# SPDX-License-Identifier: GPL-2.0-onlymenu "Core Netfilter Configuration"	depends on INET && NETFILTER config NETFILTER_INGRESS	bool "Netfilter ingress support"	default y	select NET_INGRESS	help	  This allows you to classify packets from ingress using the Netfilter	  infrastructure. config NETFILTER_EGRESS	bool "Netfilter egress support"	default y	select NET_EGRESS	help	  This allows you to classify packets before transmission using the	  Netfilter infrastructure. config NETFILTER_SKIP_EGRESS	def_bool NETFILTER_EGRESS && (NET_CLS_ACT || IFB) config NETFILTER_NETLINK	bool config NETFILTER_FAMILY_BRIDGE	bool config NETFILTER_FAMILY_ARP	bool config NETFILTER_BPF_LINK	def_bool BPF_SYSCALL config NETFILTER_NETLINK_HOOK	tristate "Netfilter base hook dump support"	depends on NETFILTER_ADVANCED	depends on NF_TABLES	select NETFILTER_NETLINK	help	  If this option is enabled, the kernel will include support	  to list the base netfilter hooks via NFNETLINK.	  This is helpful for debugging. config NETFILTER_NETLINK_ACCT	tristate "Netfilter NFACCT over NFNETLINK interface"	depends on NETFILTER_ADVANCED	select NETFILTER_NETLINK	help	  If this option is enabled, the kernel will include support	  for extended accounting via NFNETLINK. config NETFILTER_NETLINK_QUEUE	tristate "Netfilter NFQUEUE over NFNETLINK interface"	depends on NETFILTER_ADVANCED	select NETFILTER_NETLINK	help	  If this option is enabled, the kernel will include support	  for queueing packets via NFNETLINK. config NETFILTER_NETLINK_LOG	tristate "Netfilter LOG over NFNETLINK interface"	default m if NETFILTER_ADVANCED=n	select NETFILTER_NETLINK	help	  If this option is enabled, the kernel will include support	  for logging packets via NFNETLINK. 	  This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,	  and is also scheduled to replace the old syslog-based ipt_LOG	  and ip6t_LOG modules. config NETFILTER_NETLINK_OSF	tristate "Netfilter OSF over NFNETLINK interface"	depends on NETFILTER_ADVANCED	select NETFILTER_NETLINK	help	  If this option is enabled, the kernel will include support	  for passive OS fingerprint via NFNETLINK. config NF_CONNTRACK	tristate "Netfilter connection tracking support"	default m if NETFILTER_ADVANCED=n	select NF_DEFRAG_IPV4	select NF_DEFRAG_IPV6 if IPV6 != n	help	  Connection tracking keeps a record of what packets have passed	  through your machine, in order to figure out how they are related	  into connections. 	  This is required to do Masquerading or other kinds of Network	  Address Translation.  It can also be used to enhance packet	  filtering (see `Connection state match support' below). 	  To compile it as a module, choose M here.  If unsure, say N. config NF_LOG_SYSLOG	tristate "Syslog packet logging"	default m if NETFILTER_ADVANCED=n	help	  This option enable support for packet logging via syslog.	  It supports IPv4, IPV6, ARP and common transport protocols such	  as TCP and UDP.	  This is a simpler but less flexible logging method compared to	  CONFIG_NETFILTER_NETLINK_LOG.	  If both are enabled the backend to use can be configured at run-time	  by means of per-address-family sysctl tunables. if NF_CONNTRACKconfig NETFILTER_CONNCOUNT	tristate config NF_CONNTRACK_MARK	bool  'Connection mark tracking support'	depends on NETFILTER_ADVANCED	help	  This option enables support for connection marks, used by the	  `CONNMARK' target and `connmark' match. Similar to the mark value	  of packets, but this mark value is kept in the conntrack session	  instead of the individual packets. config NF_CONNTRACK_SECMARK	bool  'Connection tracking security mark support'	depends on NETWORK_SECMARK	default y if NETFILTER_ADVANCED=n	help	  This option enables security markings to be applied to	  connections.  Typically they are copied to connections from	  packets using the CONNSECMARK target and copied back from	  connections to packets with the same target, with the packets	  being originally labeled via SECMARK. 	  If unsure, say 'N'. config NF_CONNTRACK_ZONES	bool  'Connection tracking zones'	depends on NETFILTER_ADVANCED	help	  This option enables support for connection tracking zones.	  Normally, each connection needs to have a unique system wide	  identity. Connection tracking zones allow to have multiple	  connections using the same identity, as long as they are	  contained in different zones. 	  If unsure, say `N'. config NF_CONNTRACK_PROCFS	bool "Supply CT list in procfs (OBSOLETE)"	depends on PROC_FS	help	This option enables for the list of known conntrack entries	to be shown in procfs under net/netfilter/nf_conntrack. This	is considered obsolete in favor of using the conntrack(8)	tool which uses Netlink. config NF_CONNTRACK_EVENTS	bool "Connection tracking events"	depends on NETFILTER_ADVANCED	help	  If this option is enabled, the connection tracking code will	  provide a notifier chain that can be used by other kernel code	  to get notified about changes in the connection tracking state. 	  If unsure, say `N'. config NF_CONNTRACK_TIMEOUT	bool  'Connection tracking timeout'	depends on NETFILTER_ADVANCED	help	  This option enables support for connection tracking timeout	  extension. This allows you to attach timeout policies to flow	  via the CT target. 	  If unsure, say `N'. config NF_CONNTRACK_TIMESTAMP	bool  'Connection tracking timestamping'	depends on NETFILTER_ADVANCED	help	  This option enables support for connection tracking timestamping.	  This allows you to store the flow start-time and to obtain	  the flow-stop time (once it has been destroyed) via Connection	  tracking events. 	  If unsure, say `N'. config NF_CONNTRACK_LABELS	bool "Connection tracking labels"	help	  This option enables support for assigning user-defined flag bits	  to connection tracking entries.  It can be used with xtables connlabel	  match and the nftables ct expression. config NF_CONNTRACK_OVS	bool config NF_CT_PROTO_GRE	bool config NF_CT_PROTO_SCTP	bool 'SCTP protocol connection tracking support'	depends on NETFILTER_ADVANCED	default y	select NET_CRC32C	help	  With this option enabled, the layer 3 independent connection	  tracking code will be able to do state tracking on SCTP connections. 	  If unsure, say Y. config NF_CONNTRACK_AMANDA	tristate "Amanda backup protocol support"	depends on NETFILTER_ADVANCED	select TEXTSEARCH	select TEXTSEARCH_KMP	help	  If you are running the Amanda backup package <http://www.amanda.org/>	  on this machine or machines that will be MASQUERADED through this	  machine, then you may want to enable this feature.  This allows the	  connection tracking and natting code to allow the sub-channels that	  Amanda requires for communication of the backup data, messages and	  index. 	  To compile it as a module, choose M here.  If unsure, say N. config NF_CONNTRACK_FTP	tristate "FTP protocol support"	default m if NETFILTER_ADVANCED=n	help	  Tracking FTP connections is problematic: special helpers are	  required for tracking them, and doing masquerading and other forms	  of Network Address Translation on them. 	  This is FTP support on Layer 3 independent connection tracking. 	  To compile it as a module, choose M here.  If unsure, say N. config NF_CONNTRACK_H323	tristate "H.323 protocol support"	depends on NETFILTER_ADVANCED	help	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most	  important VoIP protocols, it is widely used by voice hardware and	  software including voice gateways, IP phones, Netmeeting, OpenPhone,	  Gnomemeeting, etc. 	  With this module you can support H.323 on a connection tracking/NAT	  firewall. 	  This module supports RAS, Fast Start, H.245 Tunnelling, Call	  Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,	  whiteboard, file transfer, etc. For more information, please	  visit http://nath323.sourceforge.net/. 	  To compile it as a module, choose M here.  If unsure, say N. config NF_CONNTRACK_IRC	tristate "IRC DCC protocol support (obsolete)"	help	  There is a commonly-used extension to IRC called	  Direct Client-to-Client Protocol (DCC).  This enables users to send	  files to each other, and also chat to each other without the need	  of a server.  DCC Sending is used anywhere you send files over IRC,	  and DCC Chat is most commonly used by Eggdrop bots.  If you are	  using NAT, this extension will enable you to send files and initiate	  chats.  Note that you do NOT need this extension to get files or	  have others initiate chats, or everything else in IRC.	  DCC tracking behind NAT requires plaintext (unencrypted) IRC, so	  this helper is of limited use these days. 	  To compile it as a module, choose M here.  If unsure, say N. config NF_CONNTRACK_BROADCAST	tristate config NF_CONNTRACK_NETBIOS_NS	tristate "NetBIOS name service protocol support"	select NF_CONNTRACK_BROADCAST	help	  NetBIOS name service requests are sent as broadcast messages from an	  unprivileged port and responded to with unicast messages to the	  same port. This make them hard to firewall properly because connection	  tracking doesn't deal with broadcasts. This helper tracks locally	  originating NetBIOS name service requests and the corresponding	  responses. It relies on correct IP address configuration, specifically	  netmask and broadcast address. When properly configured, the output	  of "ip address show" should look similar to this: 	  $ ip -4 address show eth0	  4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000	      inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 	  To compile it as a module, choose M here.  If unsure, say N. config NF_CONNTRACK_SNMP	tristate "SNMP service protocol support"	depends on NETFILTER_ADVANCED	select NF_CONNTRACK_BROADCAST	help	  SNMP service requests are sent as broadcast messages from an	  unprivileged port and responded to with unicast messages to the	  same port. This make them hard to firewall properly because connection	  tracking doesn't deal with broadcasts. This helper tracks locally	  originating SNMP service requests and the corresponding	  responses. It relies on correct IP address configuration, specifically	  netmask and broadcast address. 	  To compile it as a module, choose M here.  If unsure, say N. config NF_CONNTRACK_PPTP	tristate "PPtP protocol support (deprecated)"	depends on NETFILTER_ADVANCED	select NF_CT_PROTO_GRE	help	  This module adds support for PPTP (Point to Point Tunnelling	  Protocol, RFC2637) connection tracking and NAT. 	  If you are still running PPTP sessions over a stateful firewall or NAT	  box, you may want to enable this feature. 	  Please note that not all PPTP modes of operation are supported.	  Specifically these limitations exist:	    - Blindly assumes that control connections are always established	      in PNS->PAC direction. This is a violation of RFC2637.	    - Only supports a single call within each session 	  To compile it as a module, choose M here.  If unsure, say N. config NF_CONNTRACK_SANE	tristate "SANE protocol support"	depends on NETFILTER_ADVANCED	help	  SANE is a protocol for remote access to scanners as implemented	  by the 'saned' daemon. Like FTP, it uses separate control and	  data connections. 	  With this module you can support SANE on a connection tracking	  firewall. 	  To compile it as a module, choose M here.  If unsure, say N. config NF_CONNTRACK_SIP	tristate "SIP protocol support"	default m if NETFILTER_ADVANCED=n	help	  SIP is an application-layer control protocol that can establish,	  modify, and terminate multimedia sessions (conferences) such as	  Internet telephony calls. With the nf_conntrack_sip and	  the nf_nat_sip modules you can support the protocol on a connection	  tracking/NATing firewall. 	  To compile it as a module, choose M here.  If unsure, say N. config NF_CONNTRACK_TFTP	tristate "TFTP protocol support"	depends on NETFILTER_ADVANCED	help	  TFTP connection tracking helper, this is required depending	  on how restrictive your ruleset is.	  If you are using a tftp client behind -j SNAT or -j MASQUERADING	  you will need this. 	  To compile it as a module, choose M here.  If unsure, say N. config NF_CT_NETLINK	tristate 'Connection tracking netlink interface'	select NETFILTER_NETLINK	default m if NETFILTER_ADVANCED=n	help	  This option enables support for a netlink-based userspace interface config NF_CT_NETLINK_TIMEOUT	tristate  'Connection tracking timeout tuning via Netlink'	select NETFILTER_NETLINK	depends on NETFILTER_ADVANCED	depends on NF_CONNTRACK_TIMEOUT	help	  This option enables support for connection tracking timeout	  fine-grain tuning. This allows you to attach specific timeout	  policies to flows, instead of using the global timeout policy. 	  If unsure, say `N'. config NF_CT_NETLINK_HELPER	tristate 'Connection tracking helpers in user-space via Netlink'	select NETFILTER_NETLINK	depends on NF_CT_NETLINK	depends on NETFILTER_NETLINK_QUEUE	depends on NETFILTER_NETLINK_GLUE_CT	depends on NETFILTER_ADVANCED	help	  This option enables the user-space connection tracking helpers	  infrastructure. 	  If unsure, say `N'. config NETFILTER_NETLINK_GLUE_CT	bool "NFQUEUE and NFLOG integration with Connection Tracking"	default n	depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK	help	  If this option is enabled, NFQUEUE and NFLOG can include	  Connection Tracking information together with the packet is	  the enqueued via NFNETLINK. config NF_NAT	tristate "Network Address Translation support"	depends on NF_CONNTRACK	default m if NETFILTER_ADVANCED=n	help	  The NAT option allows masquerading, port forwarding and other	  forms of full Network Address Port Translation. This can be	  controlled by iptables, ip6tables or nft. config NF_NAT_AMANDA	tristate	depends on NF_CONNTRACK && NF_NAT	default NF_NAT && NF_CONNTRACK_AMANDA config NF_NAT_FTP	tristate	depends on NF_CONNTRACK && NF_NAT	default NF_NAT && NF_CONNTRACK_FTP config NF_NAT_IRC	tristate	depends on NF_CONNTRACK && NF_NAT	default NF_NAT && NF_CONNTRACK_IRC config NF_NAT_SIP	tristate	depends on NF_CONNTRACK && NF_NAT	default NF_NAT && NF_CONNTRACK_SIP config NF_NAT_TFTP	tristate	depends on NF_CONNTRACK && NF_NAT	default NF_NAT && NF_CONNTRACK_TFTP config NF_NAT_REDIRECT	bool config NF_NAT_MASQUERADE	bool config NF_NAT_OVS	bool config NETFILTER_SYNPROXY	tristate endif # NF_CONNTRACK config NF_TABLES	select NETFILTER_NETLINK	select NET_CRC32C	tristate "Netfilter nf_tables support"	help	  nftables is the new packet classification framework that intends to	  replace the existing {ip,ip6,arp,eb}_tables infrastructure. It	  provides a pseudo-state machine with an extensible instruction-set	  (also known as expressions) that the userspace 'nft' utility	  (https://www.netfilter.org/projects/nftables) uses to build the	  rule-set. It also comes with the generic set infrastructure that	  allows you to construct mappings between matchings and actions	  for performance lookups. 	  To compile it as a module, choose M here. if NF_TABLESconfig NF_TABLES_INET	depends on IPV6	select NF_TABLES_IPV4	select NF_TABLES_IPV6	bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"	help	  This option enables support for a mixed IPv4/IPv6 "inet" table. config NF_TABLES_NETDEV	bool "Netfilter nf_tables netdev tables support"	help	  This option enables support for the "netdev" table. config NFT_NUMGEN	tristate "Netfilter nf_tables number generator module"	help	  This option adds the number generator expression used to perform	  incremental counting and random numbers bound to a upper limit. config NFT_CT	depends on NF_CONNTRACK	tristate "Netfilter nf_tables conntrack module"	help	  This option adds the "ct" expression that you can use to match	  connection tracking information such as the flow state. config NFT_EXTHDR_DCCP	bool "Netfilter nf_tables exthdr DCCP support (DEPRECATED)"	default n

Lines 1–500 of 1664. Load more