1 menu "Core Netfilter Configuration"
2 depends on NET && INET && NETFILTER
4 config NETFILTER_INGRESS
5 bool "Netfilter ingress support"
9 This allows you to classify packets from ingress using the Netfilter
12 config NETFILTER_NETLINK
15 config NETFILTER_NETLINK_ACCT
16 tristate "Netfilter NFACCT over NFNETLINK interface"
17 depends on NETFILTER_ADVANCED
18 select NETFILTER_NETLINK
20 If this option is enabled, the kernel will include support
21 for extended accounting via NFNETLINK.
23 config NETFILTER_NETLINK_QUEUE
24 tristate "Netfilter NFQUEUE over NFNETLINK interface"
25 depends on NETFILTER_ADVANCED
26 select NETFILTER_NETLINK
28 If this option is enabled, the kernel will include support
29 for queueing packets via NFNETLINK.
31 config NETFILTER_NETLINK_LOG
32 tristate "Netfilter LOG over NFNETLINK interface"
33 default m if NETFILTER_ADVANCED=n
34 select NETFILTER_NETLINK
36 If this option is enabled, the kernel will include support
37 for logging packets via NFNETLINK.
39 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
40 and is also scheduled to replace the old syslog-based ipt_LOG
44 tristate "Netfilter connection tracking support"
45 default m if NETFILTER_ADVANCED=n
47 Connection tracking keeps a record of what packets have passed
48 through your machine, in order to figure out how they are related
51 This is required to do Masquerading or other kinds of Network
52 Address Translation. It can also be used to enhance packet
53 filtering (see `Connection state match support' below).
55 To compile it as a module, choose M here. If unsure, say N.
62 config NF_CONNTRACK_MARK
63 bool 'Connection mark tracking support'
64 depends on NETFILTER_ADVANCED
66 This option enables support for connection marks, used by the
67 `CONNMARK' target and `connmark' match. Similar to the mark value
68 of packets, but this mark value is kept in the conntrack session
69 instead of the individual packets.
71 config NF_CONNTRACK_SECMARK
72 bool 'Connection tracking security mark support'
73 depends on NETWORK_SECMARK
74 default m if NETFILTER_ADVANCED=n
76 This option enables security markings to be applied to
77 connections. Typically they are copied to connections from
78 packets using the CONNSECMARK target and copied back from
79 connections to packets with the same target, with the packets
80 being originally labeled via SECMARK.
84 config NF_CONNTRACK_ZONES
85 bool 'Connection tracking zones'
86 depends on NETFILTER_ADVANCED
87 depends on NETFILTER_XT_TARGET_CT
89 This option enables support for connection tracking zones.
90 Normally, each connection needs to have a unique system wide
91 identity. Connection tracking zones allow to have multiple
92 connections using the same identity, as long as they are
93 contained in different zones.
97 config NF_CONNTRACK_PROCFS
98 bool "Supply CT list in procfs (OBSOLETE)"
102 This option enables for the list of known conntrack entries
103 to be shown in procfs under net/netfilter/nf_conntrack. This
104 is considered obsolete in favor of using the conntrack(8)
105 tool which uses Netlink.
107 config NF_CONNTRACK_EVENTS
108 bool "Connection tracking events"
109 depends on NETFILTER_ADVANCED
111 If this option is enabled, the connection tracking code will
112 provide a notifier chain that can be used by other kernel code
113 to get notified about changes in the connection tracking state.
117 config NF_CONNTRACK_TIMEOUT
118 bool 'Connection tracking timeout'
119 depends on NETFILTER_ADVANCED
121 This option enables support for connection tracking timeout
122 extension. This allows you to attach timeout policies to flow
127 config NF_CONNTRACK_TIMESTAMP
128 bool 'Connection tracking timestamping'
129 depends on NETFILTER_ADVANCED
131 This option enables support for connection tracking timestamping.
132 This allows you to store the flow start-time and to obtain
133 the flow-stop time (once it has been destroyed) via Connection
138 config NF_CONNTRACK_LABELS
141 This option enables support for assigning user-defined flag bits
142 to connection tracking entries. It selected by the connlabel match.
144 config NF_CT_PROTO_DCCP
145 tristate 'DCCP protocol connection tracking support'
146 depends on NETFILTER_ADVANCED
149 With this option enabled, the layer 3 independent connection
150 tracking code will be able to do state tracking on DCCP connections.
154 config NF_CT_PROTO_GRE
157 config NF_CT_PROTO_SCTP
158 tristate 'SCTP protocol connection tracking support'
159 depends on NETFILTER_ADVANCED
162 With this option enabled, the layer 3 independent connection
163 tracking code will be able to do state tracking on SCTP connections.
165 If you want to compile it as a module, say M here and read
166 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
168 config NF_CT_PROTO_UDPLITE
169 tristate 'UDP-Lite protocol connection tracking support'
170 depends on NETFILTER_ADVANCED
172 With this option enabled, the layer 3 independent connection
173 tracking code will be able to do state tracking on UDP-Lite
176 To compile it as a module, choose M here. If unsure, say N.
178 config NF_CONNTRACK_AMANDA
179 tristate "Amanda backup protocol support"
180 depends on NETFILTER_ADVANCED
182 select TEXTSEARCH_KMP
184 If you are running the Amanda backup package <http://www.amanda.org/>
185 on this machine or machines that will be MASQUERADED through this
186 machine, then you may want to enable this feature. This allows the
187 connection tracking and natting code to allow the sub-channels that
188 Amanda requires for communication of the backup data, messages and
191 To compile it as a module, choose M here. If unsure, say N.
193 config NF_CONNTRACK_FTP
194 tristate "FTP protocol support"
195 default m if NETFILTER_ADVANCED=n
197 Tracking FTP connections is problematic: special helpers are
198 required for tracking them, and doing masquerading and other forms
199 of Network Address Translation on them.
201 This is FTP support on Layer 3 independent connection tracking.
202 Layer 3 independent connection tracking is experimental scheme
203 which generalize ip_conntrack to support other layer 3 protocols.
205 To compile it as a module, choose M here. If unsure, say N.
207 config NF_CONNTRACK_H323
208 tristate "H.323 protocol support"
209 depends on IPV6 || IPV6=n
210 depends on NETFILTER_ADVANCED
212 H.323 is a VoIP signalling protocol from ITU-T. As one of the most
213 important VoIP protocols, it is widely used by voice hardware and
214 software including voice gateways, IP phones, Netmeeting, OpenPhone,
217 With this module you can support H.323 on a connection tracking/NAT
220 This module supports RAS, Fast Start, H.245 Tunnelling, Call
221 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
222 whiteboard, file transfer, etc. For more information, please
223 visit http://nath323.sourceforge.net/.
225 To compile it as a module, choose M here. If unsure, say N.
227 config NF_CONNTRACK_IRC
228 tristate "IRC protocol support"
229 default m if NETFILTER_ADVANCED=n
231 There is a commonly-used extension to IRC called
232 Direct Client-to-Client Protocol (DCC). This enables users to send
233 files to each other, and also chat to each other without the need
234 of a server. DCC Sending is used anywhere you send files over IRC,
235 and DCC Chat is most commonly used by Eggdrop bots. If you are
236 using NAT, this extension will enable you to send files and initiate
237 chats. Note that you do NOT need this extension to get files or
238 have others initiate chats, or everything else in IRC.
240 To compile it as a module, choose M here. If unsure, say N.
242 config NF_CONNTRACK_BROADCAST
245 config NF_CONNTRACK_NETBIOS_NS
246 tristate "NetBIOS name service protocol support"
247 select NF_CONNTRACK_BROADCAST
249 NetBIOS name service requests are sent as broadcast messages from an
250 unprivileged port and responded to with unicast messages to the
251 same port. This make them hard to firewall properly because connection
252 tracking doesn't deal with broadcasts. This helper tracks locally
253 originating NetBIOS name service requests and the corresponding
254 responses. It relies on correct IP address configuration, specifically
255 netmask and broadcast address. When properly configured, the output
256 of "ip address show" should look similar to this:
258 $ ip -4 address show eth0
259 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
260 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
262 To compile it as a module, choose M here. If unsure, say N.
264 config NF_CONNTRACK_SNMP
265 tristate "SNMP service protocol support"
266 depends on NETFILTER_ADVANCED
267 select NF_CONNTRACK_BROADCAST
269 SNMP service requests are sent as broadcast messages from an
270 unprivileged port and responded to with unicast messages to the
271 same port. This make them hard to firewall properly because connection
272 tracking doesn't deal with broadcasts. This helper tracks locally
273 originating SNMP service requests and the corresponding
274 responses. It relies on correct IP address configuration, specifically
275 netmask and broadcast address.
277 To compile it as a module, choose M here. If unsure, say N.
279 config NF_CONNTRACK_PPTP
280 tristate "PPtP protocol support"
281 depends on NETFILTER_ADVANCED
282 select NF_CT_PROTO_GRE
284 This module adds support for PPTP (Point to Point Tunnelling
285 Protocol, RFC2637) connection tracking and NAT.
287 If you are running PPTP sessions over a stateful firewall or NAT
288 box, you may want to enable this feature.
290 Please note that not all PPTP modes of operation are supported yet.
291 Specifically these limitations exist:
292 - Blindly assumes that control connections are always established
293 in PNS->PAC direction. This is a violation of RFC2637.
294 - Only supports a single call within each session
296 To compile it as a module, choose M here. If unsure, say N.
298 config NF_CONNTRACK_SANE
299 tristate "SANE protocol support"
300 depends on NETFILTER_ADVANCED
302 SANE is a protocol for remote access to scanners as implemented
303 by the 'saned' daemon. Like FTP, it uses separate control and
306 With this module you can support SANE on a connection tracking
309 To compile it as a module, choose M here. If unsure, say N.
311 config NF_CONNTRACK_SIP
312 tristate "SIP protocol support"
313 default m if NETFILTER_ADVANCED=n
315 SIP is an application-layer control protocol that can establish,
316 modify, and terminate multimedia sessions (conferences) such as
317 Internet telephony calls. With the ip_conntrack_sip and
318 the nf_nat_sip modules you can support the protocol on a connection
319 tracking/NATing firewall.
321 To compile it as a module, choose M here. If unsure, say N.
323 config NF_CONNTRACK_TFTP
324 tristate "TFTP protocol support"
325 depends on NETFILTER_ADVANCED
327 TFTP connection tracking helper, this is required depending
328 on how restrictive your ruleset is.
329 If you are using a tftp client behind -j SNAT or -j MASQUERADING
332 To compile it as a module, choose M here. If unsure, say N.
335 tristate 'Connection tracking netlink interface'
336 select NETFILTER_NETLINK
337 default m if NETFILTER_ADVANCED=n
339 This option enables support for a netlink-based userspace interface
341 config NF_CT_NETLINK_TIMEOUT
342 tristate 'Connection tracking timeout tuning via Netlink'
343 select NETFILTER_NETLINK
344 depends on NETFILTER_ADVANCED
346 This option enables support for connection tracking timeout
347 fine-grain tuning. This allows you to attach specific timeout
348 policies to flows, instead of using the global timeout policy.
352 config NF_CT_NETLINK_HELPER
353 tristate 'Connection tracking helpers in user-space via Netlink'
354 select NETFILTER_NETLINK
355 depends on NF_CT_NETLINK
356 depends on NETFILTER_NETLINK_QUEUE
357 depends on NETFILTER_NETLINK_GLUE_CT
358 depends on NETFILTER_ADVANCED
360 This option enables the user-space connection tracking helpers
365 config NETFILTER_NETLINK_GLUE_CT
366 bool "NFQUEUE and NFLOG integration with Connection Tracking"
368 depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
370 If this option is enabled, NFQUEUE and NFLOG can include
371 Connection Tracking information together with the packet is
372 the enqueued via NFNETLINK.
382 config NF_NAT_PROTO_DCCP
384 depends on NF_NAT && NF_CT_PROTO_DCCP
385 default NF_NAT && NF_CT_PROTO_DCCP
387 config NF_NAT_PROTO_UDPLITE
389 depends on NF_NAT && NF_CT_PROTO_UDPLITE
390 default NF_NAT && NF_CT_PROTO_UDPLITE
392 config NF_NAT_PROTO_SCTP
394 default NF_NAT && NF_CT_PROTO_SCTP
395 depends on NF_NAT && NF_CT_PROTO_SCTP
400 depends on NF_CONNTRACK && NF_NAT
401 default NF_NAT && NF_CONNTRACK_AMANDA
405 depends on NF_CONNTRACK && NF_NAT
406 default NF_NAT && NF_CONNTRACK_FTP
410 depends on NF_CONNTRACK && NF_NAT
411 default NF_NAT && NF_CONNTRACK_IRC
415 depends on NF_CONNTRACK && NF_NAT
416 default NF_NAT && NF_CONNTRACK_SIP
420 depends on NF_CONNTRACK && NF_NAT
421 default NF_NAT && NF_CONNTRACK_TFTP
423 config NF_NAT_REDIRECT
424 tristate "IPv4/IPv6 redirect support"
427 This is the kernel functionality to redirect packets to local
430 config NETFILTER_SYNPROXY
436 select NETFILTER_NETLINK
437 tristate "Netfilter nf_tables support"
439 nftables is the new packet classification framework that intends to
440 replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
441 provides a pseudo-state machine with an extensible instruction-set
442 (also known as expressions) that the userspace 'nft' utility
443 (http://www.netfilter.org/projects/nftables) uses to build the
444 rule-set. It also comes with the generic set infrastructure that
445 allows you to construct mappings between matchings and actions
446 for performance lookups.
448 To compile it as a module, choose M here.
452 config NF_TABLES_INET
454 select NF_TABLES_IPV4
455 select NF_TABLES_IPV6
456 tristate "Netfilter nf_tables mixed IPv4/IPv6 tables support"
458 This option enables support for a mixed IPv4/IPv6 "inet" table.
460 config NF_TABLES_NETDEV
461 tristate "Netfilter nf_tables netdev tables support"
463 This option enables support for the "netdev" table.
466 tristate "Netfilter nf_tables IPv6 exthdr module"
468 This option adds the "exthdr" expression that you can use to match
469 IPv6 extension headers.
472 tristate "Netfilter nf_tables meta module"
474 This option adds the "meta" expression that you can use to match and
475 to set packet metainformation such as the packet mark.
478 tristate "Netfilter nf_tables number generator module"
480 This option adds the number generator expression used to perform
481 incremental counting and random numbers bound to a upper limit.
484 depends on NF_CONNTRACK
485 tristate "Netfilter nf_tables conntrack module"
487 This option adds the "meta" expression that you can use to match
488 connection tracking information such as the flow state.
490 config NFT_SET_RBTREE
491 tristate "Netfilter nf_tables rbtree set module"
493 This option adds the "rbtree" set type (Red Black tree) that is used
494 to build interval-based sets.
497 tristate "Netfilter nf_tables hash set module"
499 This option adds the "hash" set type that is used to build one-way
500 mappings between matchings and actions.
503 tristate "Netfilter nf_tables counter module"
505 This option adds the "counter" expression that you can use to
506 include packet and byte counters in a rule.
509 tristate "Netfilter nf_tables log module"
511 This option adds the "log" expression that you can use to log
512 packets matching some criteria.
515 tristate "Netfilter nf_tables limit module"
517 This option adds the "limit" expression that you can use to
518 ratelimit rule matchings.
521 depends on NF_CONNTRACK
523 tristate "Netfilter nf_tables masquerade support"
525 This option adds the "masquerade" expression that you can use
526 to perform NAT in the masquerade flavour.
529 depends on NF_CONNTRACK
531 tristate "Netfilter nf_tables redirect support"
533 This options adds the "redirect" expression that you can use
534 to perform NAT in the redirect flavour.
537 depends on NF_CONNTRACK
539 tristate "Netfilter nf_tables nat module"
541 This option adds the "nat" expression that you can use to perform
542 typical Network Address Translation (NAT) packet transformations.
545 depends on NETFILTER_NETLINK_QUEUE
546 tristate "Netfilter nf_tables queue module"
548 This is required if you intend to use the userspace queueing
549 infrastructure (also known as NFQUEUE) from nftables.
552 tristate "Netfilter nf_tables quota module"
554 This option adds the "quota" expression that you can use to match
555 enforce bytes quotas.
558 default m if NETFILTER_ADVANCED=n
559 tristate "Netfilter nf_tables reject support"
561 This option adds the "reject" expression that you can use to
562 explicitly deny and notify via TCP reset/ICMP informational errors
565 config NFT_REJECT_INET
566 depends on NF_TABLES_INET
571 depends on NETFILTER_XTABLES
572 tristate "Netfilter x_tables over nf_tables module"
574 This is required if you intend to use any of existing
575 x_tables match/target extensions over the nf_tables
579 tristate "Netfilter nf_tables hash module"
581 This option adds the "hash" expression that you can use to perform
582 a hash operation on registers.
588 depends on NF_TABLES_INET
589 depends on NFT_FIB_IPV4
590 depends on NFT_FIB_IPV6
591 tristate "Netfilter nf_tables fib inet support"
593 This option allows using the FIB expression from the inet table.
594 The lookup will be delegated to the IPv4 or IPv6 FIB depending
595 on the protocol of the packet.
600 tristate "Netfilter packet duplication support"
602 This option enables the generic packet duplication infrastructure
605 config NFT_DUP_NETDEV
606 tristate "Netfilter nf_tables netdev packet duplication support"
609 This option enables packet duplication for the "netdev" family.
611 config NFT_FWD_NETDEV
612 tristate "Netfilter nf_tables netdev packet forwarding support"
615 This option enables packet forwarding for the "netdev" family.
617 endif # NF_TABLES_NETDEV
621 config NETFILTER_XTABLES
622 tristate "Netfilter Xtables support (required for ip_tables)"
623 default m if NETFILTER_ADVANCED=n
625 This is required if you intend to use any of ip_tables,
626 ip6_tables or arp_tables.
630 comment "Xtables combined modules"
632 config NETFILTER_XT_MARK
633 tristate 'nfmark target and match support'
634 default m if NETFILTER_ADVANCED=n
636 This option adds the "MARK" target and "mark" match.
638 Netfilter mark matching allows you to match packets based on the
639 "nfmark" value in the packet.
640 The target allows you to create rules in the "mangle" table which alter
641 the netfilter mark (nfmark) field associated with the packet.
643 Prior to routing, the nfmark can influence the routing method and can
644 also be used by other subsystems to change their behavior.
646 config NETFILTER_XT_CONNMARK
647 tristate 'ctmark target and match support'
648 depends on NF_CONNTRACK
649 depends on NETFILTER_ADVANCED
650 select NF_CONNTRACK_MARK
652 This option adds the "CONNMARK" target and "connmark" match.
654 Netfilter allows you to store a mark value per connection (a.k.a.
655 ctmark), similarly to the packet mark (nfmark). Using this
656 target and match, you can set and match on this mark.
658 config NETFILTER_XT_SET
659 tristate 'set target and match support'
661 depends on NETFILTER_ADVANCED
663 This option adds the "SET" target and "set" match.
665 Using this target and match, you can add/delete and match
666 elements in the sets created by ipset(8).
668 To compile it as a module, choose M here. If unsure, say N.
670 # alphabetically ordered list of targets
672 comment "Xtables targets"
674 config NETFILTER_XT_TARGET_AUDIT
675 tristate "AUDIT target support"
677 depends on NETFILTER_ADVANCED
679 This option adds a 'AUDIT' target, which can be used to create
680 audit records for packets dropped/accepted.
682 To compileit as a module, choose M here. If unsure, say N.
684 config NETFILTER_XT_TARGET_CHECKSUM
685 tristate "CHECKSUM target support"
686 depends on IP_NF_MANGLE || IP6_NF_MANGLE
687 depends on NETFILTER_ADVANCED
689 This option adds a `CHECKSUM' target, which can be used in the iptables mangle
692 You can use this target to compute and fill in the checksum in
693 a packet that lacks a checksum. This is particularly useful,
694 if you need to work around old applications such as dhcp clients,
695 that do not work well with checksum offloads, but don't want to disable
696 checksum offload in your device.
698 To compile it as a module, choose M here. If unsure, say N.
700 config NETFILTER_XT_TARGET_CLASSIFY
701 tristate '"CLASSIFY" target support'
702 depends on NETFILTER_ADVANCED
704 This option adds a `CLASSIFY' target, which enables the user to set
705 the priority of a packet. Some qdiscs can use this value for
706 classification, among these are:
708 atm, cbq, dsmark, pfifo_fast, htb, prio
710 To compile it as a module, choose M here. If unsure, say N.
712 config NETFILTER_XT_TARGET_CONNMARK
713 tristate '"CONNMARK" target support'
714 depends on NF_CONNTRACK
715 depends on NETFILTER_ADVANCED
716 select NETFILTER_XT_CONNMARK
718 This is a backwards-compat option for the user's convenience
719 (e.g. when running oldconfig). It selects
720 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
722 config NETFILTER_XT_TARGET_CONNSECMARK
723 tristate '"CONNSECMARK" target support'
724 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
725 default m if NETFILTER_ADVANCED=n
727 The CONNSECMARK target copies security markings from packets
728 to connections, and restores security markings from connections
729 to packets (if the packets are not already marked). This would
730 normally be used in conjunction with the SECMARK target.
732 To compile it as a module, choose M here. If unsure, say N.
734 config NETFILTER_XT_TARGET_CT
735 tristate '"CT" target support'
736 depends on NF_CONNTRACK
737 depends on IP_NF_RAW || IP6_NF_RAW
738 depends on NETFILTER_ADVANCED
740 This options adds a `CT' target, which allows to specify initial
741 connection tracking parameters like events to be delivered and
742 the helper to be used.
744 To compile it as a module, choose M here. If unsure, say N.
746 config NETFILTER_XT_TARGET_DSCP
747 tristate '"DSCP" and "TOS" target support'
748 depends on IP_NF_MANGLE || IP6_NF_MANGLE
749 depends on NETFILTER_ADVANCED
751 This option adds a `DSCP' target, which allows you to manipulate
752 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
754 The DSCP field can have any value between 0x0 and 0x3f inclusive.
756 It also adds the "TOS" target, which allows you to create rules in
757 the "mangle" table which alter the Type Of Service field of an IPv4
758 or the Priority field of an IPv6 packet, prior to routing.
760 To compile it as a module, choose M here. If unsure, say N.
762 config NETFILTER_XT_TARGET_HL
763 tristate '"HL" hoplimit target support'
764 depends on IP_NF_MANGLE || IP6_NF_MANGLE
765 depends on NETFILTER_ADVANCED
767 This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
768 targets, which enable the user to change the
769 hoplimit/time-to-live value of the IP header.
771 While it is safe to decrement the hoplimit/TTL value, the
772 modules also allow to increment and set the hoplimit value of
773 the header to arbitrary values. This is EXTREMELY DANGEROUS
774 since you can easily create immortal packets that loop
775 forever on the network.
777 config NETFILTER_XT_TARGET_HMARK
778 tristate '"HMARK" target support'
779 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
780 depends on NETFILTER_ADVANCED
782 This option adds the "HMARK" target.
784 The target allows you to create rules in the "raw" and "mangle" tables
785 which set the skbuff mark by means of hash calculation within a given
786 range. The nfmark can influence the routing method and can also be used
787 by other subsystems to change their behaviour.
789 To compile it as a module, choose M here. If unsure, say N.
791 config NETFILTER_XT_TARGET_IDLETIMER
792 tristate "IDLETIMER target support"
793 depends on NETFILTER_ADVANCED
796 This option adds the `IDLETIMER' target. Each matching packet
797 resets the timer associated with label specified when the rule is
798 added. When the timer expires, it triggers a sysfs notification.
799 The remaining time for expiration can be read via sysfs.
801 To compile it as a module, choose M here. If unsure, say N.
803 config NETFILTER_XT_TARGET_LED
804 tristate '"LED" target support'
805 depends on LEDS_CLASS && LEDS_TRIGGERS
806 depends on NETFILTER_ADVANCED
808 This option adds a `LED' target, which allows you to blink LEDs in
809 response to particular packets passing through your machine.
811 This can be used to turn a spare LED into a network activity LED,
812 which only flashes in response to FTP transfers, for example. Or
813 you could have an LED which lights up for a minute or two every time
814 somebody connects to your machine via SSH.
816 You will need support for the "led" class to make this work.
818 To create an LED trigger for incoming SSH traffic:
819 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
821 Then attach the new trigger to an LED on your system:
822 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
824 For more information on the LEDs available on your system, see
825 Documentation/leds/leds-class.txt
827 config NETFILTER_XT_TARGET_LOG
828 tristate "LOG target support"
831 select NF_LOG_IPV6 if IPV6
832 default m if NETFILTER_ADVANCED=n
834 This option adds a `LOG' target, which allows you to create rules in
835 any iptables table which records the packet header to the syslog.
837 To compile it as a module, choose M here. If unsure, say N.
839 config NETFILTER_XT_TARGET_MARK
840 tristate '"MARK" target support'
841 depends on NETFILTER_ADVANCED
842 select NETFILTER_XT_MARK
844 This is a backwards-compat option for the user's convenience
845 (e.g. when running oldconfig). It selects
846 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
848 config NETFILTER_XT_NAT
849 tristate '"SNAT and DNAT" targets support'
852 This option enables the SNAT and DNAT targets.
854 To compile it as a module, choose M here. If unsure, say N.
856 config NETFILTER_XT_TARGET_NETMAP
857 tristate '"NETMAP" target support'
860 NETMAP is an implementation of static 1:1 NAT mapping of network
861 addresses. It maps the network address part, while keeping the host
864 To compile it as a module, choose M here. If unsure, say N.
866 config NETFILTER_XT_TARGET_NFLOG
867 tristate '"NFLOG" target support'
868 default m if NETFILTER_ADVANCED=n
869 select NETFILTER_NETLINK_LOG
871 This option enables the NFLOG target, which allows to LOG
872 messages through nfnetlink_log.
874 To compile it as a module, choose M here. If unsure, say N.
876 config NETFILTER_XT_TARGET_NFQUEUE
877 tristate '"NFQUEUE" target Support'
878 depends on NETFILTER_ADVANCED
879 select NETFILTER_NETLINK_QUEUE
881 This target replaced the old obsolete QUEUE target.
883 As opposed to QUEUE, it supports 65535 different queues,
886 To compile it as a module, choose M here. If unsure, say N.
888 config NETFILTER_XT_TARGET_NOTRACK
889 tristate '"NOTRACK" target support (DEPRECATED)'
890 depends on NF_CONNTRACK
891 depends on IP_NF_RAW || IP6_NF_RAW
892 depends on NETFILTER_ADVANCED
893 select NETFILTER_XT_TARGET_CT
895 config NETFILTER_XT_TARGET_RATEEST
896 tristate '"RATEEST" target support'
897 depends on NETFILTER_ADVANCED
899 This option adds a `RATEEST' target, which allows to measure
900 rates similar to TC estimators. The `rateest' match can be
901 used to match on the measured rates.
903 To compile it as a module, choose M here. If unsure, say N.
905 config NETFILTER_XT_TARGET_REDIRECT
906 tristate "REDIRECT target support"
908 select NF_NAT_REDIRECT
910 REDIRECT is a special case of NAT: all incoming connections are
911 mapped onto the incoming interface's address, causing the packets to
912 come to the local machine instead of passing through. This is
913 useful for transparent proxies.
915 To compile it as a module, choose M here. If unsure, say N.
917 config NETFILTER_XT_TARGET_TEE
918 tristate '"TEE" - packet cloning to alternate destination'
919 depends on NETFILTER_ADVANCED
920 depends on IPV6 || IPV6=n
921 depends on !NF_CONNTRACK || NF_CONNTRACK
923 select NF_DUP_IPV6 if IPV6
925 This option adds a "TEE" target with which a packet can be cloned and
926 this clone be rerouted to another nexthop.
928 config NETFILTER_XT_TARGET_TPROXY
929 tristate '"TPROXY" target transparent proxying support'
930 depends on NETFILTER_XTABLES
931 depends on NETFILTER_ADVANCED
932 depends on IPV6 || IPV6=n
933 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
934 depends on IP_NF_MANGLE
935 select NF_DEFRAG_IPV4
936 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
938 This option adds a `TPROXY' target, which is somewhat similar to
939 REDIRECT. It can only be used in the mangle table and is useful
940 to redirect traffic to a transparent proxy. It does _not_ depend
941 on Netfilter connection tracking and NAT, unlike REDIRECT.
942 For it to work you will have to configure certain iptables rules
943 and use policy routing. For more information on how to set it up
944 see Documentation/networking/tproxy.txt.
946 To compile it as a module, choose M here. If unsure, say N.
948 config NETFILTER_XT_TARGET_TRACE
949 tristate '"TRACE" target support'
950 depends on IP_NF_RAW || IP6_NF_RAW
951 depends on NETFILTER_ADVANCED
953 The TRACE target allows you to mark packets so that the kernel
954 will log every rule which match the packets as those traverse
955 the tables, chains, rules.
957 If you want to compile it as a module, say M here and read
958 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
960 config NETFILTER_XT_TARGET_SECMARK
961 tristate '"SECMARK" target support'
962 depends on NETWORK_SECMARK
963 default m if NETFILTER_ADVANCED=n
965 The SECMARK target allows security marking of network
966 packets, for use with security subsystems.
968 To compile it as a module, choose M here. If unsure, say N.
970 config NETFILTER_XT_TARGET_TCPMSS
971 tristate '"TCPMSS" target support'
972 depends on IPV6 || IPV6=n
973 default m if NETFILTER_ADVANCED=n
975 This option adds a `TCPMSS' target, which allows you to alter the
976 MSS value of TCP SYN packets, to control the maximum size for that
977 connection (usually limiting it to your outgoing interface's MTU
980 This is used to overcome criminally braindead ISPs or servers which
981 block ICMP Fragmentation Needed packets. The symptoms of this
982 problem are that everything works fine from your Linux
983 firewall/router, but machines behind it can never exchange large
985 1) Web browsers connect, then hang with no data received.
986 2) Small mail works fine, but large emails hang.
987 3) ssh works fine, but scp hangs after initial handshaking.
989 Workaround: activate this option and add a rule to your firewall
992 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
993 -j TCPMSS --clamp-mss-to-pmtu
995 To compile it as a module, choose M here. If unsure, say N.
997 config NETFILTER_XT_TARGET_TCPOPTSTRIP
998 tristate '"TCPOPTSTRIP" target support'
999 depends on IP_NF_MANGLE || IP6_NF_MANGLE
1000 depends on NETFILTER_ADVANCED
1002 This option adds a "TCPOPTSTRIP" target, which allows you to strip
1003 TCP options from TCP packets.
1005 # alphabetically ordered list of matches
1007 comment "Xtables matches"
1009 config NETFILTER_XT_MATCH_ADDRTYPE
1010 tristate '"addrtype" address type match support'
1011 default m if NETFILTER_ADVANCED=n
1013 This option allows you to match what routing thinks of an address,
1014 eg. UNICAST, LOCAL, BROADCAST, ...
1016 If you want to compile it as a module, say M here and read
1017 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1019 config NETFILTER_XT_MATCH_BPF
1020 tristate '"bpf" match support'
1021 depends on NETFILTER_ADVANCED
1023 BPF matching applies a linux socket filter to each packet and
1024 accepts those for which the filter returns non-zero.
1026 To compile it as a module, choose M here. If unsure, say N.
1028 config NETFILTER_XT_MATCH_CGROUP
1029 tristate '"control group" match support'
1030 depends on NETFILTER_ADVANCED
1032 select CGROUP_NET_CLASSID
1034 Socket/process control group matching allows you to match locally
1035 generated packets based on which net_cls control group processes
1038 config NETFILTER_XT_MATCH_CLUSTER
1039 tristate '"cluster" match support'
1040 depends on NF_CONNTRACK
1041 depends on NETFILTER_ADVANCED
1043 This option allows you to build work-load-sharing clusters of
1044 network servers/stateful firewalls without having a dedicated
1045 load-balancing router/server/switch. Basically, this match returns
1046 true when the packet must be handled by this cluster node. Thus,
1047 all nodes see all packets and this match decides which node handles
1048 what packets. The work-load sharing algorithm is based on source
1051 If you say Y or M here, try `iptables -m cluster --help` for
1054 config NETFILTER_XT_MATCH_COMMENT
1055 tristate '"comment" match support'
1056 depends on NETFILTER_ADVANCED
1058 This option adds a `comment' dummy-match, which allows you to put
1059 comments in your iptables ruleset.
1061 If you want to compile it as a module, say M here and read
1062 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1064 config NETFILTER_XT_MATCH_CONNBYTES
1065 tristate '"connbytes" per-connection counter match support'
1066 depends on NF_CONNTRACK
1067 depends on NETFILTER_ADVANCED
1069 This option adds a `connbytes' match, which allows you to match the
1070 number of bytes and/or packets for each direction within a connection.
1072 If you want to compile it as a module, say M here and read
1073 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1075 config NETFILTER_XT_MATCH_CONNLABEL
1076 tristate '"connlabel" match support'
1077 select NF_CONNTRACK_LABELS
1078 depends on NF_CONNTRACK
1079 depends on NETFILTER_ADVANCED
1081 This match allows you to test and assign userspace-defined labels names
1082 to a connection. The kernel only stores bit values - mapping
1083 names to bits is done by userspace.
1085 Unlike connmark, more than 32 flag bits may be assigned to a
1086 connection simultaneously.
1088 config NETFILTER_XT_MATCH_CONNLIMIT
1089 tristate '"connlimit" match support'
1090 depends on NF_CONNTRACK
1091 depends on NETFILTER_ADVANCED
1093 This match allows you to match against the number of parallel
1094 connections to a server per client IP address (or address block).
1096 config NETFILTER_XT_MATCH_CONNMARK
1097 tristate '"connmark" connection mark match support'
1098 depends on NF_CONNTRACK
1099 depends on NETFILTER_ADVANCED
1100 select NETFILTER_XT_CONNMARK
1102 This is a backwards-compat option for the user's convenience
1103 (e.g. when running oldconfig). It selects
1104 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1106 config NETFILTER_XT_MATCH_CONNTRACK
1107 tristate '"conntrack" connection tracking match support'
1108 depends on NF_CONNTRACK
1109 default m if NETFILTER_ADVANCED=n
1111 This is a general conntrack match module, a superset of the state match.
1113 It allows matching on additional conntrack information, which is
1114 useful in complex configurations, such as NAT gateways with multiple
1115 internet links or tunnels.
1117 To compile it as a module, choose M here. If unsure, say N.
1119 config NETFILTER_XT_MATCH_CPU
1120 tristate '"cpu" match support'
1121 depends on NETFILTER_ADVANCED
1123 CPU matching allows you to match packets based on the CPU
1124 currently handling the packet.
1126 To compile it as a module, choose M here. If unsure, say N.
1128 config NETFILTER_XT_MATCH_DCCP
1129 tristate '"dccp" protocol match support'
1130 depends on NETFILTER_ADVANCED
1133 With this option enabled, you will be able to use the iptables
1134 `dccp' match in order to match on DCCP source/destination ports
1137 If you want to compile it as a module, say M here and read
1138 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1140 config NETFILTER_XT_MATCH_DEVGROUP
1141 tristate '"devgroup" match support'
1142 depends on NETFILTER_ADVANCED
1144 This options adds a `devgroup' match, which allows to match on the
1145 device group a network device is assigned to.
1147 To compile it as a module, choose M here. If unsure, say N.
1149 config NETFILTER_XT_MATCH_DSCP
1150 tristate '"dscp" and "tos" match support'
1151 depends on NETFILTER_ADVANCED
1153 This option adds a `DSCP' match, which allows you to match against
1154 the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1156 The DSCP field can have any value between 0x0 and 0x3f inclusive.
1158 It will also add a "tos" match, which allows you to match packets
1159 based on the Type Of Service fields of the IPv4 packet (which share
1160 the same bits as DSCP).
1162 To compile it as a module, choose M here. If unsure, say N.
1164 config NETFILTER_XT_MATCH_ECN
1165 tristate '"ecn" match support'
1166 depends on NETFILTER_ADVANCED
1168 This option adds an "ECN" match, which allows you to match against
1169 the IPv4 and TCP header ECN fields.
1171 To compile it as a module, choose M here. If unsure, say N.
1173 config NETFILTER_XT_MATCH_ESP
1174 tristate '"esp" match support'
1175 depends on NETFILTER_ADVANCED
1177 This match extension allows you to match a range of SPIs
1178 inside ESP header of IPSec packets.
1180 To compile it as a module, choose M here. If unsure, say N.
1182 config NETFILTER_XT_MATCH_HASHLIMIT
1183 tristate '"hashlimit" match support'
1184 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1185 depends on NETFILTER_ADVANCED
1187 This option adds a `hashlimit' match.
1189 As opposed to `limit', this match dynamically creates a hash table
1190 of limit buckets, based on your selection of source/destination
1191 addresses and/or ports.
1193 It enables you to express policies like `10kpps for any given
1194 destination address' or `500pps from any given source address'
1197 config NETFILTER_XT_MATCH_HELPER
1198 tristate '"helper" match support'
1199 depends on NF_CONNTRACK
1200 depends on NETFILTER_ADVANCED
1202 Helper matching allows you to match packets in dynamic connections
1203 tracked by a conntrack-helper, ie. ip_conntrack_ftp
1205 To compile it as a module, choose M here. If unsure, say Y.
1207 config NETFILTER_XT_MATCH_HL
1208 tristate '"hl" hoplimit/TTL match support'
1209 depends on NETFILTER_ADVANCED
1211 HL matching allows you to match packets based on the hoplimit
1212 in the IPv6 header, or the time-to-live field in the IPv4
1213 header of the packet.
1215 config NETFILTER_XT_MATCH_IPCOMP
1216 tristate '"ipcomp" match support'
1217 depends on NETFILTER_ADVANCED
1219 This match extension allows you to match a range of CPIs(16 bits)
1220 inside IPComp header of IPSec packets.
1222 To compile it as a module, choose M here. If unsure, say N.
1224 config NETFILTER_XT_MATCH_IPRANGE
1225 tristate '"iprange" address range match support'
1226 depends on NETFILTER_ADVANCED
1228 This option adds a "iprange" match, which allows you to match based on
1229 an IP address range. (Normal iptables only matches on single addresses
1230 with an optional mask.)
1234 config NETFILTER_XT_MATCH_IPVS
1235 tristate '"ipvs" match support'
1237 depends on NETFILTER_ADVANCED
1238 depends on NF_CONNTRACK
1240 This option allows you to match against IPVS properties of a packet.
1244 config NETFILTER_XT_MATCH_L2TP
1245 tristate '"l2tp" match support'
1246 depends on NETFILTER_ADVANCED
1249 This option adds an "L2TP" match, which allows you to match against
1250 L2TP protocol header fields.
1252 To compile it as a module, choose M here. If unsure, say N.
1254 config NETFILTER_XT_MATCH_LENGTH
1255 tristate '"length" match support'
1256 depends on NETFILTER_ADVANCED
1258 This option allows you to match the length of a packet against a
1259 specific value or range of values.
1261 To compile it as a module, choose M here. If unsure, say N.
1263 config NETFILTER_XT_MATCH_LIMIT
1264 tristate '"limit" match support'
1265 depends on NETFILTER_ADVANCED
1267 limit matching allows you to control the rate at which a rule can be
1268 matched: mainly useful in combination with the LOG target ("LOG
1269 target support", below) and to avoid some Denial of Service attacks.
1271 To compile it as a module, choose M here. If unsure, say N.
1273 config NETFILTER_XT_MATCH_MAC
1274 tristate '"mac" address match support'
1275 depends on NETFILTER_ADVANCED
1277 MAC matching allows you to match packets based on the source
1278 Ethernet address of the packet.
1280 To compile it as a module, choose M here. If unsure, say N.
1282 config NETFILTER_XT_MATCH_MARK
1283 tristate '"mark" match support'
1284 depends on NETFILTER_ADVANCED
1285 select NETFILTER_XT_MARK
1287 This is a backwards-compat option for the user's convenience
1288 (e.g. when running oldconfig). It selects
1289 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1291 config NETFILTER_XT_MATCH_MULTIPORT
1292 tristate '"multiport" Multiple port match support'
1293 depends on NETFILTER_ADVANCED
1295 Multiport matching allows you to match TCP or UDP packets based on
1296 a series of source or destination ports: normally a rule can only
1297 match a single range of ports.
1299 To compile it as a module, choose M here. If unsure, say N.
1301 config NETFILTER_XT_MATCH_NFACCT
1302 tristate '"nfacct" match support'
1303 depends on NETFILTER_ADVANCED
1304 select NETFILTER_NETLINK_ACCT
1306 This option allows you to use the extended accounting through
1309 To compile it as a module, choose M here. If unsure, say N.
1311 config NETFILTER_XT_MATCH_OSF
1312 tristate '"osf" Passive OS fingerprint match'
1313 depends on NETFILTER_ADVANCED && NETFILTER_NETLINK
1315 This option selects the Passive OS Fingerprinting match module
1316 that allows to passively match the remote operating system by
1317 analyzing incoming TCP SYN packets.
1319 Rules and loading software can be downloaded from
1320 http://www.ioremap.net/projects/osf
1322 To compile it as a module, choose M here. If unsure, say N.
1324 config NETFILTER_XT_MATCH_OWNER
1325 tristate '"owner" match support'
1326 depends on NETFILTER_ADVANCED
1328 Socket owner matching allows you to match locally-generated packets
1329 based on who created the socket: the user or group. It is also
1330 possible to check whether a socket actually exists.
1332 config NETFILTER_XT_MATCH_POLICY
1333 tristate 'IPsec "policy" match support'
1335 default m if NETFILTER_ADVANCED=n
1337 Policy matching allows you to match packets based on the
1338 IPsec policy that was used during decapsulation/will
1339 be used during encapsulation.
1341 To compile it as a module, choose M here. If unsure, say N.
1343 config NETFILTER_XT_MATCH_PHYSDEV
1344 tristate '"physdev" match support'
1345 depends on BRIDGE && BRIDGE_NETFILTER
1346 depends on NETFILTER_ADVANCED
1348 Physdev packet matching matches against the physical bridge ports
1349 the IP packet arrived on or will leave by.
1351 To compile it as a module, choose M here. If unsure, say N.
1353 config NETFILTER_XT_MATCH_PKTTYPE
1354 tristate '"pkttype" packet type match support'
1355 depends on NETFILTER_ADVANCED
1357 Packet type matching allows you to match a packet by
1358 its "class", eg. BROADCAST, MULTICAST, ...
1361 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1363 To compile it as a module, choose M here. If unsure, say N.
1365 config NETFILTER_XT_MATCH_QUOTA
1366 tristate '"quota" match support'
1367 depends on NETFILTER_ADVANCED
1369 This option adds a `quota' match, which allows to match on a
1372 If you want to compile it as a module, say M here and read
1373 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1375 config NETFILTER_XT_MATCH_RATEEST
1376 tristate '"rateest" match support'
1377 depends on NETFILTER_ADVANCED
1378 select NETFILTER_XT_TARGET_RATEEST
1380 This option adds a `rateest' match, which allows to match on the
1381 rate estimated by the RATEEST target.
1383 To compile it as a module, choose M here. If unsure, say N.
1385 config NETFILTER_XT_MATCH_REALM
1386 tristate '"realm" match support'
1387 depends on NETFILTER_ADVANCED
1388 select IP_ROUTE_CLASSID
1390 This option adds a `realm' match, which allows you to use the realm
1391 key from the routing subsystem inside iptables.
1393 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1396 If you want to compile it as a module, say M here and read
1397 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1399 config NETFILTER_XT_MATCH_RECENT
1400 tristate '"recent" match support'
1401 depends on NETFILTER_ADVANCED
1403 This match is used for creating one or many lists of recently
1404 used addresses and then matching against that/those list(s).
1406 Short options are available by using 'iptables -m recent -h'
1407 Official Website: <http://snowman.net/projects/ipt_recent/>
1409 config NETFILTER_XT_MATCH_SCTP
1410 tristate '"sctp" protocol match support'
1411 depends on NETFILTER_ADVANCED
1414 With this option enabled, you will be able to use the
1415 `sctp' match in order to match on SCTP source/destination ports
1416 and SCTP chunk types.
1418 If you want to compile it as a module, say M here and read
1419 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
1421 config NETFILTER_XT_MATCH_SOCKET
1422 tristate '"socket" match support'
1423 depends on NETFILTER_XTABLES
1424 depends on NETFILTER_ADVANCED
1425 depends on !NF_CONNTRACK || NF_CONNTRACK
1426 depends on IPV6 || IPV6=n
1427 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1428 select NF_DEFRAG_IPV4
1429 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1431 This option adds a `socket' match, which can be used to match
1432 packets for which a TCP or UDP socket lookup finds a valid socket.
1433 It can be used in combination with the MARK target and policy
1434 routing to implement full featured non-locally bound sockets.
1436 To compile it as a module, choose M here. If unsure, say N.
1438 config NETFILTER_XT_MATCH_STATE
1439 tristate '"state" match support'
1440 depends on NF_CONNTRACK
1441 default m if NETFILTER_ADVANCED=n
1443 Connection state matching allows you to match packets based on their
1444 relationship to a tracked connection (ie. previous packets). This
1445 is a powerful tool for packet classification.
1447 To compile it as a module, choose M here. If unsure, say N.
1449 config NETFILTER_XT_MATCH_STATISTIC
1450 tristate '"statistic" match support'
1451 depends on NETFILTER_ADVANCED
1453 This option adds a `statistic' match, which allows you to match
1454 on packets periodically or randomly with a given percentage.
1456 To compile it as a module, choose M here. If unsure, say N.
1458 config NETFILTER_XT_MATCH_STRING
1459 tristate '"string" match support'
1460 depends on NETFILTER_ADVANCED
1462 select TEXTSEARCH_KMP
1463 select TEXTSEARCH_BM
1464 select TEXTSEARCH_FSM
1466 This option adds a `string' match, which allows you to look for
1467 pattern matchings in packets.
1469 To compile it as a module, choose M here. If unsure, say N.
1471 config NETFILTER_XT_MATCH_TCPMSS
1472 tristate '"tcpmss" match support'
1473 depends on NETFILTER_ADVANCED
1475 This option adds a `tcpmss' match, which allows you to examine the
1476 MSS value of TCP SYN packets, which control the maximum packet size
1477 for that connection.
1479 To compile it as a module, choose M here. If unsure, say N.
1481 config NETFILTER_XT_MATCH_TIME
1482 tristate '"time" match support'
1483 depends on NETFILTER_ADVANCED
1485 This option adds a "time" match, which allows you to match based on
1486 the packet arrival time (at the machine which netfilter is running)
1487 on) or departure time/date (for locally generated packets).
1489 If you say Y here, try `iptables -m time --help` for
1492 If you want to compile it as a module, say M here.
1495 config NETFILTER_XT_MATCH_U32
1496 tristate '"u32" match support'
1497 depends on NETFILTER_ADVANCED
1499 u32 allows you to extract quantities of up to 4 bytes from a packet,
1500 AND them with specified masks, shift them by specified amounts and
1501 test whether the results are in any of a set of specified ranges.
1502 The specification of what to extract is general enough to skip over
1503 headers with lengths stored in the packet, as in IP or TCP header
1506 Details and examples are in the kernel module source.
1508 endif # NETFILTER_XTABLES
1512 source "net/netfilter/ipset/Kconfig"
1514 source "net/netfilter/ipvs/Kconfig"