2 # Bridge netfilter configuration
5 menuconfig NF_TABLES_BRIDGE
6 depends on BRIDGE && NETFILTER && NF_TABLES
7 tristate "Ethernet Bridge nf_tables support"
11 config NFT_BRIDGE_META
12 tristate "Netfilter nf_table bridge meta support"
15 Add support for bridge dedicated meta key.
17 endif # NF_TABLES_BRIDGE
19 menuconfig BRIDGE_NF_EBTABLES
20 tristate "Ethernet Bridge tables (ebtables) support"
21 depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
23 ebtables is a general, extensible frame/packet identification
24 framework. Say 'Y' or 'M' here if you want to do Ethernet
25 filtering/NAT/brouting on the Ethernet bridge.
32 config BRIDGE_EBT_BROUTE
33 tristate "ebt: broute table support"
35 The ebtables broute table is used to define rules that decide between
36 bridging and routing frames, giving Linux the functionality of a
37 brouter. See the man page for ebtables(8) and examples on the ebtables
40 To compile it as a module, choose M here. If unsure, say N.
42 config BRIDGE_EBT_T_FILTER
43 tristate "ebt: filter table support"
45 The ebtables filter table is used to define frame filtering rules at
46 local input, forwarding and local output. See the man page for
49 To compile it as a module, choose M here. If unsure, say N.
51 config BRIDGE_EBT_T_NAT
52 tristate "ebt: nat table support"
54 The ebtables nat table is used to define rules that alter the MAC
55 source address (MAC SNAT) or the MAC destination address (MAC DNAT).
56 See the man page for ebtables(8).
58 To compile it as a module, choose M here. If unsure, say N.
62 config BRIDGE_EBT_802_3
63 tristate "ebt: 802.3 filter support"
65 This option adds matching support for 802.3 Ethernet frames.
67 To compile it as a module, choose M here. If unsure, say N.
69 config BRIDGE_EBT_AMONG
70 tristate "ebt: among filter support"
72 This option adds the among match, which allows matching the MAC source
73 and/or destination address on a list of addresses. Optionally,
74 MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
76 To compile it as a module, choose M here. If unsure, say N.
79 tristate "ebt: ARP filter support"
81 This option adds the ARP match, which allows ARP and RARP header field
84 To compile it as a module, choose M here. If unsure, say N.
87 tristate "ebt: IP filter support"
89 This option adds the IP match, which allows basic IP header field
92 To compile it as a module, choose M here. If unsure, say N.
95 tristate "ebt: IP6 filter support"
96 depends on BRIDGE_NF_EBTABLES && IPV6
98 This option adds the IP6 match, which allows basic IPV6 header field
101 To compile it as a module, choose M here. If unsure, say N.
103 config BRIDGE_EBT_LIMIT
104 tristate "ebt: limit match support"
106 This option adds the limit match, which allows you to control
107 the rate at which a rule can be matched. This match is the
108 equivalent of the iptables limit match.
110 If you want to compile it as a module, say M here and read
111 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
113 config BRIDGE_EBT_MARK
114 tristate "ebt: mark filter support"
116 This option adds the mark match, which allows matching frames based on
117 the 'nfmark' value in the frame. This can be set by the mark target.
118 This value is the same as the one used in the iptables mark match and
121 To compile it as a module, choose M here. If unsure, say N.
123 config BRIDGE_EBT_PKTTYPE
124 tristate "ebt: packet type filter support"
126 This option adds the packet type match, which allows matching on the
127 type of packet based on its Ethernet "class" (as determined by
128 the generic networking code): broadcast, multicast,
129 for this host alone or for another host.
131 To compile it as a module, choose M here. If unsure, say N.
133 config BRIDGE_EBT_STP
134 tristate "ebt: STP filter support"
136 This option adds the Spanning Tree Protocol match, which
137 allows STP header field filtering.
139 To compile it as a module, choose M here. If unsure, say N.
141 config BRIDGE_EBT_VLAN
142 tristate "ebt: 802.1Q VLAN filter support"
144 This option adds the 802.1Q vlan match, which allows the filtering of
147 To compile it as a module, choose M here. If unsure, say N.
151 config BRIDGE_EBT_ARPREPLY
152 tristate "ebt: arp reply target support"
153 depends on BRIDGE_NF_EBTABLES && INET
155 This option adds the arp reply target, which allows
156 automatically sending arp replies to arp requests.
158 To compile it as a module, choose M here. If unsure, say N.
160 config BRIDGE_EBT_DNAT
161 tristate "ebt: dnat target support"
163 This option adds the MAC DNAT target, which allows altering the MAC
164 destination address of frames.
166 To compile it as a module, choose M here. If unsure, say N.
168 config BRIDGE_EBT_MARK_T
169 tristate "ebt: mark target support"
171 This option adds the mark target, which allows marking frames by
172 setting the 'nfmark' value in the frame.
173 This value is the same as the one used in the iptables mark match and
176 To compile it as a module, choose M here. If unsure, say N.
178 config BRIDGE_EBT_REDIRECT
179 tristate "ebt: redirect target support"
181 This option adds the MAC redirect target, which allows altering the MAC
182 destination address of a frame to that of the device it arrived on.
184 To compile it as a module, choose M here. If unsure, say N.
186 config BRIDGE_EBT_SNAT
187 tristate "ebt: snat target support"
189 This option adds the MAC SNAT target, which allows altering the MAC
190 source address of frames.
192 To compile it as a module, choose M here. If unsure, say N.
196 config BRIDGE_EBT_LOG
197 tristate "ebt: log support"
199 This option adds the log watcher, that you can use in any rule
200 in any ebtables table. It records info about the frame header
203 To compile it as a module, choose M here. If unsure, say N.
205 config BRIDGE_EBT_ULOG
206 tristate "ebt: ulog support (OBSOLETE)"
208 This option enables the old bridge-specific "ebt_ulog" implementation
209 which has been obsoleted by the new "nfnetlink_log" code (see
210 CONFIG_NETFILTER_NETLINK_LOG).
212 This option adds the ulog watcher, that you can use in any rule
213 in any ebtables table. The packet is passed to a userspace
214 logging daemon using netlink multicast sockets. This differs
215 from the log watcher in the sense that the complete packet is
216 sent to userspace instead of a descriptive text and that
217 netlink multicast sockets are used instead of the syslog.
219 To compile it as a module, choose M here. If unsure, say N.
221 config BRIDGE_EBT_NFLOG
222 tristate "ebt: nflog support"
224 This option enables the nflog watcher, which allows to LOG
225 messages through the netfilter logging API, which can use
226 either the old LOG target, the old ULOG target or nfnetlink_log
229 This option adds the nflog watcher, that you can use in any rule
230 in any ebtables table.
232 To compile it as a module, choose M here. If unsure, say N.
234 endif # BRIDGE_NF_EBTABLES