1# 2# Bridge netfilter configuration 3# 4# 5menuconfig NF_TABLES_BRIDGE 6 depends on NF_TABLES 7 select BRIDGE_NETFILTER 8 tristate "Ethernet Bridge nf_tables support" 9 10if NF_TABLES_BRIDGE 11 12config NFT_BRIDGE_META 13 tristate "Netfilter nf_table bridge meta support" 14 depends on NFT_META 15 help 16 Add support for bridge dedicated meta key. 17 18endif # NF_TABLES_BRIDGE 19 20menuconfig BRIDGE_NF_EBTABLES 21 tristate "Ethernet Bridge tables (ebtables) support" 22 depends on BRIDGE && NETFILTER 23 select BRIDGE_NETFILTER 24 select NETFILTER_XTABLES 25 help 26 ebtables is a general, extensible frame/packet identification 27 framework. Say 'Y' or 'M' here if you want to do Ethernet 28 filtering/NAT/brouting on the Ethernet bridge. 29 30if BRIDGE_NF_EBTABLES 31 32# 33# tables 34# 35config BRIDGE_EBT_BROUTE 36 tristate "ebt: broute table support" 37 help 38 The ebtables broute table is used to define rules that decide between 39 bridging and routing frames, giving Linux the functionality of a 40 brouter. See the man page for ebtables(8) and examples on the ebtables 41 website. 42 43 To compile it as a module, choose M here. If unsure, say N. 44 45config BRIDGE_EBT_T_FILTER 46 tristate "ebt: filter table support" 47 help 48 The ebtables filter table is used to define frame filtering rules at 49 local input, forwarding and local output. See the man page for 50 ebtables(8). 51 52 To compile it as a module, choose M here. If unsure, say N. 53 54config BRIDGE_EBT_T_NAT 55 tristate "ebt: nat table support" 56 help 57 The ebtables nat table is used to define rules that alter the MAC 58 source address (MAC SNAT) or the MAC destination address (MAC DNAT). 59 See the man page for ebtables(8). 60 61 To compile it as a module, choose M here. If unsure, say N. 62# 63# matches 64# 65config BRIDGE_EBT_802_3 66 tristate "ebt: 802.3 filter support" 67 help 68 This option adds matching support for 802.3 Ethernet frames. 69 70 To compile it as a module, choose M here. If unsure, say N. 71 72config BRIDGE_EBT_AMONG 73 tristate "ebt: among filter support" 74 help 75 This option adds the among match, which allows matching the MAC source 76 and/or destination address on a list of addresses. Optionally, 77 MAC/IP address pairs can be matched, f.e. for anti-spoofing rules. 78 79 To compile it as a module, choose M here. If unsure, say N. 80 81config BRIDGE_EBT_ARP 82 tristate "ebt: ARP filter support" 83 help 84 This option adds the ARP match, which allows ARP and RARP header field 85 filtering. 86 87 To compile it as a module, choose M here. If unsure, say N. 88 89config BRIDGE_EBT_IP 90 tristate "ebt: IP filter support" 91 help 92 This option adds the IP match, which allows basic IP header field 93 filtering. 94 95 To compile it as a module, choose M here. If unsure, say N. 96 97config BRIDGE_EBT_IP6 98 tristate "ebt: IP6 filter support" 99 depends on BRIDGE_NF_EBTABLES && IPV6 100 help 101 This option adds the IP6 match, which allows basic IPV6 header field 102 filtering. 103 104 To compile it as a module, choose M here. If unsure, say N. 105 106config BRIDGE_EBT_LIMIT 107 tristate "ebt: limit match support" 108 help 109 This option adds the limit match, which allows you to control 110 the rate at which a rule can be matched. This match is the 111 equivalent of the iptables limit match. 112 113 If you want to compile it as a module, say M here and read 114 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 115 116config BRIDGE_EBT_MARK 117 tristate "ebt: mark filter support" 118 help 119 This option adds the mark match, which allows matching frames based on 120 the 'nfmark' value in the frame. This can be set by the mark target. 121 This value is the same as the one used in the iptables mark match and 122 target. 123 124 To compile it as a module, choose M here. If unsure, say N. 125 126config BRIDGE_EBT_PKTTYPE 127 tristate "ebt: packet type filter support" 128 help 129 This option adds the packet type match, which allows matching on the 130 type of packet based on its Ethernet "class" (as determined by 131 the generic networking code): broadcast, multicast, 132 for this host alone or for another host. 133 134 To compile it as a module, choose M here. If unsure, say N. 135 136config BRIDGE_EBT_STP 137 tristate "ebt: STP filter support" 138 help 139 This option adds the Spanning Tree Protocol match, which 140 allows STP header field filtering. 141 142 To compile it as a module, choose M here. If unsure, say N. 143 144config BRIDGE_EBT_VLAN 145 tristate "ebt: 802.1Q VLAN filter support" 146 help 147 This option adds the 802.1Q vlan match, which allows the filtering of 148 802.1Q vlan fields. 149 150 To compile it as a module, choose M here. If unsure, say N. 151# 152# targets 153# 154config BRIDGE_EBT_ARPREPLY 155 tristate "ebt: arp reply target support" 156 depends on BRIDGE_NF_EBTABLES && INET 157 help 158 This option adds the arp reply target, which allows 159 automatically sending arp replies to arp requests. 160 161 To compile it as a module, choose M here. If unsure, say N. 162 163config BRIDGE_EBT_DNAT 164 tristate "ebt: dnat target support" 165 help 166 This option adds the MAC DNAT target, which allows altering the MAC 167 destination address of frames. 168 169 To compile it as a module, choose M here. If unsure, say N. 170 171config BRIDGE_EBT_MARK_T 172 tristate "ebt: mark target support" 173 help 174 This option adds the mark target, which allows marking frames by 175 setting the 'nfmark' value in the frame. 176 This value is the same as the one used in the iptables mark match and 177 target. 178 179 To compile it as a module, choose M here. If unsure, say N. 180 181config BRIDGE_EBT_REDIRECT 182 tristate "ebt: redirect target support" 183 help 184 This option adds the MAC redirect target, which allows altering the MAC 185 destination address of a frame to that of the device it arrived on. 186 187 To compile it as a module, choose M here. If unsure, say N. 188 189config BRIDGE_EBT_SNAT 190 tristate "ebt: snat target support" 191 help 192 This option adds the MAC SNAT target, which allows altering the MAC 193 source address of frames. 194 195 To compile it as a module, choose M here. If unsure, say N. 196# 197# watchers 198# 199config BRIDGE_EBT_LOG 200 tristate "ebt: log support" 201 help 202 This option adds the log watcher, that you can use in any rule 203 in any ebtables table. It records info about the frame header 204 to the syslog. 205 206 To compile it as a module, choose M here. If unsure, say N. 207 208config BRIDGE_EBT_ULOG 209 tristate "ebt: ulog support (OBSOLETE)" 210 help 211 This option enables the old bridge-specific "ebt_ulog" implementation 212 which has been obsoleted by the new "nfnetlink_log" code (see 213 CONFIG_NETFILTER_NETLINK_LOG). 214 215 This option adds the ulog watcher, that you can use in any rule 216 in any ebtables table. The packet is passed to a userspace 217 logging daemon using netlink multicast sockets. This differs 218 from the log watcher in the sense that the complete packet is 219 sent to userspace instead of a descriptive text and that 220 netlink multicast sockets are used instead of the syslog. 221 222 To compile it as a module, choose M here. If unsure, say N. 223 224config BRIDGE_EBT_NFLOG 225 tristate "ebt: nflog support" 226 help 227 This option enables the nflog watcher, which allows to LOG 228 messages through the netfilter logging API, which can use 229 either the old LOG target, the old ULOG target or nfnetlink_log 230 as backend. 231 232 This option adds the nflog watcher, that you can use in any rule 233 in any ebtables table. 234 235 To compile it as a module, choose M here. If unsure, say N. 236 237endif # BRIDGE_NF_EBTABLES 238