1menu "Core Netfilter Configuration" 2 depends on NET && INET && NETFILTER 3 4config NETFILTER_NETLINK 5 tristate 6 7config NETFILTER_NETLINK_ACCT 8tristate "Netfilter NFACCT over NFNETLINK interface" 9 depends on NETFILTER_ADVANCED 10 select NETFILTER_NETLINK 11 help 12 If this option is enabled, the kernel will include support 13 for extended accounting via NFNETLINK. 14 15config NETFILTER_NETLINK_QUEUE 16 tristate "Netfilter NFQUEUE over NFNETLINK interface" 17 depends on NETFILTER_ADVANCED 18 select NETFILTER_NETLINK 19 help 20 If this option is enabled, the kernel will include support 21 for queueing packets via NFNETLINK. 22 23config NETFILTER_NETLINK_LOG 24 tristate "Netfilter LOG over NFNETLINK interface" 25 default m if NETFILTER_ADVANCED=n 26 select NETFILTER_NETLINK 27 help 28 If this option is enabled, the kernel will include support 29 for logging packets via NFNETLINK. 30 31 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms, 32 and is also scheduled to replace the old syslog-based ipt_LOG 33 and ip6t_LOG modules. 34 35config NF_CONNTRACK 36 tristate "Netfilter connection tracking support" 37 default m if NETFILTER_ADVANCED=n 38 help 39 Connection tracking keeps a record of what packets have passed 40 through your machine, in order to figure out how they are related 41 into connections. 42 43 This is required to do Masquerading or other kinds of Network 44 Address Translation. It can also be used to enhance packet 45 filtering (see `Connection state match support' below). 46 47 To compile it as a module, choose M here. If unsure, say N. 48 49if NF_CONNTRACK 50 51config NF_CONNTRACK_MARK 52 bool 'Connection mark tracking support' 53 depends on NETFILTER_ADVANCED 54 help 55 This option enables support for connection marks, used by the 56 `CONNMARK' target and `connmark' match. Similar to the mark value 57 of packets, but this mark value is kept in the conntrack session 58 instead of the individual packets. 59 60config NF_CONNTRACK_SECMARK 61 bool 'Connection tracking security mark support' 62 depends on NETWORK_SECMARK 63 default m if NETFILTER_ADVANCED=n 64 help 65 This option enables security markings to be applied to 66 connections. Typically they are copied to connections from 67 packets using the CONNSECMARK target and copied back from 68 connections to packets with the same target, with the packets 69 being originally labeled via SECMARK. 70 71 If unsure, say 'N'. 72 73config NF_CONNTRACK_ZONES 74 bool 'Connection tracking zones' 75 depends on NETFILTER_ADVANCED 76 depends on NETFILTER_XT_TARGET_CT 77 help 78 This option enables support for connection tracking zones. 79 Normally, each connection needs to have a unique system wide 80 identity. Connection tracking zones allow to have multiple 81 connections using the same identity, as long as they are 82 contained in different zones. 83 84 If unsure, say `N'. 85 86config NF_CONNTRACK_PROCFS 87 bool "Supply CT list in procfs (OBSOLETE)" 88 default y 89 depends on PROC_FS 90 ---help--- 91 This option enables for the list of known conntrack entries 92 to be shown in procfs under net/netfilter/nf_conntrack. This 93 is considered obsolete in favor of using the conntrack(8) 94 tool which uses Netlink. 95 96config NF_CONNTRACK_EVENTS 97 bool "Connection tracking events" 98 depends on NETFILTER_ADVANCED 99 help 100 If this option is enabled, the connection tracking code will 101 provide a notifier chain that can be used by other kernel code 102 to get notified about changes in the connection tracking state. 103 104 If unsure, say `N'. 105 106config NF_CONNTRACK_TIMEOUT 107 bool 'Connection tracking timeout' 108 depends on NETFILTER_ADVANCED 109 help 110 This option enables support for connection tracking timeout 111 extension. This allows you to attach timeout policies to flow 112 via the CT target. 113 114 If unsure, say `N'. 115 116config NF_CONNTRACK_TIMESTAMP 117 bool 'Connection tracking timestamping' 118 depends on NETFILTER_ADVANCED 119 help 120 This option enables support for connection tracking timestamping. 121 This allows you to store the flow start-time and to obtain 122 the flow-stop time (once it has been destroyed) via Connection 123 tracking events. 124 125 If unsure, say `N'. 126 127config NF_CONNTRACK_LABELS 128 bool 129 help 130 This option enables support for assigning user-defined flag bits 131 to connection tracking entries. It selected by the connlabel match. 132 133config NF_CT_PROTO_DCCP 134 tristate 'DCCP protocol connection tracking support' 135 depends on NETFILTER_ADVANCED 136 default IP_DCCP 137 help 138 With this option enabled, the layer 3 independent connection 139 tracking code will be able to do state tracking on DCCP connections. 140 141 If unsure, say 'N'. 142 143config NF_CT_PROTO_GRE 144 tristate 145 146config NF_CT_PROTO_SCTP 147 tristate 'SCTP protocol connection tracking support' 148 depends on NETFILTER_ADVANCED 149 default IP_SCTP 150 help 151 With this option enabled, the layer 3 independent connection 152 tracking code will be able to do state tracking on SCTP connections. 153 154 If you want to compile it as a module, say M here and read 155 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 156 157config NF_CT_PROTO_UDPLITE 158 tristate 'UDP-Lite protocol connection tracking support' 159 depends on NETFILTER_ADVANCED 160 help 161 With this option enabled, the layer 3 independent connection 162 tracking code will be able to do state tracking on UDP-Lite 163 connections. 164 165 To compile it as a module, choose M here. If unsure, say N. 166 167config NF_CONNTRACK_AMANDA 168 tristate "Amanda backup protocol support" 169 depends on NETFILTER_ADVANCED 170 select TEXTSEARCH 171 select TEXTSEARCH_KMP 172 help 173 If you are running the Amanda backup package <http://www.amanda.org/> 174 on this machine or machines that will be MASQUERADED through this 175 machine, then you may want to enable this feature. This allows the 176 connection tracking and natting code to allow the sub-channels that 177 Amanda requires for communication of the backup data, messages and 178 index. 179 180 To compile it as a module, choose M here. If unsure, say N. 181 182config NF_CONNTRACK_FTP 183 tristate "FTP protocol support" 184 default m if NETFILTER_ADVANCED=n 185 help 186 Tracking FTP connections is problematic: special helpers are 187 required for tracking them, and doing masquerading and other forms 188 of Network Address Translation on them. 189 190 This is FTP support on Layer 3 independent connection tracking. 191 Layer 3 independent connection tracking is experimental scheme 192 which generalize ip_conntrack to support other layer 3 protocols. 193 194 To compile it as a module, choose M here. If unsure, say N. 195 196config NF_CONNTRACK_H323 197 tristate "H.323 protocol support" 198 depends on IPV6 || IPV6=n 199 depends on NETFILTER_ADVANCED 200 help 201 H.323 is a VoIP signalling protocol from ITU-T. As one of the most 202 important VoIP protocols, it is widely used by voice hardware and 203 software including voice gateways, IP phones, Netmeeting, OpenPhone, 204 Gnomemeeting, etc. 205 206 With this module you can support H.323 on a connection tracking/NAT 207 firewall. 208 209 This module supports RAS, Fast Start, H.245 Tunnelling, Call 210 Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat, 211 whiteboard, file transfer, etc. For more information, please 212 visit http://nath323.sourceforge.net/. 213 214 To compile it as a module, choose M here. If unsure, say N. 215 216config NF_CONNTRACK_IRC 217 tristate "IRC protocol support" 218 default m if NETFILTER_ADVANCED=n 219 help 220 There is a commonly-used extension to IRC called 221 Direct Client-to-Client Protocol (DCC). This enables users to send 222 files to each other, and also chat to each other without the need 223 of a server. DCC Sending is used anywhere you send files over IRC, 224 and DCC Chat is most commonly used by Eggdrop bots. If you are 225 using NAT, this extension will enable you to send files and initiate 226 chats. Note that you do NOT need this extension to get files or 227 have others initiate chats, or everything else in IRC. 228 229 To compile it as a module, choose M here. If unsure, say N. 230 231config NF_CONNTRACK_BROADCAST 232 tristate 233 234config NF_CONNTRACK_NETBIOS_NS 235 tristate "NetBIOS name service protocol support" 236 select NF_CONNTRACK_BROADCAST 237 help 238 NetBIOS name service requests are sent as broadcast messages from an 239 unprivileged port and responded to with unicast messages to the 240 same port. This make them hard to firewall properly because connection 241 tracking doesn't deal with broadcasts. This helper tracks locally 242 originating NetBIOS name service requests and the corresponding 243 responses. It relies on correct IP address configuration, specifically 244 netmask and broadcast address. When properly configured, the output 245 of "ip address show" should look similar to this: 246 247 $ ip -4 address show eth0 248 4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 249 inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0 250 251 To compile it as a module, choose M here. If unsure, say N. 252 253config NF_CONNTRACK_SNMP 254 tristate "SNMP service protocol support" 255 depends on NETFILTER_ADVANCED 256 select NF_CONNTRACK_BROADCAST 257 help 258 SNMP service requests are sent as broadcast messages from an 259 unprivileged port and responded to with unicast messages to the 260 same port. This make them hard to firewall properly because connection 261 tracking doesn't deal with broadcasts. This helper tracks locally 262 originating SNMP service requests and the corresponding 263 responses. It relies on correct IP address configuration, specifically 264 netmask and broadcast address. 265 266 To compile it as a module, choose M here. If unsure, say N. 267 268config NF_CONNTRACK_PPTP 269 tristate "PPtP protocol support" 270 depends on NETFILTER_ADVANCED 271 select NF_CT_PROTO_GRE 272 help 273 This module adds support for PPTP (Point to Point Tunnelling 274 Protocol, RFC2637) connection tracking and NAT. 275 276 If you are running PPTP sessions over a stateful firewall or NAT 277 box, you may want to enable this feature. 278 279 Please note that not all PPTP modes of operation are supported yet. 280 Specifically these limitations exist: 281 - Blindly assumes that control connections are always established 282 in PNS->PAC direction. This is a violation of RFC2637. 283 - Only supports a single call within each session 284 285 To compile it as a module, choose M here. If unsure, say N. 286 287config NF_CONNTRACK_SANE 288 tristate "SANE protocol support" 289 depends on NETFILTER_ADVANCED 290 help 291 SANE is a protocol for remote access to scanners as implemented 292 by the 'saned' daemon. Like FTP, it uses separate control and 293 data connections. 294 295 With this module you can support SANE on a connection tracking 296 firewall. 297 298 To compile it as a module, choose M here. If unsure, say N. 299 300config NF_CONNTRACK_SIP 301 tristate "SIP protocol support" 302 default m if NETFILTER_ADVANCED=n 303 help 304 SIP is an application-layer control protocol that can establish, 305 modify, and terminate multimedia sessions (conferences) such as 306 Internet telephony calls. With the ip_conntrack_sip and 307 the nf_nat_sip modules you can support the protocol on a connection 308 tracking/NATing firewall. 309 310 To compile it as a module, choose M here. If unsure, say N. 311 312config NF_CONNTRACK_TFTP 313 tristate "TFTP protocol support" 314 depends on NETFILTER_ADVANCED 315 help 316 TFTP connection tracking helper, this is required depending 317 on how restrictive your ruleset is. 318 If you are using a tftp client behind -j SNAT or -j MASQUERADING 319 you will need this. 320 321 To compile it as a module, choose M here. If unsure, say N. 322 323config NF_CT_NETLINK 324 tristate 'Connection tracking netlink interface' 325 select NETFILTER_NETLINK 326 default m if NETFILTER_ADVANCED=n 327 help 328 This option enables support for a netlink-based userspace interface 329 330config NF_CT_NETLINK_TIMEOUT 331 tristate 'Connection tracking timeout tuning via Netlink' 332 select NETFILTER_NETLINK 333 depends on NETFILTER_ADVANCED 334 help 335 This option enables support for connection tracking timeout 336 fine-grain tuning. This allows you to attach specific timeout 337 policies to flows, instead of using the global timeout policy. 338 339 If unsure, say `N'. 340 341config NF_CT_NETLINK_HELPER 342 tristate 'Connection tracking helpers in user-space via Netlink' 343 select NETFILTER_NETLINK 344 depends on NF_CT_NETLINK 345 depends on NETFILTER_NETLINK_QUEUE 346 depends on NETFILTER_NETLINK_QUEUE_CT 347 depends on NETFILTER_ADVANCED 348 help 349 This option enables the user-space connection tracking helpers 350 infrastructure. 351 352 If unsure, say `N'. 353 354config NETFILTER_NETLINK_QUEUE_CT 355 bool "NFQUEUE integration with Connection Tracking" 356 default n 357 depends on NETFILTER_NETLINK_QUEUE 358 help 359 If this option is enabled, NFQUEUE can include Connection Tracking 360 information together with the packet is the enqueued via NFNETLINK. 361 362config NF_NAT 363 tristate 364 365config NF_NAT_NEEDED 366 bool 367 depends on NF_NAT 368 default y 369 370config NF_NAT_PROTO_DCCP 371 tristate 372 depends on NF_NAT && NF_CT_PROTO_DCCP 373 default NF_NAT && NF_CT_PROTO_DCCP 374 375config NF_NAT_PROTO_UDPLITE 376 tristate 377 depends on NF_NAT && NF_CT_PROTO_UDPLITE 378 default NF_NAT && NF_CT_PROTO_UDPLITE 379 380config NF_NAT_PROTO_SCTP 381 tristate 382 default NF_NAT && NF_CT_PROTO_SCTP 383 depends on NF_NAT && NF_CT_PROTO_SCTP 384 select LIBCRC32C 385 386config NF_NAT_AMANDA 387 tristate 388 depends on NF_CONNTRACK && NF_NAT 389 default NF_NAT && NF_CONNTRACK_AMANDA 390 391config NF_NAT_FTP 392 tristate 393 depends on NF_CONNTRACK && NF_NAT 394 default NF_NAT && NF_CONNTRACK_FTP 395 396config NF_NAT_IRC 397 tristate 398 depends on NF_CONNTRACK && NF_NAT 399 default NF_NAT && NF_CONNTRACK_IRC 400 401config NF_NAT_SIP 402 tristate 403 depends on NF_CONNTRACK && NF_NAT 404 default NF_NAT && NF_CONNTRACK_SIP 405 406config NF_NAT_TFTP 407 tristate 408 depends on NF_CONNTRACK && NF_NAT 409 default NF_NAT && NF_CONNTRACK_TFTP 410 411endif # NF_CONNTRACK 412 413# transparent proxy support 414config NETFILTER_TPROXY 415 tristate "Transparent proxying support" 416 depends on IP_NF_MANGLE 417 depends on NETFILTER_ADVANCED 418 help 419 This option enables transparent proxying support, that is, 420 support for handling non-locally bound IPv4 TCP and UDP sockets. 421 For it to work you will have to configure certain iptables rules 422 and use policy routing. For more information on how to set it up 423 see Documentation/networking/tproxy.txt. 424 425 To compile it as a module, choose M here. If unsure, say N. 426 427config NETFILTER_XTABLES 428 tristate "Netfilter Xtables support (required for ip_tables)" 429 default m if NETFILTER_ADVANCED=n 430 help 431 This is required if you intend to use any of ip_tables, 432 ip6_tables or arp_tables. 433 434if NETFILTER_XTABLES 435 436comment "Xtables combined modules" 437 438config NETFILTER_XT_MARK 439 tristate 'nfmark target and match support' 440 default m if NETFILTER_ADVANCED=n 441 ---help--- 442 This option adds the "MARK" target and "mark" match. 443 444 Netfilter mark matching allows you to match packets based on the 445 "nfmark" value in the packet. 446 The target allows you to create rules in the "mangle" table which alter 447 the netfilter mark (nfmark) field associated with the packet. 448 449 Prior to routing, the nfmark can influence the routing method (see 450 "Use netfilter MARK value as routing key") and can also be used by 451 other subsystems to change their behavior. 452 453config NETFILTER_XT_CONNMARK 454 tristate 'ctmark target and match support' 455 depends on NF_CONNTRACK 456 depends on NETFILTER_ADVANCED 457 select NF_CONNTRACK_MARK 458 ---help--- 459 This option adds the "CONNMARK" target and "connmark" match. 460 461 Netfilter allows you to store a mark value per connection (a.k.a. 462 ctmark), similarly to the packet mark (nfmark). Using this 463 target and match, you can set and match on this mark. 464 465config NETFILTER_XT_SET 466 tristate 'set target and match support' 467 depends on IP_SET 468 depends on NETFILTER_ADVANCED 469 help 470 This option adds the "SET" target and "set" match. 471 472 Using this target and match, you can add/delete and match 473 elements in the sets created by ipset(8). 474 475 To compile it as a module, choose M here. If unsure, say N. 476 477# alphabetically ordered list of targets 478 479comment "Xtables targets" 480 481config NETFILTER_XT_TARGET_AUDIT 482 tristate "AUDIT target support" 483 depends on AUDIT 484 depends on NETFILTER_ADVANCED 485 ---help--- 486 This option adds a 'AUDIT' target, which can be used to create 487 audit records for packets dropped/accepted. 488 489 To compileit as a module, choose M here. If unsure, say N. 490 491config NETFILTER_XT_TARGET_CHECKSUM 492 tristate "CHECKSUM target support" 493 depends on IP_NF_MANGLE || IP6_NF_MANGLE 494 depends on NETFILTER_ADVANCED 495 ---help--- 496 This option adds a `CHECKSUM' target, which can be used in the iptables mangle 497 table. 498 499 You can use this target to compute and fill in the checksum in 500 a packet that lacks a checksum. This is particularly useful, 501 if you need to work around old applications such as dhcp clients, 502 that do not work well with checksum offloads, but don't want to disable 503 checksum offload in your device. 504 505 To compile it as a module, choose M here. If unsure, say N. 506 507config NETFILTER_XT_TARGET_CLASSIFY 508 tristate '"CLASSIFY" target support' 509 depends on NETFILTER_ADVANCED 510 help 511 This option adds a `CLASSIFY' target, which enables the user to set 512 the priority of a packet. Some qdiscs can use this value for 513 classification, among these are: 514 515 atm, cbq, dsmark, pfifo_fast, htb, prio 516 517 To compile it as a module, choose M here. If unsure, say N. 518 519config NETFILTER_XT_TARGET_CONNMARK 520 tristate '"CONNMARK" target support' 521 depends on NF_CONNTRACK 522 depends on NETFILTER_ADVANCED 523 select NETFILTER_XT_CONNMARK 524 ---help--- 525 This is a backwards-compat option for the user's convenience 526 (e.g. when running oldconfig). It selects 527 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 528 529config NETFILTER_XT_TARGET_CONNSECMARK 530 tristate '"CONNSECMARK" target support' 531 depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK 532 default m if NETFILTER_ADVANCED=n 533 help 534 The CONNSECMARK target copies security markings from packets 535 to connections, and restores security markings from connections 536 to packets (if the packets are not already marked). This would 537 normally be used in conjunction with the SECMARK target. 538 539 To compile it as a module, choose M here. If unsure, say N. 540 541config NETFILTER_XT_TARGET_CT 542 tristate '"CT" target support' 543 depends on NF_CONNTRACK 544 depends on IP_NF_RAW || IP6_NF_RAW 545 depends on NETFILTER_ADVANCED 546 help 547 This options adds a `CT' target, which allows to specify initial 548 connection tracking parameters like events to be delivered and 549 the helper to be used. 550 551 To compile it as a module, choose M here. If unsure, say N. 552 553config NETFILTER_XT_TARGET_DSCP 554 tristate '"DSCP" and "TOS" target support' 555 depends on IP_NF_MANGLE || IP6_NF_MANGLE 556 depends on NETFILTER_ADVANCED 557 help 558 This option adds a `DSCP' target, which allows you to manipulate 559 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 560 561 The DSCP field can have any value between 0x0 and 0x3f inclusive. 562 563 It also adds the "TOS" target, which allows you to create rules in 564 the "mangle" table which alter the Type Of Service field of an IPv4 565 or the Priority field of an IPv6 packet, prior to routing. 566 567 To compile it as a module, choose M here. If unsure, say N. 568 569config NETFILTER_XT_TARGET_HL 570 tristate '"HL" hoplimit target support' 571 depends on IP_NF_MANGLE || IP6_NF_MANGLE 572 depends on NETFILTER_ADVANCED 573 ---help--- 574 This option adds the "HL" (for IPv6) and "TTL" (for IPv4) 575 targets, which enable the user to change the 576 hoplimit/time-to-live value of the IP header. 577 578 While it is safe to decrement the hoplimit/TTL value, the 579 modules also allow to increment and set the hoplimit value of 580 the header to arbitrary values. This is EXTREMELY DANGEROUS 581 since you can easily create immortal packets that loop 582 forever on the network. 583 584config NETFILTER_XT_TARGET_HMARK 585 tristate '"HMARK" target support' 586 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 587 depends on NETFILTER_ADVANCED 588 ---help--- 589 This option adds the "HMARK" target. 590 591 The target allows you to create rules in the "raw" and "mangle" tables 592 which set the skbuff mark by means of hash calculation within a given 593 range. The nfmark can influence the routing method (see "Use netfilter 594 MARK value as routing key") and can also be used by other subsystems to 595 change their behaviour. 596 597 To compile it as a module, choose M here. If unsure, say N. 598 599config NETFILTER_XT_TARGET_IDLETIMER 600 tristate "IDLETIMER target support" 601 depends on NETFILTER_ADVANCED 602 help 603 604 This option adds the `IDLETIMER' target. Each matching packet 605 resets the timer associated with label specified when the rule is 606 added. When the timer expires, it triggers a sysfs notification. 607 The remaining time for expiration can be read via sysfs. 608 609 To compile it as a module, choose M here. If unsure, say N. 610 611config NETFILTER_XT_TARGET_LED 612 tristate '"LED" target support' 613 depends on LEDS_CLASS && LEDS_TRIGGERS 614 depends on NETFILTER_ADVANCED 615 help 616 This option adds a `LED' target, which allows you to blink LEDs in 617 response to particular packets passing through your machine. 618 619 This can be used to turn a spare LED into a network activity LED, 620 which only flashes in response to FTP transfers, for example. Or 621 you could have an LED which lights up for a minute or two every time 622 somebody connects to your machine via SSH. 623 624 You will need support for the "led" class to make this work. 625 626 To create an LED trigger for incoming SSH traffic: 627 iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000 628 629 Then attach the new trigger to an LED on your system: 630 echo netfilter-ssh > /sys/class/leds/<ledname>/trigger 631 632 For more information on the LEDs available on your system, see 633 Documentation/leds/leds-class.txt 634 635config NETFILTER_XT_TARGET_LOG 636 tristate "LOG target support" 637 default m if NETFILTER_ADVANCED=n 638 help 639 This option adds a `LOG' target, which allows you to create rules in 640 any iptables table which records the packet header to the syslog. 641 642 To compile it as a module, choose M here. If unsure, say N. 643 644config NETFILTER_XT_TARGET_MARK 645 tristate '"MARK" target support' 646 depends on NETFILTER_ADVANCED 647 select NETFILTER_XT_MARK 648 ---help--- 649 This is a backwards-compat option for the user's convenience 650 (e.g. when running oldconfig). It selects 651 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 652 653config NETFILTER_XT_TARGET_NETMAP 654 tristate '"NETMAP" target support' 655 depends on NF_NAT 656 ---help--- 657 NETMAP is an implementation of static 1:1 NAT mapping of network 658 addresses. It maps the network address part, while keeping the host 659 address part intact. 660 661 To compile it as a module, choose M here. If unsure, say N. 662 663config NETFILTER_XT_TARGET_NFLOG 664 tristate '"NFLOG" target support' 665 default m if NETFILTER_ADVANCED=n 666 select NETFILTER_NETLINK_LOG 667 help 668 This option enables the NFLOG target, which allows to LOG 669 messages through nfnetlink_log. 670 671 To compile it as a module, choose M here. If unsure, say N. 672 673config NETFILTER_XT_TARGET_NFQUEUE 674 tristate '"NFQUEUE" target Support' 675 depends on NETFILTER_ADVANCED 676 select NETFILTER_NETLINK_QUEUE 677 help 678 This target replaced the old obsolete QUEUE target. 679 680 As opposed to QUEUE, it supports 65535 different queues, 681 not just one. 682 683 To compile it as a module, choose M here. If unsure, say N. 684 685config NETFILTER_XT_TARGET_NOTRACK 686 tristate '"NOTRACK" target support (DEPRECATED)' 687 depends on NF_CONNTRACK 688 depends on IP_NF_RAW || IP6_NF_RAW 689 depends on NETFILTER_ADVANCED 690 select NETFILTER_XT_TARGET_CT 691 692config NETFILTER_XT_TARGET_RATEEST 693 tristate '"RATEEST" target support' 694 depends on NETFILTER_ADVANCED 695 help 696 This option adds a `RATEEST' target, which allows to measure 697 rates similar to TC estimators. The `rateest' match can be 698 used to match on the measured rates. 699 700 To compile it as a module, choose M here. If unsure, say N. 701 702config NETFILTER_XT_TARGET_REDIRECT 703 tristate "REDIRECT target support" 704 depends on NF_NAT 705 ---help--- 706 REDIRECT is a special case of NAT: all incoming connections are 707 mapped onto the incoming interface's address, causing the packets to 708 come to the local machine instead of passing through. This is 709 useful for transparent proxies. 710 711 To compile it as a module, choose M here. If unsure, say N. 712 713config NETFILTER_XT_TARGET_TEE 714 tristate '"TEE" - packet cloning to alternate destination' 715 depends on NETFILTER_ADVANCED 716 depends on IPV6 || IPV6=n 717 depends on !NF_CONNTRACK || NF_CONNTRACK 718 ---help--- 719 This option adds a "TEE" target with which a packet can be cloned and 720 this clone be rerouted to another nexthop. 721 722config NETFILTER_XT_TARGET_TPROXY 723 tristate '"TPROXY" target support' 724 depends on NETFILTER_TPROXY 725 depends on NETFILTER_XTABLES 726 depends on NETFILTER_ADVANCED 727 depends on IPV6 || IPV6=n 728 select NF_DEFRAG_IPV4 729 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES 730 help 731 This option adds a `TPROXY' target, which is somewhat similar to 732 REDIRECT. It can only be used in the mangle table and is useful 733 to redirect traffic to a transparent proxy. It does _not_ depend 734 on Netfilter connection tracking and NAT, unlike REDIRECT. 735 736 To compile it as a module, choose M here. If unsure, say N. 737 738config NETFILTER_XT_TARGET_TRACE 739 tristate '"TRACE" target support' 740 depends on IP_NF_RAW || IP6_NF_RAW 741 depends on NETFILTER_ADVANCED 742 help 743 The TRACE target allows you to mark packets so that the kernel 744 will log every rule which match the packets as those traverse 745 the tables, chains, rules. 746 747 If you want to compile it as a module, say M here and read 748 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 749 750config NETFILTER_XT_TARGET_SECMARK 751 tristate '"SECMARK" target support' 752 depends on NETWORK_SECMARK 753 default m if NETFILTER_ADVANCED=n 754 help 755 The SECMARK target allows security marking of network 756 packets, for use with security subsystems. 757 758 To compile it as a module, choose M here. If unsure, say N. 759 760config NETFILTER_XT_TARGET_TCPMSS 761 tristate '"TCPMSS" target support' 762 depends on IPV6 || IPV6=n 763 default m if NETFILTER_ADVANCED=n 764 ---help--- 765 This option adds a `TCPMSS' target, which allows you to alter the 766 MSS value of TCP SYN packets, to control the maximum size for that 767 connection (usually limiting it to your outgoing interface's MTU 768 minus 40). 769 770 This is used to overcome criminally braindead ISPs or servers which 771 block ICMP Fragmentation Needed packets. The symptoms of this 772 problem are that everything works fine from your Linux 773 firewall/router, but machines behind it can never exchange large 774 packets: 775 1) Web browsers connect, then hang with no data received. 776 2) Small mail works fine, but large emails hang. 777 3) ssh works fine, but scp hangs after initial handshaking. 778 779 Workaround: activate this option and add a rule to your firewall 780 configuration like: 781 782 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ 783 -j TCPMSS --clamp-mss-to-pmtu 784 785 To compile it as a module, choose M here. If unsure, say N. 786 787config NETFILTER_XT_TARGET_TCPOPTSTRIP 788 tristate '"TCPOPTSTRIP" target support' 789 depends on IP_NF_MANGLE || IP6_NF_MANGLE 790 depends on NETFILTER_ADVANCED 791 help 792 This option adds a "TCPOPTSTRIP" target, which allows you to strip 793 TCP options from TCP packets. 794 795# alphabetically ordered list of matches 796 797comment "Xtables matches" 798 799config NETFILTER_XT_MATCH_ADDRTYPE 800 tristate '"addrtype" address type match support' 801 depends on NETFILTER_ADVANCED 802 ---help--- 803 This option allows you to match what routing thinks of an address, 804 eg. UNICAST, LOCAL, BROADCAST, ... 805 806 If you want to compile it as a module, say M here and read 807 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 808 809config NETFILTER_XT_MATCH_BPF 810 tristate '"bpf" match support' 811 depends on NETFILTER_ADVANCED 812 help 813 BPF matching applies a linux socket filter to each packet and 814 accepts those for which the filter returns non-zero. 815 816 To compile it as a module, choose M here. If unsure, say N. 817 818config NETFILTER_XT_MATCH_CLUSTER 819 tristate '"cluster" match support' 820 depends on NF_CONNTRACK 821 depends on NETFILTER_ADVANCED 822 ---help--- 823 This option allows you to build work-load-sharing clusters of 824 network servers/stateful firewalls without having a dedicated 825 load-balancing router/server/switch. Basically, this match returns 826 true when the packet must be handled by this cluster node. Thus, 827 all nodes see all packets and this match decides which node handles 828 what packets. The work-load sharing algorithm is based on source 829 address hashing. 830 831 If you say Y or M here, try `iptables -m cluster --help` for 832 more information. 833 834config NETFILTER_XT_MATCH_COMMENT 835 tristate '"comment" match support' 836 depends on NETFILTER_ADVANCED 837 help 838 This option adds a `comment' dummy-match, which allows you to put 839 comments in your iptables ruleset. 840 841 If you want to compile it as a module, say M here and read 842 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 843 844config NETFILTER_XT_MATCH_CONNBYTES 845 tristate '"connbytes" per-connection counter match support' 846 depends on NF_CONNTRACK 847 depends on NETFILTER_ADVANCED 848 help 849 This option adds a `connbytes' match, which allows you to match the 850 number of bytes and/or packets for each direction within a connection. 851 852 If you want to compile it as a module, say M here and read 853 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 854 855config NETFILTER_XT_MATCH_CONNLABEL 856 tristate '"connlabel" match support' 857 select NF_CONNTRACK_LABELS 858 depends on NF_CONNTRACK 859 depends on NETFILTER_ADVANCED 860 ---help--- 861 This match allows you to test and assign userspace-defined labels names 862 to a connection. The kernel only stores bit values - mapping 863 names to bits is done by userspace. 864 865 Unlike connmark, more than 32 flag bits may be assigned to a 866 connection simultaneously. 867 868config NETFILTER_XT_MATCH_CONNLIMIT 869 tristate '"connlimit" match support"' 870 depends on NF_CONNTRACK 871 depends on NETFILTER_ADVANCED 872 ---help--- 873 This match allows you to match against the number of parallel 874 connections to a server per client IP address (or address block). 875 876config NETFILTER_XT_MATCH_CONNMARK 877 tristate '"connmark" connection mark match support' 878 depends on NF_CONNTRACK 879 depends on NETFILTER_ADVANCED 880 select NETFILTER_XT_CONNMARK 881 ---help--- 882 This is a backwards-compat option for the user's convenience 883 (e.g. when running oldconfig). It selects 884 CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module). 885 886config NETFILTER_XT_MATCH_CONNTRACK 887 tristate '"conntrack" connection tracking match support' 888 depends on NF_CONNTRACK 889 default m if NETFILTER_ADVANCED=n 890 help 891 This is a general conntrack match module, a superset of the state match. 892 893 It allows matching on additional conntrack information, which is 894 useful in complex configurations, such as NAT gateways with multiple 895 internet links or tunnels. 896 897 To compile it as a module, choose M here. If unsure, say N. 898 899config NETFILTER_XT_MATCH_CPU 900 tristate '"cpu" match support' 901 depends on NETFILTER_ADVANCED 902 help 903 CPU matching allows you to match packets based on the CPU 904 currently handling the packet. 905 906 To compile it as a module, choose M here. If unsure, say N. 907 908config NETFILTER_XT_MATCH_DCCP 909 tristate '"dccp" protocol match support' 910 depends on NETFILTER_ADVANCED 911 default IP_DCCP 912 help 913 With this option enabled, you will be able to use the iptables 914 `dccp' match in order to match on DCCP source/destination ports 915 and DCCP flags. 916 917 If you want to compile it as a module, say M here and read 918 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 919 920config NETFILTER_XT_MATCH_DEVGROUP 921 tristate '"devgroup" match support' 922 depends on NETFILTER_ADVANCED 923 help 924 This options adds a `devgroup' match, which allows to match on the 925 device group a network device is assigned to. 926 927 To compile it as a module, choose M here. If unsure, say N. 928 929config NETFILTER_XT_MATCH_DSCP 930 tristate '"dscp" and "tos" match support' 931 depends on NETFILTER_ADVANCED 932 help 933 This option adds a `DSCP' match, which allows you to match against 934 the IPv4/IPv6 header DSCP field (differentiated services codepoint). 935 936 The DSCP field can have any value between 0x0 and 0x3f inclusive. 937 938 It will also add a "tos" match, which allows you to match packets 939 based on the Type Of Service fields of the IPv4 packet (which share 940 the same bits as DSCP). 941 942 To compile it as a module, choose M here. If unsure, say N. 943 944config NETFILTER_XT_MATCH_ECN 945 tristate '"ecn" match support' 946 depends on NETFILTER_ADVANCED 947 ---help--- 948 This option adds an "ECN" match, which allows you to match against 949 the IPv4 and TCP header ECN fields. 950 951 To compile it as a module, choose M here. If unsure, say N. 952 953config NETFILTER_XT_MATCH_ESP 954 tristate '"esp" match support' 955 depends on NETFILTER_ADVANCED 956 help 957 This match extension allows you to match a range of SPIs 958 inside ESP header of IPSec packets. 959 960 To compile it as a module, choose M here. If unsure, say N. 961 962config NETFILTER_XT_MATCH_HASHLIMIT 963 tristate '"hashlimit" match support' 964 depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n 965 depends on NETFILTER_ADVANCED 966 help 967 This option adds a `hashlimit' match. 968 969 As opposed to `limit', this match dynamically creates a hash table 970 of limit buckets, based on your selection of source/destination 971 addresses and/or ports. 972 973 It enables you to express policies like `10kpps for any given 974 destination address' or `500pps from any given source address' 975 with a single rule. 976 977config NETFILTER_XT_MATCH_HELPER 978 tristate '"helper" match support' 979 depends on NF_CONNTRACK 980 depends on NETFILTER_ADVANCED 981 help 982 Helper matching allows you to match packets in dynamic connections 983 tracked by a conntrack-helper, ie. ip_conntrack_ftp 984 985 To compile it as a module, choose M here. If unsure, say Y. 986 987config NETFILTER_XT_MATCH_HL 988 tristate '"hl" hoplimit/TTL match support' 989 depends on NETFILTER_ADVANCED 990 ---help--- 991 HL matching allows you to match packets based on the hoplimit 992 in the IPv6 header, or the time-to-live field in the IPv4 993 header of the packet. 994 995config NETFILTER_XT_MATCH_IPRANGE 996 tristate '"iprange" address range match support' 997 depends on NETFILTER_ADVANCED 998 ---help--- 999 This option adds a "iprange" match, which allows you to match based on 1000 an IP address range. (Normal iptables only matches on single addresses 1001 with an optional mask.) 1002 1003 If unsure, say M. 1004 1005config NETFILTER_XT_MATCH_IPVS 1006 tristate '"ipvs" match support' 1007 depends on IP_VS 1008 depends on NETFILTER_ADVANCED 1009 depends on NF_CONNTRACK 1010 help 1011 This option allows you to match against IPVS properties of a packet. 1012 1013 If unsure, say N. 1014 1015config NETFILTER_XT_MATCH_LENGTH 1016 tristate '"length" match support' 1017 depends on NETFILTER_ADVANCED 1018 help 1019 This option allows you to match the length of a packet against a 1020 specific value or range of values. 1021 1022 To compile it as a module, choose M here. If unsure, say N. 1023 1024config NETFILTER_XT_MATCH_LIMIT 1025 tristate '"limit" match support' 1026 depends on NETFILTER_ADVANCED 1027 help 1028 limit matching allows you to control the rate at which a rule can be 1029 matched: mainly useful in combination with the LOG target ("LOG 1030 target support", below) and to avoid some Denial of Service attacks. 1031 1032 To compile it as a module, choose M here. If unsure, say N. 1033 1034config NETFILTER_XT_MATCH_MAC 1035 tristate '"mac" address match support' 1036 depends on NETFILTER_ADVANCED 1037 help 1038 MAC matching allows you to match packets based on the source 1039 Ethernet address of the packet. 1040 1041 To compile it as a module, choose M here. If unsure, say N. 1042 1043config NETFILTER_XT_MATCH_MARK 1044 tristate '"mark" match support' 1045 depends on NETFILTER_ADVANCED 1046 select NETFILTER_XT_MARK 1047 ---help--- 1048 This is a backwards-compat option for the user's convenience 1049 (e.g. when running oldconfig). It selects 1050 CONFIG_NETFILTER_XT_MARK (combined mark/MARK module). 1051 1052config NETFILTER_XT_MATCH_MULTIPORT 1053 tristate '"multiport" Multiple port match support' 1054 depends on NETFILTER_ADVANCED 1055 help 1056 Multiport matching allows you to match TCP or UDP packets based on 1057 a series of source or destination ports: normally a rule can only 1058 match a single range of ports. 1059 1060 To compile it as a module, choose M here. If unsure, say N. 1061 1062config NETFILTER_XT_MATCH_NFACCT 1063 tristate '"nfacct" match support' 1064 depends on NETFILTER_ADVANCED 1065 select NETFILTER_NETLINK_ACCT 1066 help 1067 This option allows you to use the extended accounting through 1068 nfnetlink_acct. 1069 1070 To compile it as a module, choose M here. If unsure, say N. 1071 1072config NETFILTER_XT_MATCH_OSF 1073 tristate '"osf" Passive OS fingerprint match' 1074 depends on NETFILTER_ADVANCED && NETFILTER_NETLINK 1075 help 1076 This option selects the Passive OS Fingerprinting match module 1077 that allows to passively match the remote operating system by 1078 analyzing incoming TCP SYN packets. 1079 1080 Rules and loading software can be downloaded from 1081 http://www.ioremap.net/projects/osf 1082 1083 To compile it as a module, choose M here. If unsure, say N. 1084 1085config NETFILTER_XT_MATCH_OWNER 1086 tristate '"owner" match support' 1087 depends on NETFILTER_ADVANCED 1088 ---help--- 1089 Socket owner matching allows you to match locally-generated packets 1090 based on who created the socket: the user or group. It is also 1091 possible to check whether a socket actually exists. 1092 1093 Conflicts with '"quota, tag, uid" match' 1094 1095config NETFILTER_XT_MATCH_POLICY 1096 tristate 'IPsec "policy" match support' 1097 depends on XFRM 1098 default m if NETFILTER_ADVANCED=n 1099 help 1100 Policy matching allows you to match packets based on the 1101 IPsec policy that was used during decapsulation/will 1102 be used during encapsulation. 1103 1104 To compile it as a module, choose M here. If unsure, say N. 1105 1106config NETFILTER_XT_MATCH_PHYSDEV 1107 tristate '"physdev" match support' 1108 depends on BRIDGE && BRIDGE_NETFILTER 1109 depends on NETFILTER_ADVANCED 1110 help 1111 Physdev packet matching matches against the physical bridge ports 1112 the IP packet arrived on or will leave by. 1113 1114 To compile it as a module, choose M here. If unsure, say N. 1115 1116config NETFILTER_XT_MATCH_PKTTYPE 1117 tristate '"pkttype" packet type match support' 1118 depends on NETFILTER_ADVANCED 1119 help 1120 Packet type matching allows you to match a packet by 1121 its "class", eg. BROADCAST, MULTICAST, ... 1122 1123 Typical usage: 1124 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG 1125 1126 To compile it as a module, choose M here. If unsure, say N. 1127 1128config NETFILTER_XT_MATCH_QTAGUID 1129 bool '"quota, tag, owner" match and stats support' 1130 depends on NETFILTER_XT_MATCH_SOCKET 1131 depends on NETFILTER_XT_MATCH_OWNER=n 1132 help 1133 This option replaces the `owner' match. In addition to matching 1134 on uid, it keeps stats based on a tag assigned to a socket. 1135 The full tag is comprised of a UID and an accounting tag. 1136 The tags are assignable to sockets from user space (e.g. a download 1137 manager can assign the socket to another UID for accounting). 1138 Stats and control are done via /proc/net/xt_qtaguid/. 1139 It replaces owner as it takes the same arguments, but should 1140 really be recognized by the iptables tool. 1141 1142 If unsure, say `N'. 1143 1144config NETFILTER_XT_MATCH_QUOTA 1145 tristate '"quota" match support' 1146 depends on NETFILTER_ADVANCED 1147 help 1148 This option adds a `quota' match, which allows to match on a 1149 byte counter. 1150 1151 If you want to compile it as a module, say M here and read 1152 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1153 1154config NETFILTER_XT_MATCH_QUOTA2 1155 tristate '"quota2" match support' 1156 depends on NETFILTER_ADVANCED 1157 help 1158 This option adds a `quota2' match, which allows to match on a 1159 byte counter correctly and not per CPU. 1160 It allows naming the quotas. 1161 This is based on http://xtables-addons.git.sourceforge.net 1162 1163 If you want to compile it as a module, say M here and read 1164 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1165 1166config NETFILTER_XT_MATCH_QUOTA2_LOG 1167 bool '"quota2" Netfilter LOG support' 1168 depends on NETFILTER_XT_MATCH_QUOTA2 1169 depends on IP_NF_TARGET_ULOG=n # not yes, not module, just no 1170 default n 1171 help 1172 This option allows `quota2' to log ONCE when a quota limit 1173 is passed. It logs via NETLINK using the NETLINK_NFLOG family. 1174 It logs similarly to how ipt_ULOG would without data. 1175 1176 If unsure, say `N'. 1177 1178config NETFILTER_XT_MATCH_RATEEST 1179 tristate '"rateest" match support' 1180 depends on NETFILTER_ADVANCED 1181 select NETFILTER_XT_TARGET_RATEEST 1182 help 1183 This option adds a `rateest' match, which allows to match on the 1184 rate estimated by the RATEEST target. 1185 1186 To compile it as a module, choose M here. If unsure, say N. 1187 1188config NETFILTER_XT_MATCH_REALM 1189 tristate '"realm" match support' 1190 depends on NETFILTER_ADVANCED 1191 select IP_ROUTE_CLASSID 1192 help 1193 This option adds a `realm' match, which allows you to use the realm 1194 key from the routing subsystem inside iptables. 1195 1196 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 1197 in tc world. 1198 1199 If you want to compile it as a module, say M here and read 1200 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1201 1202config NETFILTER_XT_MATCH_RECENT 1203 tristate '"recent" match support' 1204 depends on NETFILTER_ADVANCED 1205 ---help--- 1206 This match is used for creating one or many lists of recently 1207 used addresses and then matching against that/those list(s). 1208 1209 Short options are available by using 'iptables -m recent -h' 1210 Official Website: <http://snowman.net/projects/ipt_recent/> 1211 1212config NETFILTER_XT_MATCH_SCTP 1213 tristate '"sctp" protocol match support' 1214 depends on NETFILTER_ADVANCED 1215 default IP_SCTP 1216 help 1217 With this option enabled, you will be able to use the 1218 `sctp' match in order to match on SCTP source/destination ports 1219 and SCTP chunk types. 1220 1221 If you want to compile it as a module, say M here and read 1222 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 1223 1224config NETFILTER_XT_MATCH_SOCKET 1225 tristate '"socket" match support' 1226 depends on NETFILTER_TPROXY 1227 depends on NETFILTER_XTABLES 1228 depends on NETFILTER_ADVANCED 1229 depends on !NF_CONNTRACK || NF_CONNTRACK 1230 depends on IPV6 || IPV6=n 1231 select NF_DEFRAG_IPV4 1232 select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES 1233 help 1234 This option adds a `socket' match, which can be used to match 1235 packets for which a TCP or UDP socket lookup finds a valid socket. 1236 It can be used in combination with the MARK target and policy 1237 routing to implement full featured non-locally bound sockets. 1238 1239 To compile it as a module, choose M here. If unsure, say N. 1240 1241config NETFILTER_XT_MATCH_STATE 1242 tristate '"state" match support' 1243 depends on NF_CONNTRACK 1244 default m if NETFILTER_ADVANCED=n 1245 help 1246 Connection state matching allows you to match packets based on their 1247 relationship to a tracked connection (ie. previous packets). This 1248 is a powerful tool for packet classification. 1249 1250 To compile it as a module, choose M here. If unsure, say N. 1251 1252config NETFILTER_XT_MATCH_STATISTIC 1253 tristate '"statistic" match support' 1254 depends on NETFILTER_ADVANCED 1255 help 1256 This option adds a `statistic' match, which allows you to match 1257 on packets periodically or randomly with a given percentage. 1258 1259 To compile it as a module, choose M here. If unsure, say N. 1260 1261config NETFILTER_XT_MATCH_STRING 1262 tristate '"string" match support' 1263 depends on NETFILTER_ADVANCED 1264 select TEXTSEARCH 1265 select TEXTSEARCH_KMP 1266 select TEXTSEARCH_BM 1267 select TEXTSEARCH_FSM 1268 help 1269 This option adds a `string' match, which allows you to look for 1270 pattern matchings in packets. 1271 1272 To compile it as a module, choose M here. If unsure, say N. 1273 1274config NETFILTER_XT_MATCH_TCPMSS 1275 tristate '"tcpmss" match support' 1276 depends on NETFILTER_ADVANCED 1277 help 1278 This option adds a `tcpmss' match, which allows you to examine the 1279 MSS value of TCP SYN packets, which control the maximum packet size 1280 for that connection. 1281 1282 To compile it as a module, choose M here. If unsure, say N. 1283 1284config NETFILTER_XT_MATCH_TIME 1285 tristate '"time" match support' 1286 depends on NETFILTER_ADVANCED 1287 ---help--- 1288 This option adds a "time" match, which allows you to match based on 1289 the packet arrival time (at the machine which netfilter is running) 1290 on) or departure time/date (for locally generated packets). 1291 1292 If you say Y here, try `iptables -m time --help` for 1293 more information. 1294 1295 If you want to compile it as a module, say M here. 1296 If unsure, say N. 1297 1298config NETFILTER_XT_MATCH_U32 1299 tristate '"u32" match support' 1300 depends on NETFILTER_ADVANCED 1301 ---help--- 1302 u32 allows you to extract quantities of up to 4 bytes from a packet, 1303 AND them with specified masks, shift them by specified amounts and 1304 test whether the results are in any of a set of specified ranges. 1305 The specification of what to extract is general enough to skip over 1306 headers with lengths stored in the packet, as in IP or TCP header 1307 lengths. 1308 1309 Details and examples are in the kernel module source. 1310 1311endif # NETFILTER_XTABLES 1312 1313endmenu 1314 1315source "net/netfilter/ipset/Kconfig" 1316 1317source "net/netfilter/ipvs/Kconfig" 1318