1 menu "Core Netfilter Configuration"
2 depends on NET && INET && NETFILTER
4 config NETFILTER_INGRESS
5 bool "Netfilter ingress support"
9 This allows you to classify packets from ingress using the Netfilter
12 config NETFILTER_NETLINK
15 config NETFILTER_NETLINK_ACCT
16 tristate "Netfilter NFACCT over NFNETLINK interface"
17 depends on NETFILTER_ADVANCED
18 select NETFILTER_NETLINK
20 If this option is enabled, the kernel will include support
21 for extended accounting via NFNETLINK.
23 config NETFILTER_NETLINK_QUEUE
24 tristate "Netfilter NFQUEUE over NFNETLINK interface"
25 depends on NETFILTER_ADVANCED
26 select NETFILTER_NETLINK
28 If this option is enabled, the kernel will include support
29 for queueing packets via NFNETLINK.
31 config NETFILTER_NETLINK_LOG
32 tristate "Netfilter LOG over NFNETLINK interface"
33 default m if NETFILTER_ADVANCED=n
34 select NETFILTER_NETLINK
36 If this option is enabled, the kernel will include support
37 for logging packets via NFNETLINK.
39 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
40 and is also scheduled to replace the old syslog-based ipt_LOG
44 tristate "Netfilter connection tracking support"
45 default m if NETFILTER_ADVANCED=n
47 Connection tracking keeps a record of what packets have passed
48 through your machine, in order to figure out how they are related
51 This is required to do Masquerading or other kinds of Network
52 Address Translation. It can also be used to enhance packet
53 filtering (see `Connection state match support' below).
55 To compile it as a module, choose M here. If unsure, say N.
62 config NF_CONNTRACK_MARK
63 bool 'Connection mark tracking support'
64 depends on NETFILTER_ADVANCED
66 This option enables support for connection marks, used by the
67 `CONNMARK' target and `connmark' match. Similar to the mark value
68 of packets, but this mark value is kept in the conntrack session
69 instead of the individual packets.
71 config NF_CONNTRACK_SECMARK
72 bool 'Connection tracking security mark support'
73 depends on NETWORK_SECMARK
74 default m if NETFILTER_ADVANCED=n
76 This option enables security markings to be applied to
77 connections. Typically they are copied to connections from
78 packets using the CONNSECMARK target and copied back from
79 connections to packets with the same target, with the packets
80 being originally labeled via SECMARK.
84 config NF_CONNTRACK_ZONES
85 bool 'Connection tracking zones'
86 depends on NETFILTER_ADVANCED
87 depends on NETFILTER_XT_TARGET_CT
89 This option enables support for connection tracking zones.
90 Normally, each connection needs to have a unique system wide
91 identity. Connection tracking zones allow to have multiple
92 connections using the same identity, as long as they are
93 contained in different zones.
97 config NF_CONNTRACK_PROCFS
98 bool "Supply CT list in procfs (OBSOLETE)"
102 This option enables for the list of known conntrack entries
103 to be shown in procfs under net/netfilter/nf_conntrack. This
104 is considered obsolete in favor of using the conntrack(8)
105 tool which uses Netlink.
107 config NF_CONNTRACK_EVENTS
108 bool "Connection tracking events"
109 depends on NETFILTER_ADVANCED
111 If this option is enabled, the connection tracking code will
112 provide a notifier chain that can be used by other kernel code
113 to get notified about changes in the connection tracking state.
117 config NF_CONNTRACK_TIMEOUT
118 bool 'Connection tracking timeout'
119 depends on NETFILTER_ADVANCED
121 This option enables support for connection tracking timeout
122 extension. This allows you to attach timeout policies to flow
127 config NF_CONNTRACK_TIMESTAMP
128 bool 'Connection tracking timestamping'
129 depends on NETFILTER_ADVANCED
131 This option enables support for connection tracking timestamping.
132 This allows you to store the flow start-time and to obtain
133 the flow-stop time (once it has been destroyed) via Connection
138 config NF_CONNTRACK_LABELS
141 This option enables support for assigning user-defined flag bits
142 to connection tracking entries. It selected by the connlabel match.
144 config NF_CT_PROTO_DCCP
145 tristate 'DCCP protocol connection tracking support'
146 depends on NETFILTER_ADVANCED
149 With this option enabled, the layer 3 independent connection
150 tracking code will be able to do state tracking on DCCP connections.
154 config NF_CT_PROTO_GRE
157 config NF_CT_PROTO_SCTP
158 tristate 'SCTP protocol connection tracking support'
159 depends on NETFILTER_ADVANCED
162 With this option enabled, the layer 3 independent connection
163 tracking code will be able to do state tracking on SCTP connections.
165 If you want to compile it as a module, say M here and read
166 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
168 config NF_CT_PROTO_UDPLITE
169 tristate 'UDP-Lite protocol connection tracking support'
170 depends on NETFILTER_ADVANCED
172 With this option enabled, the layer 3 independent connection
173 tracking code will be able to do state tracking on UDP-Lite
176 To compile it as a module, choose M here. If unsure, say N.
178 config NF_CONNTRACK_AMANDA
179 tristate "Amanda backup protocol support"
180 depends on NETFILTER_ADVANCED
182 select TEXTSEARCH_KMP
184 If you are running the Amanda backup package <http://www.amanda.org/>
185 on this machine or machines that will be MASQUERADED through this
186 machine, then you may want to enable this feature. This allows the
187 connection tracking and natting code to allow the sub-channels that
188 Amanda requires for communication of the backup data, messages and
191 To compile it as a module, choose M here. If unsure, say N.
193 config NF_CONNTRACK_FTP
194 tristate "FTP protocol support"
195 default m if NETFILTER_ADVANCED=n
197 Tracking FTP connections is problematic: special helpers are
198 required for tracking them, and doing masquerading and other forms
199 of Network Address Translation on them.
201 This is FTP support on Layer 3 independent connection tracking.
202 Layer 3 independent connection tracking is experimental scheme
203 which generalize ip_conntrack to support other layer 3 protocols.
205 To compile it as a module, choose M here. If unsure, say N.
207 config NF_CONNTRACK_H323
208 tristate "H.323 protocol support"
209 depends on IPV6 || IPV6=n
210 depends on NETFILTER_ADVANCED
212 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
213 important VoIP protocols, it is widely used by voice hardware and
214 software including voice gateways, IP phones, Netmeeting, OpenPhone,
217 With this module you can support H.323 on a connection tracking/NAT
220 This module supports RAS, Fast Start, H.245 Tunnelling, Call
221 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
222 whiteboard, file transfer, etc. For more information, please
223 visit http://nath323.sourceforge.net/.
225 To compile it as a module, choose M here. If unsure, say N.
227 config NF_CONNTRACK_IRC
228 tristate "IRC protocol support"
229 default m if NETFILTER_ADVANCED=n
231 There is a commonly-used extension to IRC called
232 Direct Client-to-Client Protocol (DCC). This enables users to send
233 files to each other, and also chat to each other without the need
234 of a server. DCC Sending is used anywhere you send files over IRC,
235 and DCC Chat is most commonly used by Eggdrop bots. If you are
236 using NAT, this extension will enable you to send files and initiate
237 chats. Note that you do NOT need this extension to get files or
238 have others initiate chats, or everything else in IRC.
240 To compile it as a module, choose M here. If unsure, say N.
242 config NF_CONNTRACK_BROADCAST
245 config NF_CONNTRACK_NETBIOS_NS
246 tristate "NetBIOS name service protocol support"
247 select NF_CONNTRACK_BROADCAST
249 NetBIOS name service requests are sent as broadcast messages from an
250 unprivileged port and responded to with unicast messages to the
251 same port. This make them hard to firewall properly because connection
252 tracking doesn't deal with broadcasts. This helper tracks locally
253 originating NetBIOS name service requests and the corresponding
254 responses. It relies on correct IP address configuration, specifically
255 netmask and broadcast address. When properly configured, the output
256 of "ip address show" should look similar to this:
258 $ ip -4 address show eth0
259 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
260 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
262 To compile it as a module, choose M here. If unsure, say N.
264 config NF_CONNTRACK_SNMP
265 tristate "SNMP service protocol support"
266 depends on NETFILTER_ADVANCED
267 select NF_CONNTRACK_BROADCAST
269 SNMP service requests are sent as broadcast messages from an
270 unprivileged port and responded to with unicast messages to the
271 same port. This make them hard to firewall properly because connection
272 tracking doesn't deal with broadcasts. This helper tracks locally
273 originating SNMP service requests and the corresponding
274 responses. It relies on correct IP address configuration, specifically
275 netmask and broadcast address.
277 To compile it as a module, choose M here. If unsure, say N.
279 config NF_CONNTRACK_PPTP
280 tristate "PPtP protocol support"
281 depends on NETFILTER_ADVANCED
282 select NF_CT_PROTO_GRE
284 This module adds support for PPTP (Point to Point Tunnelling
285 Protocol, RFC2637) connection tracking and NAT.
287 If you are running PPTP sessions over a stateful firewall or NAT
288 box, you may want to enable this feature.
290 Please note that not all PPTP modes of operation are supported yet.
291 Specifically these limitations exist:
292 - Blindly assumes that control connections are always established
293 in PNS->PAC direction. This is a violation of RFC2637.
294 - Only supports a single call within each session
296 To compile it as a module, choose M here. If unsure, say N.
298 config NF_CONNTRACK_SANE
299 tristate "SANE protocol support"
300 depends on NETFILTER_ADVANCED
302 SANE is a protocol for remote access to scanners as implemented
303 by the 'saned' daemon. Like FTP, it uses separate control and
306 With this module you can support SANE on a connection tracking
309 To compile it as a module, choose M here. If unsure, say N.
311 config NF_CONNTRACK_SIP
312 tristate "SIP protocol support"
313 default m if NETFILTER_ADVANCED=n
315 SIP is an application-layer control protocol that can establish,
316 modify, and terminate multimedia sessions (conferences) such as
317 Internet telephony calls. With the ip_conntrack_sip and
318 the nf_nat_sip modules you can support the protocol on a connection
319 tracking/NATing firewall.
321 To compile it as a module, choose M here. If unsure, say N.
323 config NF_CONNTRACK_TFTP
324 tristate "TFTP protocol support"
325 depends on NETFILTER_ADVANCED
327 TFTP connection tracking helper, this is required depending
328 on how restrictive your ruleset is.
329 If you are using a tftp client behind -j SNAT or -j MASQUERADING
332 To compile it as a module, choose M here. If unsure, say N.
335 tristate 'Connection tracking netlink interface'
336 select NETFILTER_NETLINK
337 default m if NETFILTER_ADVANCED=n
339 This option enables support for a netlink-based userspace interface
341 config NF_CT_NETLINK_TIMEOUT
342 tristate 'Connection tracking timeout tuning via Netlink'
343 select NETFILTER_NETLINK
344 depends on NETFILTER_ADVANCED
346 This option enables support for connection tracking timeout
347 fine-grain tuning. This allows you to attach specific timeout
348 policies to flows, instead of using the global timeout policy.
352 config NF_CT_NETLINK_HELPER
353 tristate 'Connection tracking helpers in user-space via Netlink'
354 select NETFILTER_NETLINK
355 depends on NF_CT_NETLINK
356 depends on NETFILTER_NETLINK_QUEUE
357 depends on NETFILTER_NETLINK_GLUE_CT
358 depends on NETFILTER_ADVANCED
360 This option enables the user-space connection tracking helpers
365 config NETFILTER_NETLINK_GLUE_CT
366 bool "NFQUEUE and NFLOG integration with Connection Tracking"
368 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
370 If this option is enabled, NFQUEUE and NFLOG can include
371 Connection Tracking information together with the packet is
372 the enqueued via NFNETLINK.
382 config NF_NAT_PROTO_DCCP
384 depends on NF_NAT && NF_CT_PROTO_DCCP
385 default NF_NAT && NF_CT_PROTO_DCCP
387 config NF_NAT_PROTO_UDPLITE
389 depends on NF_NAT && NF_CT_PROTO_UDPLITE
390 default NF_NAT && NF_CT_PROTO_UDPLITE
392 config NF_NAT_PROTO_SCTP
394 default NF_NAT && NF_CT_PROTO_SCTP
395 depends on NF_NAT && NF_CT_PROTO_SCTP
400 depends on NF_CONNTRACK && NF_NAT
401 default NF_NAT && NF_CONNTRACK_AMANDA
405 depends on NF_CONNTRACK && NF_NAT
406 default NF_NAT && NF_CONNTRACK_FTP
410 depends on NF_CONNTRACK && NF_NAT
411 default NF_NAT && NF_CONNTRACK_IRC
415 depends on NF_CONNTRACK && NF_NAT
416 default NF_NAT && NF_CONNTRACK_SIP
420 depends on NF_CONNTRACK && NF_NAT
421 default NF_NAT && NF_CONNTRACK_TFTP
423 config NF_NAT_REDIRECT
424 tristate "IPv4/IPv6 redirect support"
427 This is the kernel functionality to redirect packets to local
430 config NETFILTER_SYNPROXY
436 select NETFILTER_NETLINK
437 tristate "Netfilter nf_tables support"
439 nftables is the new packet classification framework that intends to
440 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
441 provides a pseudo-state machine with an extensible instruction-set
442 (also known as expressions) that the userspace 'nft' utility
443 (http://www.netfilter.org/projects/nftables) uses to build the
444 rule-set. It also comes with the generic set infrastructure that
445 allows you to construct mappings between matchings and actions
446 for performance lookups.
448 To compile it as a module, choose M here.
452 config NF_TABLES_INET
454 select NF_TABLES_IPV4
455 select NF_TABLES_IPV6
456 tristate "Netfilter nf_tables mixed IPv4/IPv6 tables support"
458 This option enables support for a mixed IPv4/IPv6 "inet" table.
460 config NF_TABLES_NETDEV
461 tristate "Netfilter nf_tables netdev tables support"
463 This option enables support for the "netdev" table.
466 tristate "Netfilter nf_tables IPv6 exthdr module"
468 This option adds the "exthdr" expression that you can use to match
469 IPv6 extension headers.
472 tristate "Netfilter nf_tables meta module"
474 This option adds the "meta" expression that you can use to match and
475 to set packet metainformation such as the packet mark.
478 depends on NF_CONNTRACK
479 tristate "Netfilter nf_tables conntrack module"
481 This option adds the "meta" expression that you can use to match
482 connection tracking information such as the flow state.
484 config NFT_SET_RBTREE
485 tristate "Netfilter nf_tables rbtree set module"
487 This option adds the "rbtree" set type (Red Black tree) that is used
488 to build interval-based sets.
491 tristate "Netfilter nf_tables hash set module"
493 This option adds the "hash" set type that is used to build one-way
494 mappings between matchings and actions.
497 tristate "Netfilter nf_tables counter module"
499 This option adds the "counter" expression that you can use to
500 include packet and byte counters in a rule.
503 tristate "Netfilter nf_tables log module"
505 This option adds the "log" expression that you can use to log
506 packets matching some criteria.
509 tristate "Netfilter nf_tables limit module"
511 This option adds the "limit" expression that you can use to
512 ratelimit rule matchings.
515 depends on NF_CONNTRACK
517 tristate "Netfilter nf_tables masquerade support"
519 This option adds the "masquerade" expression that you can use
520 to perform NAT in the masquerade flavour.
523 depends on NF_CONNTRACK
525 tristate "Netfilter nf_tables redirect support"
527 This options adds the "redirect" expression that you can use
528 to perform NAT in the redirect flavour.
531 depends on NF_CONNTRACK
533 tristate "Netfilter nf_tables nat module"
535 This option adds the "nat" expression that you can use to perform
536 typical Network Address Translation (NAT) packet transformations.
539 depends on NETFILTER_NETLINK_QUEUE
540 tristate "Netfilter nf_tables queue module"
542 This is required if you intend to use the userspace queueing
543 infrastructure (also known as NFQUEUE) from nftables.
546 tristate "Netfilter nf_tables quota module"
548 This option adds the "quota" expression that you can use to match
549 enforce bytes quotas.
552 default m if NETFILTER_ADVANCED=n
553 tristate "Netfilter nf_tables reject support"
555 This option adds the "reject" expression that you can use to
556 explicitly deny and notify via TCP reset/ICMP informational errors
559 config NFT_REJECT_INET
560 depends on NF_TABLES_INET
565 depends on NETFILTER_XTABLES
566 tristate "Netfilter x_tables over nf_tables module"
568 This is required if you intend to use any of existing
569 x_tables match/target extensions over the nf_tables
573 tristate "Netfilter nf_tables hash module"
575 This option adds the "hash" expression that you can use to perform
576 a hash operation on registers.
581 tristate "Netfilter packet duplication support"
583 This option enables the generic packet duplication infrastructure
586 config NFT_DUP_NETDEV
587 tristate "Netfilter nf_tables netdev packet duplication support"
590 This option enables packet duplication for the "netdev" family.
592 config NFT_FWD_NETDEV
593 tristate "Netfilter nf_tables netdev packet forwarding support"
596 This option enables packet forwarding for the "netdev" family.
598 endif # NF_TABLES_NETDEV
602 config NETFILTER_XTABLES
603 tristate "Netfilter Xtables support (required for ip_tables)"
604 default m if NETFILTER_ADVANCED=n
606 This is required if you intend to use any of ip_tables,
607 ip6_tables or arp_tables.
611 comment "Xtables combined modules"
613 config NETFILTER_XT_MARK
614 tristate 'nfmark target and match support'
615 default m if NETFILTER_ADVANCED=n
617 This option adds the "MARK" target and "mark" match.
619 Netfilter mark matching allows you to match packets based on the
620 "nfmark" value in the packet.
621 The target allows you to create rules in the "mangle" table which alter
622 the netfilter mark (nfmark) field associated with the packet.
624 Prior to routing, the nfmark can influence the routing method and can
625 also be used by other subsystems to change their behavior.
627 config NETFILTER_XT_CONNMARK
628 tristate 'ctmark target and match support'
629 depends on NF_CONNTRACK
630 depends on NETFILTER_ADVANCED
631 select NF_CONNTRACK_MARK
633 This option adds the "CONNMARK" target and "connmark" match.
635 Netfilter allows you to store a mark value per connection (a.k.a.
636 ctmark), similarly to the packet mark (nfmark). Using this
637 target and match, you can set and match on this mark.
639 config NETFILTER_XT_SET
640 tristate 'set target and match support'
642 depends on NETFILTER_ADVANCED
644 This option adds the "SET" target and "set" match.
646 Using this target and match, you can add/delete and match
647 elements in the sets created by ipset(8).
649 To compile it as a module, choose M here. If unsure, say N.
651 # alphabetically ordered list of targets
653 comment "Xtables targets"
655 config NETFILTER_XT_TARGET_AUDIT
656 tristate "AUDIT target support"
658 depends on NETFILTER_ADVANCED
660 This option adds a 'AUDIT' target, which can be used to create
661 audit records for packets dropped/accepted.
663 To compileit as a module, choose M here. If unsure, say N.
665 config NETFILTER_XT_TARGET_CHECKSUM
666 tristate "CHECKSUM target support"
667 depends on IP_NF_MANGLE || IP6_NF_MANGLE
668 depends on NETFILTER_ADVANCED
670 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
673 You can use this target to compute and fill in the checksum in
674 a packet that lacks a checksum. This is particularly useful,
675 if you need to work around old applications such as dhcp clients,
676 that do not work well with checksum offloads, but don't want to disable
677 checksum offload in your device.
679 To compile it as a module, choose M here. If unsure, say N.
681 config NETFILTER_XT_TARGET_CLASSIFY
682 tristate '"CLASSIFY" target support'
683 depends on NETFILTER_ADVANCED
685 This option adds a `CLASSIFY' target, which enables the user to set
686 the priority of a packet. Some qdiscs can use this value for
687 classification, among these are:
689 atm, cbq, dsmark, pfifo_fast, htb, prio
691 To compile it as a module, choose M here. If unsure, say N.
693 config NETFILTER_XT_TARGET_CONNMARK
694 tristate '"CONNMARK" target support'
695 depends on NF_CONNTRACK
696 depends on NETFILTER_ADVANCED
697 select NETFILTER_XT_CONNMARK
699 This is a backwards-compat option for the user's convenience
700 (e.g. when running oldconfig). It selects
701 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
703 config NETFILTER_XT_TARGET_CONNSECMARK
704 tristate '"CONNSECMARK" target support'
705 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
706 default m if NETFILTER_ADVANCED=n
708 The CONNSECMARK target copies security markings from packets
709 to connections, and restores security markings from connections
710 to packets (if the packets are not already marked). This would
711 normally be used in conjunction with the SECMARK target.
713 To compile it as a module, choose M here. If unsure, say N.
715 config NETFILTER_XT_TARGET_CT
716 tristate '"CT" target support'
717 depends on NF_CONNTRACK
718 depends on IP_NF_RAW || IP6_NF_RAW
719 depends on NETFILTER_ADVANCED
721 This options adds a `CT' target, which allows to specify initial
722 connection tracking parameters like events to be delivered and
723 the helper to be used.
725 To compile it as a module, choose M here. If unsure, say N.
727 config NETFILTER_XT_TARGET_DSCP
728 tristate '"DSCP" and "TOS" target support'
729 depends on IP_NF_MANGLE || IP6_NF_MANGLE
730 depends on NETFILTER_ADVANCED
732 This option adds a `DSCP' target, which allows you to manipulate
733 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
735 The DSCP field can have any value between 0x0 and 0x3f inclusive.
737 It also adds the "TOS" target, which allows you to create rules in
738 the "mangle" table which alter the Type Of Service field of an IPv4
739 or the Priority field of an IPv6 packet, prior to routing.
741 To compile it as a module, choose M here. If unsure, say N.
743 config NETFILTER_XT_TARGET_HL
744 tristate '"HL" hoplimit target support'
745 depends on IP_NF_MANGLE || IP6_NF_MANGLE
746 depends on NETFILTER_ADVANCED
748 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
749 targets, which enable the user to change the
750 hoplimit/time-to-live value of the IP header.
752 While it is safe to decrement the hoplimit/TTL value, the
753 modules also allow to increment and set the hoplimit value of
754 the header to arbitrary values. This is EXTREMELY DANGEROUS
755 since you can easily create immortal packets that loop
756 forever on the network.
758 config NETFILTER_XT_TARGET_HMARK
759 tristate '"HMARK" target support'
760 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
761 depends on NETFILTER_ADVANCED
763 This option adds the "HMARK" target.
765 The target allows you to create rules in the "raw" and "mangle" tables
766 which set the skbuff mark by means of hash calculation within a given
767 range. The nfmark can influence the routing method and can also be used
768 by other subsystems to change their behaviour.
770 To compile it as a module, choose M here. If unsure, say N.
772 config NETFILTER_XT_TARGET_IDLETIMER
773 tristate "IDLETIMER target support"
774 depends on NETFILTER_ADVANCED
777 This option adds the `IDLETIMER' target. Each matching packet
778 resets the timer associated with label specified when the rule is
779 added. When the timer expires, it triggers a sysfs notification.
780 The remaining time for expiration can be read via sysfs.
782 To compile it as a module, choose M here. If unsure, say N.
784 config NETFILTER_XT_TARGET_LED
785 tristate '"LED" target support'
786 depends on LEDS_CLASS && LEDS_TRIGGERS
787 depends on NETFILTER_ADVANCED
789 This option adds a `LED' target, which allows you to blink LEDs in
790 response to particular packets passing through your machine.
792 This can be used to turn a spare LED into a network activity LED,
793 which only flashes in response to FTP transfers, for example. Or
794 you could have an LED which lights up for a minute or two every time
795 somebody connects to your machine via SSH.
797 You will need support for the "led" class to make this work.
799 To create an LED trigger for incoming SSH traffic:
800 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
802 Then attach the new trigger to an LED on your system:
803 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
805 For more information on the LEDs available on your system, see
806 Documentation/leds/leds-class.txt
808 config NETFILTER_XT_TARGET_LOG
809 tristate "LOG target support"
812 select NF_LOG_IPV6 if IPV6
813 default m if NETFILTER_ADVANCED=n
815 This option adds a `LOG' target, which allows you to create rules in
816 any iptables table which records the packet header to the syslog.
818 To compile it as a module, choose M here. If unsure, say N.
820 config NETFILTER_XT_TARGET_MARK
821 tristate '"MARK" target support'
822 depends on NETFILTER_ADVANCED
823 select NETFILTER_XT_MARK
825 This is a backwards-compat option for the user's convenience
826 (e.g. when running oldconfig). It selects
827 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
829 config NETFILTER_XT_NAT
830 tristate '"SNAT and DNAT" targets support'
833 This option enables the SNAT and DNAT targets.
835 To compile it as a module, choose M here. If unsure, say N.
837 config NETFILTER_XT_TARGET_NETMAP
838 tristate '"NETMAP" target support'
841 NETMAP is an implementation of static 1:1 NAT mapping of network
842 addresses. It maps the network address part, while keeping the host
845 To compile it as a module, choose M here. If unsure, say N.
847 config NETFILTER_XT_TARGET_NFLOG
848 tristate '"NFLOG" target support'
849 default m if NETFILTER_ADVANCED=n
850 select NETFILTER_NETLINK_LOG
852 This option enables the NFLOG target, which allows to LOG
853 messages through nfnetlink_log.
855 To compile it as a module, choose M here. If unsure, say N.
857 config NETFILTER_XT_TARGET_NFQUEUE
858 tristate '"NFQUEUE" target Support'
859 depends on NETFILTER_ADVANCED
860 select NETFILTER_NETLINK_QUEUE
862 This target replaced the old obsolete QUEUE target.
864 As opposed to QUEUE, it supports 65535 different queues,
867 To compile it as a module, choose M here. If unsure, say N.
869 config NETFILTER_XT_TARGET_NOTRACK
870 tristate '"NOTRACK" target support (DEPRECATED)'
871 depends on NF_CONNTRACK
872 depends on IP_NF_RAW || IP6_NF_RAW
873 depends on NETFILTER_ADVANCED
874 select NETFILTER_XT_TARGET_CT
876 config NETFILTER_XT_TARGET_RATEEST
877 tristate '"RATEEST" target support'
878 depends on NETFILTER_ADVANCED
880 This option adds a `RATEEST' target, which allows to measure
881 rates similar to TC estimators. The `rateest' match can be
882 used to match on the measured rates.
884 To compile it as a module, choose M here. If unsure, say N.
886 config NETFILTER_XT_TARGET_REDIRECT
887 tristate "REDIRECT target support"
889 select NF_NAT_REDIRECT
891 REDIRECT is a special case of NAT: all incoming connections are
892 mapped onto the incoming interface's address, causing the packets to
893 come to the local machine instead of passing through. This is
894 useful for transparent proxies.
896 To compile it as a module, choose M here. If unsure, say N.
898 config NETFILTER_XT_TARGET_TEE
899 tristate '"TEE" - packet cloning to alternate destination'
900 depends on NETFILTER_ADVANCED
901 depends on IPV6 || IPV6=n
902 depends on !NF_CONNTRACK || NF_CONNTRACK
904 select NF_DUP_IPV6 if IPV6
906 This option adds a "TEE" target with which a packet can be cloned and
907 this clone be rerouted to another nexthop.
909 config NETFILTER_XT_TARGET_TPROXY
910 tristate '"TPROXY" target transparent proxying support'
911 depends on NETFILTER_XTABLES
912 depends on NETFILTER_ADVANCED
913 depends on IPV6 || IPV6=n
914 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
915 depends on IP_NF_MANGLE
916 select NF_DEFRAG_IPV4
917 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
919 This option adds a `TPROXY' target, which is somewhat similar to
920 REDIRECT. It can only be used in the mangle table and is useful
921 to redirect traffic to a transparent proxy. It does _not_ depend
922 on Netfilter connection tracking and NAT, unlike REDIRECT.
923 For it to work you will have to configure certain iptables rules
924 and use policy routing. For more information on how to set it up
925 see Documentation/networking/tproxy.txt.
927 To compile it as a module, choose M here. If unsure, say N.
929 config NETFILTER_XT_TARGET_TRACE
930 tristate '"TRACE" target support'
931 depends on IP_NF_RAW || IP6_NF_RAW
932 depends on NETFILTER_ADVANCED
934 The TRACE target allows you to mark packets so that the kernel
935 will log every rule which match the packets as those traverse
936 the tables, chains, rules.
938 If you want to compile it as a module, say M here and read
939 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
941 config NETFILTER_XT_TARGET_SECMARK
942 tristate '"SECMARK" target support'
943 depends on NETWORK_SECMARK
944 default m if NETFILTER_ADVANCED=n
946 The SECMARK target allows security marking of network
947 packets, for use with security subsystems.
949 To compile it as a module, choose M here. If unsure, say N.
951 config NETFILTER_XT_TARGET_TCPMSS
952 tristate '"TCPMSS" target support'
953 depends on IPV6 || IPV6=n
954 default m if NETFILTER_ADVANCED=n
956 This option adds a `TCPMSS' target, which allows you to alter the
957 MSS value of TCP SYN packets, to control the maximum size for that
958 connection (usually limiting it to your outgoing interface's MTU
961 This is used to overcome criminally braindead ISPs or servers which
962 block ICMP Fragmentation Needed packets. The symptoms of this
963 problem are that everything works fine from your Linux
964 firewall/router, but machines behind it can never exchange large
966 1) Web browsers connect, then hang with no data received.
967 2) Small mail works fine, but large emails hang.
968 3) ssh works fine, but scp hangs after initial handshaking.
970 Workaround: activate this option and add a rule to your firewall
973 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
974 -j TCPMSS --clamp-mss-to-pmtu
976 To compile it as a module, choose M here. If unsure, say N.
978 config NETFILTER_XT_TARGET_TCPOPTSTRIP
979 tristate '"TCPOPTSTRIP" target support'
980 depends on IP_NF_MANGLE || IP6_NF_MANGLE
981 depends on NETFILTER_ADVANCED
983 This option adds a "TCPOPTSTRIP" target, which allows you to strip
984 TCP options from TCP packets.
986 # alphabetically ordered list of matches
988 comment "Xtables matches"
990 config NETFILTER_XT_MATCH_ADDRTYPE
991 tristate '"addrtype" address type match support'
992 default m if NETFILTER_ADVANCED=n
994 This option allows you to match what routing thinks of an address,
995 eg. UNICAST, LOCAL, BROADCAST, ...
997 If you want to compile it as a module, say M here and read
998 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1000 config NETFILTER_XT_MATCH_BPF
1001 tristate '"bpf" match support'
1002 depends on NETFILTER_ADVANCED
1004 BPF matching applies a linux socket filter to each packet and
1005 accepts those for which the filter returns non-zero.
1007 To compile it as a module, choose M here. If unsure, say N.
1009 config NETFILTER_XT_MATCH_CGROUP
1010 tristate '"control group" match support'
1011 depends on NETFILTER_ADVANCED
1013 select CGROUP_NET_CLASSID
1015 Socket/process control group matching allows you to match locally
1016 generated packets based on which net_cls control group processes
1019 config NETFILTER_XT_MATCH_CLUSTER
1020 tristate '"cluster" match support'
1021 depends on NF_CONNTRACK
1022 depends on NETFILTER_ADVANCED
1024 This option allows you to build work-load-sharing clusters of
1025 network servers/stateful firewalls without having a dedicated
1026 load-balancing router/server/switch. Basically, this match returns
1027 true when the packet must be handled by this cluster node. Thus,
1028 all nodes see all packets and this match decides which node handles
1029 what packets. The work-load sharing algorithm is based on source
1032 If you say Y or M here, try `iptables -m cluster --help` for
1035 config NETFILTER_XT_MATCH_COMMENT
1036 tristate '"comment" match support'
1037 depends on NETFILTER_ADVANCED
1039 This option adds a `comment' dummy-match, which allows you to put
1040 comments in your iptables ruleset.
1042 If you want to compile it as a module, say M here and read
1043 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1045 config NETFILTER_XT_MATCH_CONNBYTES
1046 tristate '"connbytes" per-connection counter match support'
1047 depends on NF_CONNTRACK
1048 depends on NETFILTER_ADVANCED
1050 This option adds a `connbytes' match, which allows you to match the
1051 number of bytes and/or packets for each direction within a connection.
1053 If you want to compile it as a module, say M here and read
1054 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1056 config NETFILTER_XT_MATCH_CONNLABEL
1057 tristate '"connlabel" match support'
1058 select NF_CONNTRACK_LABELS
1059 depends on NF_CONNTRACK
1060 depends on NETFILTER_ADVANCED
1062 This match allows you to test and assign userspace-defined labels names
1063 to a connection. The kernel only stores bit values - mapping
1064 names to bits is done by userspace.
1066 Unlike connmark, more than 32 flag bits may be assigned to a
1067 connection simultaneously.
1069 config NETFILTER_XT_MATCH_CONNLIMIT
1070 tristate '"connlimit" match support'
1071 depends on NF_CONNTRACK
1072 depends on NETFILTER_ADVANCED
1074 This match allows you to match against the number of parallel
1075 connections to a server per client IP address (or address block).
1077 config NETFILTER_XT_MATCH_CONNMARK
1078 tristate '"connmark" connection mark match support'
1079 depends on NF_CONNTRACK
1080 depends on NETFILTER_ADVANCED
1081 select NETFILTER_XT_CONNMARK
1083 This is a backwards-compat option for the user's convenience
1084 (e.g. when running oldconfig). It selects
1085 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1087 config NETFILTER_XT_MATCH_CONNTRACK
1088 tristate '"conntrack" connection tracking match support'
1089 depends on NF_CONNTRACK
1090 default m if NETFILTER_ADVANCED=n
1092 This is a general conntrack match module, a superset of the state match.
1094 It allows matching on additional conntrack information, which is
1095 useful in complex configurations, such as NAT gateways with multiple
1096 internet links or tunnels.
1098 To compile it as a module, choose M here. If unsure, say N.
1100 config NETFILTER_XT_MATCH_CPU
1101 tristate '"cpu" match support'
1102 depends on NETFILTER_ADVANCED
1104 CPU matching allows you to match packets based on the CPU
1105 currently handling the packet.
1107 To compile it as a module, choose M here. If unsure, say N.
1109 config NETFILTER_XT_MATCH_DCCP
1110 tristate '"dccp" protocol match support'
1111 depends on NETFILTER_ADVANCED
1114 With this option enabled, you will be able to use the iptables
1115 `dccp' match in order to match on DCCP source/destination ports
1118 If you want to compile it as a module, say M here and read
1119 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1121 config NETFILTER_XT_MATCH_DEVGROUP
1122 tristate '"devgroup" match support'
1123 depends on NETFILTER_ADVANCED
1125 This options adds a `devgroup' match, which allows to match on the
1126 device group a network device is assigned to.
1128 To compile it as a module, choose M here. If unsure, say N.
1130 config NETFILTER_XT_MATCH_DSCP
1131 tristate '"dscp" and "tos" match support'
1132 depends on NETFILTER_ADVANCED
1134 This option adds a `DSCP' match, which allows you to match against
1135 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1137 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1139 It will also add a "tos" match, which allows you to match packets
1140 based on the Type Of Service fields of the IPv4 packet (which share
1141 the same bits as DSCP).
1143 To compile it as a module, choose M here. If unsure, say N.
1145 config NETFILTER_XT_MATCH_ECN
1146 tristate '"ecn" match support'
1147 depends on NETFILTER_ADVANCED
1149 This option adds an "ECN" match, which allows you to match against
1150 the IPv4 and TCP header ECN fields.
1152 To compile it as a module, choose M here. If unsure, say N.
1154 config NETFILTER_XT_MATCH_ESP
1155 tristate '"esp" match support'
1156 depends on NETFILTER_ADVANCED
1158 This match extension allows you to match a range of SPIs
1159 inside ESP header of IPSec packets.
1161 To compile it as a module, choose M here. If unsure, say N.
1163 config NETFILTER_XT_MATCH_HASHLIMIT
1164 tristate '"hashlimit" match support'
1165 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1166 depends on NETFILTER_ADVANCED
1168 This option adds a `hashlimit' match.
1170 As opposed to `limit', this match dynamically creates a hash table
1171 of limit buckets, based on your selection of source/destination
1172 addresses and/or ports.
1174 It enables you to express policies like `10kpps for any given
1175 destination address' or `500pps from any given source address'
1178 config NETFILTER_XT_MATCH_HELPER
1179 tristate '"helper" match support'
1180 depends on NF_CONNTRACK
1181 depends on NETFILTER_ADVANCED
1183 Helper matching allows you to match packets in dynamic connections
1184 tracked by a conntrack-helper, ie. ip_conntrack_ftp
1186 To compile it as a module, choose M here. If unsure, say Y.
1188 config NETFILTER_XT_MATCH_HL
1189 tristate '"hl" hoplimit/TTL match support'
1190 depends on NETFILTER_ADVANCED
1192 HL matching allows you to match packets based on the hoplimit
1193 in the IPv6 header, or the time-to-live field in the IPv4
1194 header of the packet.
1196 config NETFILTER_XT_MATCH_IPCOMP
1197 tristate '"ipcomp" match support'
1198 depends on NETFILTER_ADVANCED
1200 This match extension allows you to match a range of CPIs(16 bits)
1201 inside IPComp header of IPSec packets.
1203 To compile it as a module, choose M here. If unsure, say N.
1205 config NETFILTER_XT_MATCH_IPRANGE
1206 tristate '"iprange" address range match support'
1207 depends on NETFILTER_ADVANCED
1209 This option adds a "iprange" match, which allows you to match based on
1210 an IP address range. (Normal iptables only matches on single addresses
1211 with an optional mask.)
1215 config NETFILTER_XT_MATCH_IPVS
1216 tristate '"ipvs" match support'
1218 depends on NETFILTER_ADVANCED
1219 depends on NF_CONNTRACK
1221 This option allows you to match against IPVS properties of a packet.
1225 config NETFILTER_XT_MATCH_L2TP
1226 tristate '"l2tp" match support'
1227 depends on NETFILTER_ADVANCED
1230 This option adds an "L2TP" match, which allows you to match against
1231 L2TP protocol header fields.
1233 To compile it as a module, choose M here. If unsure, say N.
1235 config NETFILTER_XT_MATCH_LENGTH
1236 tristate '"length" match support'
1237 depends on NETFILTER_ADVANCED
1239 This option allows you to match the length of a packet against a
1240 specific value or range of values.
1242 To compile it as a module, choose M here. If unsure, say N.
1244 config NETFILTER_XT_MATCH_LIMIT
1245 tristate '"limit" match support'
1246 depends on NETFILTER_ADVANCED
1248 limit matching allows you to control the rate at which a rule can be
1249 matched: mainly useful in combination with the LOG target ("LOG
1250 target support", below) and to avoid some Denial of Service attacks.
1252 To compile it as a module, choose M here. If unsure, say N.
1254 config NETFILTER_XT_MATCH_MAC
1255 tristate '"mac" address match support'
1256 depends on NETFILTER_ADVANCED
1258 MAC matching allows you to match packets based on the source
1259 Ethernet address of the packet.
1261 To compile it as a module, choose M here. If unsure, say N.
1263 config NETFILTER_XT_MATCH_MARK
1264 tristate '"mark" match support'
1265 depends on NETFILTER_ADVANCED
1266 select NETFILTER_XT_MARK
1268 This is a backwards-compat option for the user's convenience
1269 (e.g. when running oldconfig). It selects
1270 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1272 config NETFILTER_XT_MATCH_MULTIPORT
1273 tristate '"multiport" Multiple port match support'
1274 depends on NETFILTER_ADVANCED
1276 Multiport matching allows you to match TCP or UDP packets based on
1277 a series of source or destination ports: normally a rule can only
1278 match a single range of ports.
1280 To compile it as a module, choose M here. If unsure, say N.
1282 config NETFILTER_XT_MATCH_NFACCT
1283 tristate '"nfacct" match support'
1284 depends on NETFILTER_ADVANCED
1285 select NETFILTER_NETLINK_ACCT
1287 This option allows you to use the extended accounting through
1290 To compile it as a module, choose M here. If unsure, say N.
1292 config NETFILTER_XT_MATCH_OSF
1293 tristate '"osf" Passive OS fingerprint match'
1294 depends on NETFILTER_ADVANCED && NETFILTER_NETLINK
1296 This option selects the Passive OS Fingerprinting match module
1297 that allows to passively match the remote operating system by
1298 analyzing incoming TCP SYN packets.
1300 Rules and loading software can be downloaded from
1301 http://www.ioremap.net/projects/osf
1303 To compile it as a module, choose M here. If unsure, say N.
1305 config NETFILTER_XT_MATCH_OWNER
1306 tristate '"owner" match support'
1307 depends on NETFILTER_ADVANCED
1309 Socket owner matching allows you to match locally-generated packets
1310 based on who created the socket: the user or group. It is also
1311 possible to check whether a socket actually exists.
1313 config NETFILTER_XT_MATCH_POLICY
1314 tristate 'IPsec "policy" match support'
1316 default m if NETFILTER_ADVANCED=n
1318 Policy matching allows you to match packets based on the
1319 IPsec policy that was used during decapsulation/will
1320 be used during encapsulation.
1322 To compile it as a module, choose M here. If unsure, say N.
1324 config NETFILTER_XT_MATCH_PHYSDEV
1325 tristate '"physdev" match support'
1326 depends on BRIDGE && BRIDGE_NETFILTER
1327 depends on NETFILTER_ADVANCED
1329 Physdev packet matching matches against the physical bridge ports
1330 the IP packet arrived on or will leave by.
1332 To compile it as a module, choose M here. If unsure, say N.
1334 config NETFILTER_XT_MATCH_PKTTYPE
1335 tristate '"pkttype" packet type match support'
1336 depends on NETFILTER_ADVANCED
1338 Packet type matching allows you to match a packet by
1339 its "class", eg. BROADCAST, MULTICAST, ...
1342 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1344 To compile it as a module, choose M here. If unsure, say N.
1346 config NETFILTER_XT_MATCH_QUOTA
1347 tristate '"quota" match support'
1348 depends on NETFILTER_ADVANCED
1350 This option adds a `quota' match, which allows to match on a
1353 If you want to compile it as a module, say M here and read
1354 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1356 config NETFILTER_XT_MATCH_RATEEST
1357 tristate '"rateest" match support'
1358 depends on NETFILTER_ADVANCED
1359 select NETFILTER_XT_TARGET_RATEEST
1361 This option adds a `rateest' match, which allows to match on the
1362 rate estimated by the RATEEST target.
1364 To compile it as a module, choose M here. If unsure, say N.
1366 config NETFILTER_XT_MATCH_REALM
1367 tristate '"realm" match support'
1368 depends on NETFILTER_ADVANCED
1369 select IP_ROUTE_CLASSID
1371 This option adds a `realm' match, which allows you to use the realm
1372 key from the routing subsystem inside iptables.
1374 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1377 If you want to compile it as a module, say M here and read
1378 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1380 config NETFILTER_XT_MATCH_RECENT
1381 tristate '"recent" match support'
1382 depends on NETFILTER_ADVANCED
1384 This match is used for creating one or many lists of recently
1385 used addresses and then matching against that/those list(s).
1387 Short options are available by using 'iptables -m recent -h'
1388 Official Website: <http://snowman.net/projects/ipt_recent/>
1390 config NETFILTER_XT_MATCH_SCTP
1391 tristate '"sctp" protocol match support'
1392 depends on NETFILTER_ADVANCED
1395 With this option enabled, you will be able to use the
1396 `sctp' match in order to match on SCTP source/destination ports
1397 and SCTP chunk types.
1399 If you want to compile it as a module, say M here and read
1400 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1402 config NETFILTER_XT_MATCH_SOCKET
1403 tristate '"socket" match support'
1404 depends on NETFILTER_XTABLES
1405 depends on NETFILTER_ADVANCED
1406 depends on !NF_CONNTRACK || NF_CONNTRACK
1407 depends on IPV6 || IPV6=n
1408 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1409 select NF_DEFRAG_IPV4
1410 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1412 This option adds a `socket' match, which can be used to match
1413 packets for which a TCP or UDP socket lookup finds a valid socket.
1414 It can be used in combination with the MARK target and policy
1415 routing to implement full featured non-locally bound sockets.
1417 To compile it as a module, choose M here. If unsure, say N.
1419 config NETFILTER_XT_MATCH_STATE
1420 tristate '"state" match support'
1421 depends on NF_CONNTRACK
1422 default m if NETFILTER_ADVANCED=n
1424 Connection state matching allows you to match packets based on their
1425 relationship to a tracked connection (ie. previous packets). This
1426 is a powerful tool for packet classification.
1428 To compile it as a module, choose M here. If unsure, say N.
1430 config NETFILTER_XT_MATCH_STATISTIC
1431 tristate '"statistic" match support'
1432 depends on NETFILTER_ADVANCED
1434 This option adds a `statistic' match, which allows you to match
1435 on packets periodically or randomly with a given percentage.
1437 To compile it as a module, choose M here. If unsure, say N.
1439 config NETFILTER_XT_MATCH_STRING
1440 tristate '"string" match support'
1441 depends on NETFILTER_ADVANCED
1443 select TEXTSEARCH_KMP
1444 select TEXTSEARCH_BM
1445 select TEXTSEARCH_FSM
1447 This option adds a `string' match, which allows you to look for
1448 pattern matchings in packets.
1450 To compile it as a module, choose M here. If unsure, say N.
1452 config NETFILTER_XT_MATCH_TCPMSS
1453 tristate '"tcpmss" match support'
1454 depends on NETFILTER_ADVANCED
1456 This option adds a `tcpmss' match, which allows you to examine the
1457 MSS value of TCP SYN packets, which control the maximum packet size
1458 for that connection.
1460 To compile it as a module, choose M here. If unsure, say N.
1462 config NETFILTER_XT_MATCH_TIME
1463 tristate '"time" match support'
1464 depends on NETFILTER_ADVANCED
1466 This option adds a "time" match, which allows you to match based on
1467 the packet arrival time (at the machine which netfilter is running)
1468 on) or departure time/date (for locally generated packets).
1470 If you say Y here, try `iptables -m time --help` for
1473 If you want to compile it as a module, say M here.
1476 config NETFILTER_XT_MATCH_U32
1477 tristate '"u32" match support'
1478 depends on NETFILTER_ADVANCED
1480 u32 allows you to extract quantities of up to 4 bytes from a packet,
1481 AND them with specified masks, shift them by specified amounts and
1482 test whether the results are in any of a set of specified ranges.
1483 The specification of what to extract is general enough to skip over
1484 headers with lengths stored in the packet, as in IP or TCP header
1487 Details and examples are in the kernel module source.
1489 endif # NETFILTER_XTABLES
1493 source "net/netfilter/ipset/Kconfig"
1495 source "net/netfilter/ipvs/Kconfig"