2 # Bridge netfilter configuration
5 config NF_TABLES_BRIDGE
6 tristate "Ethernet Bridge nf_tables support"
8 menuconfig BRIDGE_NF_EBTABLES
9 tristate "Ethernet Bridge tables (ebtables) support"
10 depends on BRIDGE && NETFILTER
11 select NETFILTER_XTABLES
13 ebtables is a general, extensible frame/packet identification
14 framework. Say 'Y' or 'M' here if you want to do Ethernet
15 filtering/NAT/brouting on the Ethernet bridge.
22 config BRIDGE_EBT_BROUTE
23 tristate "ebt: broute table support"
25 The ebtables broute table is used to define rules that decide between
26 bridging and routing frames, giving Linux the functionality of a
27 brouter. See the man page for ebtables(8) and examples on the ebtables
30 To compile it as a module, choose M here. If unsure, say N.
32 config BRIDGE_EBT_T_FILTER
33 tristate "ebt: filter table support"
35 The ebtables filter table is used to define frame filtering rules at
36 local input, forwarding and local output. See the man page for
39 To compile it as a module, choose M here. If unsure, say N.
41 config BRIDGE_EBT_T_NAT
42 tristate "ebt: nat table support"
44 The ebtables nat table is used to define rules that alter the MAC
45 source address (MAC SNAT) or the MAC destination address (MAC DNAT).
46 See the man page for ebtables(8).
48 To compile it as a module, choose M here. If unsure, say N.
52 config BRIDGE_EBT_802_3
53 tristate "ebt: 802.3 filter support"
55 This option adds matching support for 802.3 Ethernet frames.
57 To compile it as a module, choose M here. If unsure, say N.
59 config BRIDGE_EBT_AMONG
60 tristate "ebt: among filter support"
62 This option adds the among match, which allows matching the MAC source
63 and/or destination address on a list of addresses. Optionally,
64 MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
66 To compile it as a module, choose M here. If unsure, say N.
69 tristate "ebt: ARP filter support"
71 This option adds the ARP match, which allows ARP and RARP header field
74 To compile it as a module, choose M here. If unsure, say N.
77 tristate "ebt: IP filter support"
79 This option adds the IP match, which allows basic IP header field
82 To compile it as a module, choose M here. If unsure, say N.
85 tristate "ebt: IP6 filter support"
86 depends on BRIDGE_NF_EBTABLES && IPV6
88 This option adds the IP6 match, which allows basic IPV6 header field
91 To compile it as a module, choose M here. If unsure, say N.
93 config BRIDGE_EBT_LIMIT
94 tristate "ebt: limit match support"
96 This option adds the limit match, which allows you to control
97 the rate at which a rule can be matched. This match is the
98 equivalent of the iptables limit match.
100 If you want to compile it as a module, say M here and read
101 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
103 config BRIDGE_EBT_MARK
104 tristate "ebt: mark filter support"
106 This option adds the mark match, which allows matching frames based on
107 the 'nfmark' value in the frame. This can be set by the mark target.
108 This value is the same as the one used in the iptables mark match and
111 To compile it as a module, choose M here. If unsure, say N.
113 config BRIDGE_EBT_PKTTYPE
114 tristate "ebt: packet type filter support"
116 This option adds the packet type match, which allows matching on the
117 type of packet based on its Ethernet "class" (as determined by
118 the generic networking code): broadcast, multicast,
119 for this host alone or for another host.
121 To compile it as a module, choose M here. If unsure, say N.
123 config BRIDGE_EBT_STP
124 tristate "ebt: STP filter support"
126 This option adds the Spanning Tree Protocol match, which
127 allows STP header field filtering.
129 To compile it as a module, choose M here. If unsure, say N.
131 config BRIDGE_EBT_VLAN
132 tristate "ebt: 802.1Q VLAN filter support"
134 This option adds the 802.1Q vlan match, which allows the filtering of
137 To compile it as a module, choose M here. If unsure, say N.
141 config BRIDGE_EBT_ARPREPLY
142 tristate "ebt: arp reply target support"
143 depends on BRIDGE_NF_EBTABLES && INET
145 This option adds the arp reply target, which allows
146 automatically sending arp replies to arp requests.
148 To compile it as a module, choose M here. If unsure, say N.
150 config BRIDGE_EBT_DNAT
151 tristate "ebt: dnat target support"
153 This option adds the MAC DNAT target, which allows altering the MAC
154 destination address of frames.
156 To compile it as a module, choose M here. If unsure, say N.
158 config BRIDGE_EBT_MARK_T
159 tristate "ebt: mark target support"
161 This option adds the mark target, which allows marking frames by
162 setting the 'nfmark' value in the frame.
163 This value is the same as the one used in the iptables mark match and
166 To compile it as a module, choose M here. If unsure, say N.
168 config BRIDGE_EBT_REDIRECT
169 tristate "ebt: redirect target support"
171 This option adds the MAC redirect target, which allows altering the MAC
172 destination address of a frame to that of the device it arrived on.
174 To compile it as a module, choose M here. If unsure, say N.
176 config BRIDGE_EBT_SNAT
177 tristate "ebt: snat target support"
179 This option adds the MAC SNAT target, which allows altering the MAC
180 source address of frames.
182 To compile it as a module, choose M here. If unsure, say N.
186 config BRIDGE_EBT_LOG
187 tristate "ebt: log support"
189 This option adds the log watcher, that you can use in any rule
190 in any ebtables table. It records info about the frame header
193 To compile it as a module, choose M here. If unsure, say N.
195 config BRIDGE_EBT_ULOG
196 tristate "ebt: ulog support (OBSOLETE)"
198 This option enables the old bridge-specific "ebt_ulog" implementation
199 which has been obsoleted by the new "nfnetlink_log" code (see
200 CONFIG_NETFILTER_NETLINK_LOG).
202 This option adds the ulog watcher, that you can use in any rule
203 in any ebtables table. The packet is passed to a userspace
204 logging daemon using netlink multicast sockets. This differs
205 from the log watcher in the sense that the complete packet is
206 sent to userspace instead of a descriptive text and that
207 netlink multicast sockets are used instead of the syslog.
209 To compile it as a module, choose M here. If unsure, say N.
211 config BRIDGE_EBT_NFLOG
212 tristate "ebt: nflog support"
214 This option enables the nflog watcher, which allows to LOG
215 messages through the netfilter logging API, which can use
216 either the old LOG target, the old ULOG target or nfnetlink_log
219 This option adds the nflog watcher, that you can use in any rule
220 in any ebtables table.
222 To compile it as a module, choose M here. If unsure, say N.
224 endif # BRIDGE_NF_EBTABLES