2 # Bridge netfilter configuration
5 config NF_TABLES_BRIDGE
7 tristate "Ethernet Bridge nf_tables support"
9 menuconfig BRIDGE_NF_EBTABLES
10 tristate "Ethernet Bridge tables (ebtables) support"
11 depends on BRIDGE && NETFILTER
12 select NETFILTER_XTABLES
14 ebtables is a general, extensible frame/packet identification
15 framework. Say 'Y' or 'M' here if you want to do Ethernet
16 filtering/NAT/brouting on the Ethernet bridge.
23 config BRIDGE_EBT_BROUTE
24 tristate "ebt: broute table support"
26 The ebtables broute table is used to define rules that decide between
27 bridging and routing frames, giving Linux the functionality of a
28 brouter. See the man page for ebtables(8) and examples on the ebtables
31 To compile it as a module, choose M here. If unsure, say N.
33 config BRIDGE_EBT_T_FILTER
34 tristate "ebt: filter table support"
36 The ebtables filter table is used to define frame filtering rules at
37 local input, forwarding and local output. See the man page for
40 To compile it as a module, choose M here. If unsure, say N.
42 config BRIDGE_EBT_T_NAT
43 tristate "ebt: nat table support"
45 The ebtables nat table is used to define rules that alter the MAC
46 source address (MAC SNAT) or the MAC destination address (MAC DNAT).
47 See the man page for ebtables(8).
49 To compile it as a module, choose M here. If unsure, say N.
53 config BRIDGE_EBT_802_3
54 tristate "ebt: 802.3 filter support"
56 This option adds matching support for 802.3 Ethernet frames.
58 To compile it as a module, choose M here. If unsure, say N.
60 config BRIDGE_EBT_AMONG
61 tristate "ebt: among filter support"
63 This option adds the among match, which allows matching the MAC source
64 and/or destination address on a list of addresses. Optionally,
65 MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
67 To compile it as a module, choose M here. If unsure, say N.
70 tristate "ebt: ARP filter support"
72 This option adds the ARP match, which allows ARP and RARP header field
75 To compile it as a module, choose M here. If unsure, say N.
78 tristate "ebt: IP filter support"
80 This option adds the IP match, which allows basic IP header field
83 To compile it as a module, choose M here. If unsure, say N.
86 tristate "ebt: IP6 filter support"
87 depends on BRIDGE_NF_EBTABLES && IPV6
89 This option adds the IP6 match, which allows basic IPV6 header field
92 To compile it as a module, choose M here. If unsure, say N.
94 config BRIDGE_EBT_LIMIT
95 tristate "ebt: limit match support"
97 This option adds the limit match, which allows you to control
98 the rate at which a rule can be matched. This match is the
99 equivalent of the iptables limit match.
101 If you want to compile it as a module, say M here and read
102 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
104 config BRIDGE_EBT_MARK
105 tristate "ebt: mark filter support"
107 This option adds the mark match, which allows matching frames based on
108 the 'nfmark' value in the frame. This can be set by the mark target.
109 This value is the same as the one used in the iptables mark match and
112 To compile it as a module, choose M here. If unsure, say N.
114 config BRIDGE_EBT_PKTTYPE
115 tristate "ebt: packet type filter support"
117 This option adds the packet type match, which allows matching on the
118 type of packet based on its Ethernet "class" (as determined by
119 the generic networking code): broadcast, multicast,
120 for this host alone or for another host.
122 To compile it as a module, choose M here. If unsure, say N.
124 config BRIDGE_EBT_STP
125 tristate "ebt: STP filter support"
127 This option adds the Spanning Tree Protocol match, which
128 allows STP header field filtering.
130 To compile it as a module, choose M here. If unsure, say N.
132 config BRIDGE_EBT_VLAN
133 tristate "ebt: 802.1Q VLAN filter support"
135 This option adds the 802.1Q vlan match, which allows the filtering of
138 To compile it as a module, choose M here. If unsure, say N.
142 config BRIDGE_EBT_ARPREPLY
143 tristate "ebt: arp reply target support"
144 depends on BRIDGE_NF_EBTABLES && INET
146 This option adds the arp reply target, which allows
147 automatically sending arp replies to arp requests.
149 To compile it as a module, choose M here. If unsure, say N.
151 config BRIDGE_EBT_DNAT
152 tristate "ebt: dnat target support"
154 This option adds the MAC DNAT target, which allows altering the MAC
155 destination address of frames.
157 To compile it as a module, choose M here. If unsure, say N.
159 config BRIDGE_EBT_MARK_T
160 tristate "ebt: mark target support"
162 This option adds the mark target, which allows marking frames by
163 setting the 'nfmark' value in the frame.
164 This value is the same as the one used in the iptables mark match and
167 To compile it as a module, choose M here. If unsure, say N.
169 config BRIDGE_EBT_REDIRECT
170 tristate "ebt: redirect target support"
172 This option adds the MAC redirect target, which allows altering the MAC
173 destination address of a frame to that of the device it arrived on.
175 To compile it as a module, choose M here. If unsure, say N.
177 config BRIDGE_EBT_SNAT
178 tristate "ebt: snat target support"
180 This option adds the MAC SNAT target, which allows altering the MAC
181 source address of frames.
183 To compile it as a module, choose M here. If unsure, say N.
187 config BRIDGE_EBT_LOG
188 tristate "ebt: log support"
190 This option adds the log watcher, that you can use in any rule
191 in any ebtables table. It records info about the frame header
194 To compile it as a module, choose M here. If unsure, say N.
196 config BRIDGE_EBT_ULOG
197 tristate "ebt: ulog support (OBSOLETE)"
199 This option enables the old bridge-specific "ebt_ulog" implementation
200 which has been obsoleted by the new "nfnetlink_log" code (see
201 CONFIG_NETFILTER_NETLINK_LOG).
203 This option adds the ulog watcher, that you can use in any rule
204 in any ebtables table. The packet is passed to a userspace
205 logging daemon using netlink multicast sockets. This differs
206 from the log watcher in the sense that the complete packet is
207 sent to userspace instead of a descriptive text and that
208 netlink multicast sockets are used instead of the syslog.
210 To compile it as a module, choose M here. If unsure, say N.
212 config BRIDGE_EBT_NFLOG
213 tristate "ebt: nflog support"
215 This option enables the nflog watcher, which allows to LOG
216 messages through the netfilter logging API, which can use
217 either the old LOG target, the old ULOG target or nfnetlink_log
220 This option adds the nflog watcher, that you can use in any rule
221 in any ebtables table.
223 To compile it as a module, choose M here. If unsure, say N.
225 endif # BRIDGE_NF_EBTABLES