# SPDX-License-Identifier: GPL-2.0-only
#
# Bridge netfilter configuration
#
#
menuconfig [31mCONFIG_NF_TABLES_BRIDGE[0m
depends on [31mCONFIG_BRIDGE[0m && [31mCONFIG_NETFILTER[0m && [31mCONFIG_NF_TABLES[0m
select [31mCONFIG_NETFILTER_FAMILY_BRIDGE[0m
tristate "Ethernet Bridge nf_tables support"
if [31mCONFIG_NF_TABLES_BRIDGE[0m
config [31mCONFIG_NFT_BRIDGE_META[0m
tristate "Netfilter nf_table bridge meta support"
help
Add support for bridge dedicated meta key.
config [31mCONFIG_NFT_BRIDGE_REJECT[0m
tristate "Netfilter nf_tables bridge reject support"
depends on [31mCONFIG_NFT_REJECT[0m && [31mCONFIG_NFT_REJECT_IPV4[0m && [31mCONFIG_NFT_REJECT_IPV6[0m
help
Add support to reject packets.
config [31mCONFIG_NF_LOG_BRIDGE[0m
tristate "Bridge packet logging"
select [31mCONFIG_NF_LOG_COMMON[0m
endif # [31mCONFIG_NF_TABLES_BRIDGE[0m
config [31mCONFIG_NF_CONNTRACK_BRIDGE[0m
tristate "IPv4/IPV6 bridge connection tracking support"
depends on [31mCONFIG_NF_CONNTRACK[0m
default n
help
Connection tracking keeps a record of what packets have passed
through your machine, in order to figure out how they are related
into connections. This is used to enhance packet filtering via
stateful policies. Enable this if you want native tracking from
the bridge. This provides a replacement for the `br_netfilter'
infrastructure.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
menuconfig [31mCONFIG_BRIDGE_NF_EBTABLES[0m
tristate "Ethernet Bridge tables (ebtables) support"
depends on [31mCONFIG_BRIDGE[0m && [31mCONFIG_NETFILTER[0m && [31mCONFIG_NETFILTER_XTABLES[0m
select [31mCONFIG_NETFILTER_FAMILY_BRIDGE[0m
help
ebtables is a general, extensible frame/packet identification
framework. Say 'Y' or '[31mCONFIG_M[0m' here if you want to do Ethernet
filtering/NAT/brouting on the Ethernet bridge.
if [31mCONFIG_BRIDGE_NF_EBTABLES[0m
#
# tables
#
config [31mCONFIG_BRIDGE_EBT_BROUTE[0m
tristate "ebt: broute table support"
help
The ebtables broute table is used to define rules that decide between
bridging and routing frames, giving Linux the functionality of a
brouter. See the man page for ebtables(8) and examples on the ebtables
website.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_T_FILTER[0m
tristate "ebt: filter table support"
help
The ebtables filter table is used to define frame filtering rules at
local input, forwarding and local output. See the man page for
ebtables(8).
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_T_NAT[0m
tristate "ebt: nat table support"
help
The ebtables nat table is used to define rules that alter the [31mCONFIG_MAC[0m
source address ([31mCONFIG_MAC[0m SNAT) or the [31mCONFIG_MAC[0m destination address ([31mCONFIG_MAC[0m DNAT).
See the man page for ebtables(8).
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
#
# matches
#
config [31mCONFIG_BRIDGE_EBT_802_3[0m
tristate "ebt: 802.3 filter support"
help
This option adds matching support for 802.3 Ethernet frames.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_AMONG[0m
tristate "ebt: among filter support"
help
This option adds the among match, which allows matching the [31mCONFIG_MAC[0m source
and/or destination address on a list of addresses. Optionally,
[31mCONFIG_MAC[0m/IP address pairs can be matched, f.e. for anti-spoofing rules.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_ARP[0m
tristate "ebt: ARP filter support"
help
This option adds the ARP match, which allows ARP and RARP header field
filtering.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_IP[0m
tristate "ebt: IP filter support"
help
This option adds the IP match, which allows basic IP header field
filtering.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_IP6[0m
tristate "ebt: IP6 filter support"
depends on [31mCONFIG_BRIDGE_NF_EBTABLES[0m && [31mCONFIG_IPV6[0m
help
This option adds the IP6 match, which allows basic [31mCONFIG_IPV6[0m header field
filtering.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_LIMIT[0m
tristate "ebt: limit match support"
help
This option adds the limit match, which allows you to control
the rate at which a rule can be matched. This match is the
equivalent of the iptables limit match.
If you want to compile it as a module, say [31mCONFIG_M[0m here and read
<file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
config [31mCONFIG_BRIDGE_EBT_MARK[0m
tristate "ebt: mark filter support"
help
This option adds the mark match, which allows matching frames based on
the 'nfmark' value in the frame. This can be set by the mark target.
This value is the same as the one used in the iptables mark match and
target.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_PKTTYPE[0m
tristate "ebt: packet type filter support"
help
This option adds the packet type match, which allows matching on the
type of packet based on its Ethernet "class" (as determined by
the generic networking code): broadcast, multicast,
for this host alone or for another host.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_STP[0m
tristate "ebt: STP filter support"
help
This option adds the Spanning Tree Protocol match, which
allows [31mCONFIG_STP[0m header field filtering.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_VLAN[0m
tristate "ebt: 802.1Q VLAN filter support"
help
This option adds the 802.1Q vlan match, which allows the filtering of
802.1Q vlan fields.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
#
# targets
#
config [31mCONFIG_BRIDGE_EBT_ARPREPLY[0m
tristate "ebt: arp reply target support"
depends on [31mCONFIG_BRIDGE_NF_EBTABLES[0m && [31mCONFIG_INET[0m
help
This option adds the arp reply target, which allows
automatically sending arp replies to arp requests.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_DNAT[0m
tristate "ebt: dnat target support"
help
This option adds the [31mCONFIG_MAC[0m DNAT target, which allows altering the [31mCONFIG_MAC[0m
destination address of frames.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_MARK_T[0m
tristate "ebt: mark target support"
help
This option adds the mark target, which allows marking frames by
setting the 'nfmark' value in the frame.
This value is the same as the one used in the iptables mark match and
target.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_REDIRECT[0m
tristate "ebt: redirect target support"
help
This option adds the [31mCONFIG_MAC[0m redirect target, which allows altering the [31mCONFIG_MAC[0m
destination address of a frame to that of the device it arrived on.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_SNAT[0m
tristate "ebt: snat target support"
help
This option adds the [31mCONFIG_MAC[0m SNAT target, which allows altering the [31mCONFIG_MAC[0m
source address of frames.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
#
# watchers
#
config [31mCONFIG_BRIDGE_EBT_LOG[0m
tristate "ebt: log support"
help
This option adds the log watcher, that you can use in any rule
in any ebtables table. It records info about the frame header
to the syslog.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
config [31mCONFIG_BRIDGE_EBT_NFLOG[0m
tristate "ebt: nflog support"
help
This option enables the nflog watcher, which allows to LOG
messages through the netfilter logging API, which can use
either the old LOG target, the old ULOG target or nfnetlink_log
as backend.
This option adds the nflog watcher, that you can use in any rule
in any ebtables table.
To compile it as a module, choose [31mCONFIG_M[0m here. If unsure, say N.
endif # [31mCONFIG_BRIDGE_NF_EBTABLES[0m