2 # Bridge netfilter configuration
5 menuconfig BRIDGE_NF_EBTABLES
6 tristate "Ethernet Bridge tables (ebtables) support"
7 select NETFILTER_XTABLES
9 ebtables is a general, extensible frame/packet identification
10 framework. Say 'Y' or 'M' here if you want to do Ethernet
11 filtering/NAT/brouting on the Ethernet bridge.
18 config BRIDGE_EBT_BROUTE
19 tristate "ebt: broute table support"
21 The ebtables broute table is used to define rules that decide between
22 bridging and routing frames, giving Linux the functionality of a
23 brouter. See the man page for ebtables(8) and examples on the ebtables
26 To compile it as a module, choose M here. If unsure, say N.
28 config BRIDGE_EBT_T_FILTER
29 tristate "ebt: filter table support"
31 The ebtables filter table is used to define frame filtering rules at
32 local input, forwarding and local output. See the man page for
35 To compile it as a module, choose M here. If unsure, say N.
37 config BRIDGE_EBT_T_NAT
38 tristate "ebt: nat table support"
40 The ebtables nat table is used to define rules that alter the MAC
41 source address (MAC SNAT) or the MAC destination address (MAC DNAT).
42 See the man page for ebtables(8).
44 To compile it as a module, choose M here. If unsure, say N.
48 config BRIDGE_EBT_802_3
49 tristate "ebt: 802.3 filter support"
51 This option adds matching support for 802.3 Ethernet frames.
53 To compile it as a module, choose M here. If unsure, say N.
55 config BRIDGE_EBT_AMONG
56 tristate "ebt: among filter support"
58 This option adds the among match, which allows matching the MAC source
59 and/or destination address on a list of addresses. Optionally,
60 MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
62 To compile it as a module, choose M here. If unsure, say N.
65 tristate "ebt: ARP filter support"
67 This option adds the ARP match, which allows ARP and RARP header field
70 To compile it as a module, choose M here. If unsure, say N.
73 tristate "ebt: IP filter support"
75 This option adds the IP match, which allows basic IP header field
78 To compile it as a module, choose M here. If unsure, say N.
81 tristate "ebt: IP6 filter support"
82 depends on BRIDGE_NF_EBTABLES && IPV6
84 This option adds the IP6 match, which allows basic IPV6 header field
87 To compile it as a module, choose M here. If unsure, say N.
89 config BRIDGE_EBT_LIMIT
90 tristate "ebt: limit match support"
92 This option adds the limit match, which allows you to control
93 the rate at which a rule can be matched. This match is the
94 equivalent of the iptables limit match.
96 If you want to compile it as a module, say M here and read
97 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
99 config BRIDGE_EBT_MARK
100 tristate "ebt: mark filter support"
102 This option adds the mark match, which allows matching frames based on
103 the 'nfmark' value in the frame. This can be set by the mark target.
104 This value is the same as the one used in the iptables mark match and
107 To compile it as a module, choose M here. If unsure, say N.
109 config BRIDGE_EBT_PKTTYPE
110 tristate "ebt: packet type filter support"
112 This option adds the packet type match, which allows matching on the
113 type of packet based on its Ethernet "class" (as determined by
114 the generic networking code): broadcast, multicast,
115 for this host alone or for another host.
117 To compile it as a module, choose M here. If unsure, say N.
119 config BRIDGE_EBT_STP
120 tristate "ebt: STP filter support"
122 This option adds the Spanning Tree Protocol match, which
123 allows STP header field filtering.
125 To compile it as a module, choose M here. If unsure, say N.
127 config BRIDGE_EBT_VLAN
128 tristate "ebt: 802.1Q VLAN filter support"
130 This option adds the 802.1Q vlan match, which allows the filtering of
133 To compile it as a module, choose M here. If unsure, say N.
137 config BRIDGE_EBT_ARPREPLY
138 tristate "ebt: arp reply target support"
139 depends on BRIDGE_NF_EBTABLES && INET
141 This option adds the arp reply target, which allows
142 automatically sending arp replies to arp requests.
144 To compile it as a module, choose M here. If unsure, say N.
146 config BRIDGE_EBT_DNAT
147 tristate "ebt: dnat target support"
149 This option adds the MAC DNAT target, which allows altering the MAC
150 destination address of frames.
152 To compile it as a module, choose M here. If unsure, say N.
154 config BRIDGE_EBT_MARK_T
155 tristate "ebt: mark target support"
157 This option adds the mark target, which allows marking frames by
158 setting the 'nfmark' value in the frame.
159 This value is the same as the one used in the iptables mark match and
162 To compile it as a module, choose M here. If unsure, say N.
164 config BRIDGE_EBT_REDIRECT
165 tristate "ebt: redirect target support"
167 This option adds the MAC redirect target, which allows altering the MAC
168 destination address of a frame to that of the device it arrived on.
170 To compile it as a module, choose M here. If unsure, say N.
172 config BRIDGE_EBT_SNAT
173 tristate "ebt: snat target support"
175 This option adds the MAC SNAT target, which allows altering the MAC
176 source address of frames.
178 To compile it as a module, choose M here. If unsure, say N.
182 config BRIDGE_EBT_LOG
183 tristate "ebt: log support"
185 This option adds the log watcher, that you can use in any rule
186 in any ebtables table. It records info about the frame header
189 To compile it as a module, choose M here. If unsure, say N.
191 config BRIDGE_EBT_ULOG
192 tristate "ebt: ulog support (OBSOLETE)"
194 This option enables the old bridge-specific "ebt_ulog" implementation
195 which has been obsoleted by the new "nfnetlink_log" code (see
196 CONFIG_NETFILTER_NETLINK_LOG).
198 This option adds the ulog watcher, that you can use in any rule
199 in any ebtables table. The packet is passed to a userspace
200 logging daemon using netlink multicast sockets. This differs
201 from the log watcher in the sense that the complete packet is
202 sent to userspace instead of a descriptive text and that
203 netlink multicast sockets are used instead of the syslog.
205 To compile it as a module, choose M here. If unsure, say N.
207 config BRIDGE_EBT_NFLOG
208 tristate "ebt: nflog support"
210 This option enables the nflog watcher, which allows to LOG
211 messages through the netfilter logging API, which can use
212 either the old LOG target, the old ULOG target or nfnetlink_log
215 This option adds the nflog watcher, that you can use in any rule
216 in any ebtables table.
218 To compile it as a module, choose M here. If unsure, say N.
220 endif # BRIDGE_NF_EBTABLES