| # | |
| # Bridge netfilter configuration | |
| # | |
| # | |
| config NF_TABLES_BRIDGE | |
| depends on NF_TABLES | |
| tristate "Ethernet Bridge nf_tables support" | |
| menuconfig BRIDGE_NF_EBTABLES | |
| tristate "Ethernet Bridge tables (ebtables) support" | |
| depends on BRIDGE && NETFILTER | |
| select NETFILTER_XTABLES | |
| help | |
| ebtables is a general, extensible frame/packet identification | |
| framework. Say 'Y' or 'M' here if you want to do Ethernet | |
| filtering/NAT/brouting on the Ethernet bridge. | |
| if BRIDGE_NF_EBTABLES | |
| # | |
| # tables | |
| # | |
| config BRIDGE_EBT_BROUTE | |
| tristate "ebt: broute table support" | |
| help | |
| The ebtables broute table is used to define rules that decide between | |
| bridging and routing frames, giving Linux the functionality of a | |
| brouter. See the man page for ebtables(8) and examples on the ebtables | |
| website. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_T_FILTER | |
| tristate "ebt: filter table support" | |
| help | |
| The ebtables filter table is used to define frame filtering rules at | |
| local input, forwarding and local output. See the man page for | |
| ebtables(8). | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_T_NAT | |
| tristate "ebt: nat table support" | |
| help | |
| The ebtables nat table is used to define rules that alter the MAC | |
| source address (MAC SNAT) or the MAC destination address (MAC DNAT). | |
| See the man page for ebtables(8). | |
| To compile it as a module, choose M here. If unsure, say N. | |
| # | |
| # matches | |
| # | |
| config BRIDGE_EBT_802_3 | |
| tristate "ebt: 802.3 filter support" | |
| help | |
| This option adds matching support for 802.3 Ethernet frames. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_AMONG | |
| tristate "ebt: among filter support" | |
| help | |
| This option adds the among match, which allows matching the MAC source | |
| and/or destination address on a list of addresses. Optionally, | |
| MAC/IP address pairs can be matched, f.e. for anti-spoofing rules. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_ARP | |
| tristate "ebt: ARP filter support" | |
| help | |
| This option adds the ARP match, which allows ARP and RARP header field | |
| filtering. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_IP | |
| tristate "ebt: IP filter support" | |
| help | |
| This option adds the IP match, which allows basic IP header field | |
| filtering. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_IP6 | |
| tristate "ebt: IP6 filter support" | |
| depends on BRIDGE_NF_EBTABLES && IPV6 | |
| help | |
| This option adds the IP6 match, which allows basic IPV6 header field | |
| filtering. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_LIMIT | |
| tristate "ebt: limit match support" | |
| help | |
| This option adds the limit match, which allows you to control | |
| the rate at which a rule can be matched. This match is the | |
| equivalent of the iptables limit match. | |
| If you want to compile it as a module, say M here and read | |
| <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. | |
| config BRIDGE_EBT_MARK | |
| tristate "ebt: mark filter support" | |
| help | |
| This option adds the mark match, which allows matching frames based on | |
| the 'nfmark' value in the frame. This can be set by the mark target. | |
| This value is the same as the one used in the iptables mark match and | |
| target. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_PKTTYPE | |
| tristate "ebt: packet type filter support" | |
| help | |
| This option adds the packet type match, which allows matching on the | |
| type of packet based on its Ethernet "class" (as determined by | |
| the generic networking code): broadcast, multicast, | |
| for this host alone or for another host. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_STP | |
| tristate "ebt: STP filter support" | |
| help | |
| This option adds the Spanning Tree Protocol match, which | |
| allows STP header field filtering. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_VLAN | |
| tristate "ebt: 802.1Q VLAN filter support" | |
| help | |
| This option adds the 802.1Q vlan match, which allows the filtering of | |
| 802.1Q vlan fields. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| # | |
| # targets | |
| # | |
| config BRIDGE_EBT_ARPREPLY | |
| tristate "ebt: arp reply target support" | |
| depends on BRIDGE_NF_EBTABLES && INET | |
| help | |
| This option adds the arp reply target, which allows | |
| automatically sending arp replies to arp requests. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_DNAT | |
| tristate "ebt: dnat target support" | |
| help | |
| This option adds the MAC DNAT target, which allows altering the MAC | |
| destination address of frames. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_MARK_T | |
| tristate "ebt: mark target support" | |
| help | |
| This option adds the mark target, which allows marking frames by | |
| setting the 'nfmark' value in the frame. | |
| This value is the same as the one used in the iptables mark match and | |
| target. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_REDIRECT | |
| tristate "ebt: redirect target support" | |
| help | |
| This option adds the MAC redirect target, which allows altering the MAC | |
| destination address of a frame to that of the device it arrived on. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_SNAT | |
| tristate "ebt: snat target support" | |
| help | |
| This option adds the MAC SNAT target, which allows altering the MAC | |
| source address of frames. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| # | |
| # watchers | |
| # | |
| config BRIDGE_EBT_LOG | |
| tristate "ebt: log support" | |
| help | |
| This option adds the log watcher, that you can use in any rule | |
| in any ebtables table. It records info about the frame header | |
| to the syslog. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_ULOG | |
| tristate "ebt: ulog support (OBSOLETE)" | |
| help | |
| This option enables the old bridge-specific "ebt_ulog" implementation | |
| which has been obsoleted by the new "nfnetlink_log" code (see | |
| CONFIG_NETFILTER_NETLINK_LOG). | |
| This option adds the ulog watcher, that you can use in any rule | |
| in any ebtables table. The packet is passed to a userspace | |
| logging daemon using netlink multicast sockets. This differs | |
| from the log watcher in the sense that the complete packet is | |
| sent to userspace instead of a descriptive text and that | |
| netlink multicast sockets are used instead of the syslog. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| config BRIDGE_EBT_NFLOG | |
| tristate "ebt: nflog support" | |
| help | |
| This option enables the nflog watcher, which allows to LOG | |
| messages through the netfilter logging API, which can use | |
| either the old LOG target, the old ULOG target or nfnetlink_log | |
| as backend. | |
| This option adds the nflog watcher, that you can use in any rule | |
| in any ebtables table. | |
| To compile it as a module, choose M here. If unsure, say N. | |
| endif # BRIDGE_NF_EBTABLES |