Wikia

How To Wiki

How to configure the Linux kernel/net/bridge/netfilter

< How to configure the Linux kernel | net | bridge

1,795pages on
this wiki
Talk0

Howto configure the Linux kernel / net / bridge / netfilter


Bridge netfilter configuration

Bridge: Netfilter ConfigurationEdit

    • depends on BRIDGE && NETFILTER


  • Option: BRIDGE_NF_EBTABLES
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) Ethernet Bridge tables (ebtables) support
      ebtables is a general, extensible frame/packet identification framework. Say 'Y' or 'M' here if you want to do Ethernet filtering/NAT/brouting on the Ethernet bridge.
tables


  • Option: BRIDGE_EBT_BROUTE
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: broute table support
    • depends on BRIDGE_NF_EBTABLES
      The ebtables broute table is used to define rules that decide between bridging and routing frames, giving Linux the functionality of a brouter. See the man page for ebtables(8) and examples on the ebtables website.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_T_FILTER
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: filter table support
    • depends on BRIDGE_NF_EBTABLES
      The ebtables filter table is used to define frame filtering rules at local input, forwarding and local output. See the man page for ebtables(8).
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_T_NAT
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: nat table support
    • depends on BRIDGE_NF_EBTABLES
      The ebtables nat table is used to define rules that alter the MAC source address (MAC SNAT) or the MAC destination address (MAC DNAT). See the man page for ebtables(8).
      To compile it as a module, choose M here. If unsure, say N.
matches


  • Option: BRIDGE_EBT_802_3
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: 802.3 filter support
    • depends on BRIDGE_NF_EBTABLES
      This option adds matching support for 802.3 Ethernet frames.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_AMONG
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: among filter support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the among match, which allows matching the MAC source and/or destination address on a list of addresses. Optionally, MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_ARP
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: ARP filter support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the ARP match, which allows ARP and RARP header field filtering.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_IP
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: IP filter support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the IP match, which allows basic IP header field filtering.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_LIMIT
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: limit match support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the limit match, which allows you to control the rate at which a rule can be matched. This match is the equivalent of the iptables limit match.
      If you want to compile it as a module, say M here and read <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.


  • Option: BRIDGE_EBT_MARK
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: mark filter support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the mark match, which allows matching frames based on the 'nfmark' value in the frame. This can be set by the mark target. This value is the same as the one used in the iptables mark match and target.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_PKTTYPE
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: packet type filter support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the packet type match, which allows matching on the type of packet based on its Ethernet "class" (as determined by the generic networking code): broadcast, multicast, for this host alone or for another host.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_STP
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: STP filter support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the Spanning Tree Protocol match, which allows STP header field filtering.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_VLAN
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: 802.1Q VLAN filter support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the 802.1Q vlan match, which allows the filtering of 802.1Q vlan fields.
      To compile it as a module, choose M here. If unsure, say N.
targets


  • Option: BRIDGE_EBT_ARPREPLY
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: arp reply target support
    • depends on BRIDGE_NF_EBTABLES && INET
      This option adds the arp reply target, which allows automatically sending arp replies to arp requests.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_DNAT
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: dnat target support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the MAC DNAT target, which allows altering the MAC destination address of frames.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_MARK_T
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: mark target support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the mark target, which allows marking frames by setting the 'nfmark' value in the frame. This value is the same as the one used in the iptables mark match and target.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_REDIRECT
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: redirect target support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the MAC redirect target, which allows altering the MAC destination address of a frame to that of the device it arrived on.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_SNAT
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: snat target support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the MAC SNAT target, which allows altering the MAC source address of frames.
      To compile it as a module, choose M here. If unsure, say N.
watchers


  • Option: BRIDGE_EBT_LOG
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: log support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the log watcher, that you can use in any rule in any ebtables table. It records info about the frame header to the syslog.
      To compile it as a module, choose M here. If unsure, say N.


  • Option: BRIDGE_EBT_ULOG
    • Kernel Versions: 2.6.15.6 ...
    • (on/off/module) ebt: ulog support
    • depends on BRIDGE_NF_EBTABLES
      This option adds the ulog watcher, that you can use in any rule in any ebtables table. The packet is passed to a userspace logging daemon using netlink multicast sockets. This differs from the log watcher in the sense that the complete packet is sent to userspace instead of a descriptive text and that netlink multicast sockets are used instead of the syslog.
      To compile it as a module, choose M here. If unsure, say N.



Linux Kernel Configuration

Around Wikia's network

Random Wiki