure, say `N'.
137 config NF_CONNTRACK_AMANDA
138 tristate "Amanda backup protocol support"
139 depends on NF_CONNTRACK
141 select TEXTSEARCH_KMP
143 If you are running the Amanda backup package <http://www.amanda.org/>
144 on this machine or machines that will be MASQUERADED through this
145 machine, then you may want to enable this feature. This allows the
146 connection tracking and natting code to allow the sub-channels that
147 Amanda requires for communication of the backup data, messages and
150 To compile it as a module, choose M here. If unsure, say N.
152 config NF_CONNTRACK_FTP
153 tristate "FTP protocol support"
154 depends on NF_CONNTRACK
156 Tracking FTP connections is problematic: special helpers are
157 required for tracking them, and doing masquerading and other forms
158 of Network Address Translation on them.
160 This is FTP support on Layer 3 independent connection tracking.
161 Layer 3 independent connection tracking is experimental scheme
162 which generalize ip_conntrack to support other layer 3 protocols.
164 To compile it as a module, choose M here. If unsure, say N.
166 config NF_CONNTRACK_H323
167 tristate "H.323 protocol support (EXPERIMENTAL)"
168 depends on EXPERIMENTAL && NF_CONNTRACK && (IPV6 || IPV6=n)
170 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
171 important VoIP protocols, it is widely used by voice hardware and
172 software including voice gateways, IP phones, Netmeeting, OpenPhone,
175 With this module you can support H.323 on a connection tracking/NAT
178 This module supports RAS, Fast Start, H.245 Tunnelling, Call
179 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
180 whiteboard, file transfer, etc. For more information, please
181 visit http://nath323.sourceforge.net/.
183 To compile it as a module, choose M here. If unsure, say N.
185 config NF_CONNTRACK_IRC
186 tristate "IRC protocol support"
187 depends on NF_CONNTRACK
189 There is a commonly-used extension to IRC called
190 Direct Client-to-Client Protocol (DCC). This enables users to send
191 files to each other, and also chat to each other without the need
192 of a server. DCC Sending is used anywhere you send files over IRC,
193 and DCC Chat is most commonly used by Eggdrop bots. If you are
194 using NAT, this extension will enable you to send files and initiate
195 chats. Note that you do NOT need this extension to get files or
196 have others initiate chats, or everything else in IRC.
198 To compile it as a module, choose M here. If unsure, say N.
200 config NF_CONNTRACK_NETBIOS_NS
201 tristate "NetBIOS name service protocol support (EXPERIMENTAL)"
202 depends on EXPERIMENTAL && NF_CONNTRACK
204 NetBIOS name service requests are sent as broadcast messages from an
205 unprivileged port and responded to with unicast messages to the
206 same port. This make them hard to firewall properly because connection
207 tracking doesn't deal with broadcasts. This helper tracks locally
208 originating NetBIOS name service requests and the corresponding
209 responses. It relies on correct IP address configuration, specifically
210 netmask and broadcast address. When properly configured, the output
211 of "ip address show" should look similar to this:
213 $ ip -4 address show eth0
214 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
215 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
217 To compile it as a module, choose M here. If unsure, say N.
219 config NF_CONNTRACK_PPTP
220 tristate "PPtP protocol support"
221 depends on NF_CONNTRACK
222 select NF_CT_PROTO_GRE
224 This module adds support for PPTP (Point to Point Tunnelling
225 Protocol, RFC2637) connection tracking and NAT.
227 If you are running PPTP sessions over a stateful firewall or NAT
228 box, you may want to enable this feature.
230 Please note that not all PPTP modes of operation are supported yet.
231 Specifically these limitations exist:
232 - Blindy assumes that control connections are always established
233 in PNS->PAC direction. This is a violation of RFC2637.
234 - Only supports a single call within each session
236 To compile it as a module, choose M here. If unsure, say N.
238 config NF_CONNTRACK_SANE
239 tristate "SANE protocol support (EXPERIMENTAL)"
240 depends on EXPERIMENTAL && NF_CONNTRACK
242 SANE is a protocol for remote access to scanners as implemented
243 by the 'saned' daemon. Like FTP, it uses separate control and
246 With this module you can support SANE on a connection tracking
249 To compile it as a module, choose M here. If unsure, say N.
251 config NF_CONNTRACK_SIP
252 tristate "SIP protocol support (EXPERIMENTAL)"
253 depends on EXPERIMENTAL && NF_CONNTRACK
255 SIP is an application-layer control protocol that can establish,
256 modify, and terminate multimedia sessions (conferences) such as
257 Internet telephony calls. With the ip_conntrack_sip and
258 the nf_nat_sip modules you can support the protocol on a connection
259 tracking/NATing firewall.
261 To compile it as a module, choose M here. If unsure, say N.
263 config NF_CONNTRACK_TFTP
264 tristate "TFTP protocol support"
265 depends on NF_CONNTRACK
267 TFTP connection tracking helper, this is required depending
268 on how restrictive your ruleset is.
269 If you are using a tftp client behind -j SNAT or -j MASQUERADING
272 To compile it as a module, choose M here. If unsure, say N.
275 tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
276 depends on EXPERIMENTAL && NF_CONNTRACK && NETFILTER_NETLINK
277 depends on NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
279 This option enables support for a netlink-based userspace interface
281 config NETFILTER_XTABLES
282 tristate "Netfilter Xtables support (required for ip_tables)"
284 This is required if you intend to use any of ip_tables,
285 ip6_tables or arp_tables.
287 # alphabetically ordered list of targets
289 config NETFILTER_XT_TARGET_CLASSIFY
290 tristate '"CLASSIFY" target support'
291 depends on NETFILTER_XTABLES
293 This option adds a `CLASSIFY' target, which enables the user to set
294 the priority of a packet. Some qdiscs can use this value for
295 classification, among these are:
297 atm, cbq, dsmark, pfifo_fast, htb, prio
299 To compile it as a module, choose M here. If unsure, say N.
301 config NETFILTER_XT_TARGET_CONNMARK
302 tristate '"CONNMARK" target support'
303 depends on NETFILTER_XTABLES
304 depends on IP_NF_MANGLE || IP6_NF_MANGLE
305 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
307 This option adds a `CONNMARK' target, which allows one to manipulate
308 the connection mark value. Similar to the MARK target, but
309 affects the connection mark value rather than the packet mark value.
311 If you want to compile it as a module, say M here and read
312 <file:Documentation/modules.txt>. The module will be called
313 ipt_CONNMARK.o. If unsure, say `N'.
315 config NETFILTER_XT_TARGET_DSCP
316 tristate '"DSCP" target support'
317 depends on NETFILTER_XTABLES
318 depends on IP_NF_MANGLE || IP6_NF_MANGLE
320 This option adds a `DSCP' target, which allows you to manipulate
321 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
323 The DSCP field can have any value between 0x0 and 0x3f inclusive.
325 To compile it as a module, choose M here. If unsure, say N.
327 config NETFILTER_XT_TARGET_MARK
328 tristate '"MARK" target support'
329 depends on NETFILTER_XTABLES
331 This option adds a `MARK' target, which allows you to create rules
332 in the `mangle' table which alter the netfilter mark (nfmark) field
333 associated with the packet prior to routing. This can change
334 the routing method (see `Use netfilter MARK value as routing
335 key') and can also be used by other subsystems to change their
338 To compile it as a module, choose M here. If unsure, say N.
340 config NETFILTER_XT_TARGET_NFQUEUE
341 tristate '"NFQUEUE" target Support'
342 depends on NETFILTER_XTABLES
344 This target replaced the old obsolete QUEUE target.
346 As opposed to QUEUE, it supports 65535 different queues,
349 To compile it as a module, choose M here. If unsure, say N.
351 config NETFILTER_XT_TARGET_NFLOG
352 tristate '"NFLOG" target support'
353 depends on NETFILTER_XTABLES
355 This option enables the NFLOG target, which allows to LOG
356 messages through the netfilter logging API, which can use
357 either the old LOG target, the old ULOG target or nfnetlink_log
360 To compile it as a module, choose M here. If unsure, say N.
362 config NETFILTER_XT_TARGET_NOTRACK
363 tristate '"NOTRACK" target support'
364 depends on NETFILTER_XTABLES
365 depends on IP_NF_RAW || IP6_NF_RAW
366 depends on IP_NF_CONNTRACK || NF_CONNTRACK
368 The NOTRACK target allows a select rule to specify
369 which packets *not* to enter the conntrack/NAT
370 subsystem with all the consequences (no ICMP error tracking,
371 no protocol helpers for the selected packets).
373 If you want to compile it as a module, say M here and read
374 <file:Documentation/modules.txt>. If unsure, say `N'.
376 config NETFILTER_XT_TARGET_SECMARK
377 tristate '"SECMARK" target support'
378 depends on NETFILTER_XTABLES && NETWORK_SECMARK
380 The SECMARK target allows security marking of network
381 packets, for use with security subsystems.
383 To compile it as a module, choose M here. If unsure, say N.
385 config NETFILTER_XT_TARGET_CONNSECMARK
386 tristate '"CONNSECMARK" target support'
387 depends on NETFILTER_XTABLES && \
388 ((NF_CONNTRACK && NF_CONNTRACK_SECMARK) || \
389 (IP_NF_CONNTRACK && IP_NF_CONNTRACK_SECMARK))
391 The CONNSECMARK target copies security markings from packets
392 to connections, and restores security markings from connections
393 to packets (if the packets are not already marked). This would
394 normally be used in conjunction with the SECMARK target.
396 To compile it as a module, choose M here. If unsure, say N.
398 config NETFILTER_XT_MATCH_COMMENT
399 tristate '"comment" match support'
400 depends on NETFILTER_XTABLES
402 This option adds a `comment' dummy-match, which allows you to put
403 comments in your iptables ruleset.
405 If you want to compile it as a module, say M here and read
406 <file:Documentation/modules.txt>. If unsure, say `N'.
408 config NETFILTER_XT_MATCH_CONNBYTES
409 tristate '"connbytes" per-connection counter match support'
410 depends on NETFILTER_XTABLES
411 depends on (IP_NF_CONNTRACK && IP_NF_CT_ACCT) || (NF_CT_ACCT && NF_CONNTRACK)
413 This option adds a `connbytes' match, which allows you to match the
414 number of bytes and/or packets for each direction within a connection.
416 If you want to compile it as a module, say M here and read
417 <file:Documentation/modules.txt>. If unsure, say `N'.
419 config NETFILTER_XT_MATCH_CONNMARK
420 tristate '"connmark" connection mark match support'
421 depends on NETFILTER_XTABLES
422 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
424 This option adds a `connmark' match, which allows you to match the
425 connection mark value previously set for the session by `CONNMARK'.
427 If you want to compile it as a module, say M here and read
428 <file:Documentation/modules.txt>. The module will be called
429 ipt_connmark.o. If unsure, say `N'.
431 config NETFILTER_XT_MATCH_CONNTRACK
432 tristate '"conntrack" connection tracking match support'
433 depends on NETFILTER_XTABLES
434 depends on IP_NF_CONNTRACK || NF_CONNTRACK
436 This is a general conntrack match module, a superset of the state match.
438 It allows matching on additional conntrack information, which is
439 useful in complex configurations, such as NAT gateways with multiple
440 internet links or tunnels.
442 To compile it as a module, choose M here. If unsure, say N.
444 config NETFILTER_XT_MATCH_DCCP
445 tristate '"DCCP" protocol match support'
446 depends on NETFILTER_XTABLES
448 With this option enabled, you will be able to use the iptables
449 `dccp' match in order to match on DCCP source/destination ports
452 If you want to compile it as a module, say M here and read
453 <file:Documentation/modules.txt>. If unsure, say `N'.
455 config NETFILTER_XT_MATCH_DSCP
456 tristate '"DSCP" match support'
457 depends on NETFILTER_XTABLES
459 This option adds a `DSCP' match, which allows you to match against
460 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
462 The DSCP field can have any value between 0x0 and 0x3f inclusive.
464 To compile it as a module, choose M here. If unsure, say N.
466 config NETFILTER_XT_MATCH_ESP
467 tristate '"ESP" match support'
468 depends on NETFILTER_XTABLES
470 This match extension allows you to match a range of SPIs
471 inside ESP header of IPSec packets.
473 To compile it as a module, choose M here. If unsure, say N.
475 config NETFILTER_XT_MATCH_HELPER
476 tristate '"helper" match support'
477 depends on NETFILTER_XTABLES
478 depends on IP_NF_CONNTRACK || NF_CONNTRACK
480 Helper matching allows you to match packets in dynamic connections
481 tracked by a conntrack-helper, ie. ip_conntrack_ftp
483 To compile it as a module, choose M here. If unsure, say Y.
485 config NETFILTER_XT_MATCH_LENGTH
486 tristate '"length" match support'
487 depends on NETFILTER_XTABLES
489 This option allows you to match the length of a packet against a
490 specific value or range of values.
492 To compile it as a module, choose M here. If unsure, say N.
494 config NETFILTER_XT_MATCH_LIMIT
495 tristate '"limit" match support'
496 depends on NETFILTER_XTABLES
498 limit matching allows you to control the rate at which a rule can be
499 matched: mainly useful in combination with the LOG target ("LOG
500 target support", below) and to avoid some Denial of Service attacks.
502 To compile it as a module, choose M here. If unsure, say N.
504 config NETFILTER_XT_MATCH_MAC
505 tristate '"mac" address match support'
506 depends on NETFILTER_XTABLES
508 MAC matching allows you to match packets based on the source
509 Ethernet address of the packet.
511 To compile it as a module, choose M here. If unsure, say N.
513 config NETFILTER_XT_MATCH_MARK
514 tristate '"mark" match support'
515 depends on NETFILTER_XTABLES
517 Netfilter mark matching allows you to match packets based on the
518 `nfmark' value in the packet. This can be set by the MARK target
521 To compile it as a module, choose M here. If unsure, say N.
523 config NETFILTER_XT_MATCH_POLICY
524 tristate 'IPsec "policy" match support'
525 depends on NETFILTER_XTABLES && XFRM
527 Policy matching allows you to match packets based on the
528 IPsec policy that was used during decapsulation/will
529 be used during encapsulation.
531 To compile it as a module, choose M here. If unsure, say N.
533 config NETFILTER_XT_MATCH_MULTIPORT
534 tristate "Multiple port match support"
535 depends on NETFILTER_XTABLES
537 Multiport matching allows you to match TCP or UDP packets based on
538 a series of source or destination ports: normally a rule can only
539 match a single range of ports.
541 To compile it as a module, choose M here. If unsure, say N.
543 config NETFILTER_XT_MATCH_PHYSDEV
544 tristate '"physdev" match support'
545 depends on NETFILTER_XTABLES && BRIDGE && BRIDGE_NETFILTER
547 Physdev packet matching matches against the physical bridge ports
548 the IP packet arrived on or will leave by.
550 To compile it as a module, choose M here. If unsure, say N.
552 config NETFILTER_XT_MATCH_PKTTYPE
553 tristate '"pkttype" packet type match support'
554 depends on NETFILTER_XTABLES
556 Packet type matching allows you to match a packet by
557 its "class", eg. BROADCAST, MULTICAST, ...
560 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
562 To compile it as a module, choose M here. If unsure, say N.
564 config NETFILTER_XT_MATCH_QUOTA
565 tristate '"quota" match support'
566 depends on NETFILTER_XTABLES
568 This option adds a `quota' match, which allows to match on a
571 If you want to compile it as a module, say M here and read
572 <file:Documentation/modules.txt>. If unsure, say `N'.
574 config NETFILTER_XT_MATCH_REALM
575 tristate '"realm" match support'
576 depends on NETFILTER_XTABLES
579 This option adds a `realm' match, which allows you to use the realm
580 key from the routing subsystem inside iptables.
582 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
585 If you want to compile it as a module, say M here and read
586 <file:Documentation/modules.txt>. If unsure, say `N'.
588 config NETFILTER_XT_MATCH_SCTP
589 tristate '"sctp" protocol match support (EXPERIMENTAL)'
590 depends on NETFILTER_XTABLES && EXPERIMENTAL
592 With this option enabled, you will be able to use the
593 `sctp' match in order to match on SCTP source/destination ports
594 and SCTP chunk types.
596 If you want to compile it as a module, say M here and read
597 <file:Documentation/modules.txt>. If unsure, say `N'.
599 config NETFILTER_XT_MATCH_STATE
600 tristate '"state" match support'
601 depends on NETFILTER_XTABLES
602 depends on IP_NF_CONNTRACK || NF_CONNTRACK
604 Connection state matching allows you to match packets based on their
605 relationship to a tracked connection (ie. previous packets). This
606 is a powerful tool for packet classification.
608 To compile it as a module, choose M here. If unsure, say N.
610 config NETFILTER_XT_MATCH_STATISTIC
611 tristate '"statistic" match support'
612 depends on NETFILTER_XTABLES
614 This option adds a `statistic' match, which allows you to match
615 on packets periodically or randomly with a given percentage.
617 To compile it as a module, choose M here. If unsure, say N.
619 config NETFILTER_XT_MATCH_STRING
620 tristate '"string" match support'
621 depends on NETFILTER_XTABLES
623 select TEXTSEARCH_KMP
625 select TEXTSEARCH_FSM
627 This option adds a `string' match, which allows you to look for
628 pattern matchings in packets.
630 To compile it as a module, choose M here. If unsure, say N.
632 config NETFILTER_XT_MATCH_TCPMSS
633 tristate '"tcpmss" match support'
634 depends on NETFILTER_XTABLES
636 This option adds a `tcpmss' match, which allows you to examine the
637 MSS value of TCP SYN packets, which control the maximum packet size
640 To compile it as a module, choose M here. If unsure, say N.
642 config NETFILTER_XT_MATCH_HASHLIMIT
643 tristate '"hashlimit" match support'
644 depends on NETFILTER_XTABLES && (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
646 This option adds a `hashlimit' match.
648 As opposed to `limit', this match dynamically creates a hash table
649 of limit buckets, based on your selection of source/destination
650 addresses and/or ports.
652 It enables you to express policies like `10kpps for any given
653 destination address' or `500pps from any given source address'