3 # Copyright (C) 2006-2010 OpenWrt.org
5 # This is free software, licensed under the GNU General Public License v2.
6 # See /LICENSE for more information.
9 NF_MENU:=Netfilter Extensions
11 include $(INCLUDE_DIR)/netfilter.mk
14 define KernelPackage/nf-reject
16 TITLE:=Netfilter IPv4 reject support
19 CONFIG_NETFILTER_ADVANCED=y \
21 FILES:=$(foreach mod,$(NF_REJECT-m),$(LINUX_DIR)/net/$(mod).ko)
22 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_REJECT-m)))
25 $(eval $(call KernelPackage,nf-reject))
28 define KernelPackage/nf-reject6
30 TITLE:=Netfilter IPv6 reject support
33 CONFIG_NETFILTER_ADVANCED=y \
36 FILES:=$(foreach mod,$(NF_REJECT6-m),$(LINUX_DIR)/net/$(mod).ko)
37 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_REJECT6-m)))
40 $(eval $(call KernelPackage,nf-reject6))
43 define KernelPackage/nf-ipt
46 KCONFIG:=$(KCONFIG_NF_IPT)
47 FILES:=$(foreach mod,$(NF_IPT-m),$(LINUX_DIR)/net/$(mod).ko)
48 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT-m)))
51 $(eval $(call KernelPackage,nf-ipt))
54 define KernelPackage/nf-ipt6
57 KCONFIG:=$(KCONFIG_NF_IPT6)
58 FILES:=$(foreach mod,$(NF_IPT6-m),$(LINUX_DIR)/net/$(mod).ko)
59 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT6-m)))
63 $(eval $(call KernelPackage,nf-ipt6))
67 define KernelPackage/ipt-core
70 KCONFIG:=$(KCONFIG_IPT_CORE)
71 FILES:=$(foreach mod,$(IPT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
72 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CORE-m)))
73 DEPENDS:=+kmod-nf-reject +kmod-nf-ipt
76 define KernelPackage/ipt-core/description
77 Netfilter core kernel modules
88 $(eval $(call KernelPackage,ipt-core))
91 define KernelPackage/nf-conntrack
93 TITLE:=Netfilter connection tracking
96 CONFIG_NETFILTER_ADVANCED=y \
97 CONFIG_NF_CONNTRACK_MARK=y \
98 CONFIG_NF_CONNTRACK_ZONES=y \
99 $(KCONFIG_NF_CONNTRACK)
100 FILES:=$(foreach mod,$(NF_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
101 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK-m)))
104 define KernelPackage/nf-conntrack/install
105 $(INSTALL_DIR) $(1)/etc/sysctl.d
106 $(INSTALL_DATA) ./files/sysctl-nf-conntrack.conf $(1)/etc/sysctl.d/11-nf-conntrack.conf
109 $(eval $(call KernelPackage,nf-conntrack))
112 define KernelPackage/nf-conntrack6
114 TITLE:=Netfilter IPv6 connection tracking
115 KCONFIG:=$(KCONFIG_NF_CONNTRACK6)
116 DEPENDS:=@IPV6 +kmod-nf-conntrack
117 FILES:=$(foreach mod,$(NF_CONNTRACK6-m),$(LINUX_DIR)/net/$(mod).ko)
118 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK6-m)))
121 $(eval $(call KernelPackage,nf-conntrack6))
124 define KernelPackage/nf-nat
127 KCONFIG:=$(KCONFIG_NF_NAT)
128 DEPENDS:=+kmod-nf-conntrack
129 FILES:=$(foreach mod,$(NF_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
130 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT-m)))
133 $(eval $(call KernelPackage,nf-nat))
136 define KernelPackage/nf-nat6
138 TITLE:=Netfilter IPV6-NAT
139 KCONFIG:=$(KCONFIG_NF_NAT6)
140 DEPENDS:=+kmod-nf-conntrack6 +kmod-nf-nat
141 FILES:=$(foreach mod,$(NF_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
142 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT6-m)))
145 $(eval $(call KernelPackage,nf-nat6))
148 define KernelPackage/nf-flow
150 TITLE:=Netfilter flowtable support
152 CONFIG_NETFILTER_INGRESS=y \
153 CONFIG_NF_FLOW_TABLE \
154 CONFIG_NF_FLOW_TABLE_HW
155 DEPENDS:=+kmod-nf-conntrack @!LINUX_3_18 @!LINUX_4_4 @!LINUX_4_9
157 $(LINUX_DIR)/net/netfilter/nf_flow_table.ko \
158 $(LINUX_DIR)/net/netfilter/nf_flow_table_hw.ko
159 AUTOLOAD:=$(call AutoProbe,nf_flow_table nf_flow_table_hw)
162 $(eval $(call KernelPackage,nf-flow))
165 define AddDepends/ipt
167 DEPENDS+= +kmod-ipt-core $(1)
171 define KernelPackage/ipt-conntrack
172 TITLE:=Basic connection tracking modules
173 KCONFIG:=$(KCONFIG_IPT_CONNTRACK)
174 FILES:=$(foreach mod,$(IPT_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
175 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK-m)))
176 $(call AddDepends/ipt,+kmod-nf-conntrack)
179 define KernelPackage/ipt-conntrack/description
180 Netfilter (IPv4) kernel modules for connection tracking
189 $(eval $(call KernelPackage,ipt-conntrack))
192 define KernelPackage/ipt-conntrack-extra
193 TITLE:=Extra connection tracking modules
194 KCONFIG:=$(KCONFIG_IPT_CONNTRACK_EXTRA)
195 FILES:=$(foreach mod,$(IPT_CONNTRACK_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
196 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_EXTRA-m)))
197 $(call AddDepends/ipt,+kmod-ipt-conntrack)
200 define KernelPackage/ipt-conntrack-extra/description
201 Netfilter (IPv4) extra kernel modules for connection tracking
210 $(eval $(call KernelPackage,ipt-conntrack-extra))
212 define KernelPackage/ipt-conntrack-label
213 TITLE:=Module for handling connection tracking labels
214 KCONFIG:=$(KCONFIG_IPT_CONNTRACK_LABEL)
215 FILES:=$(foreach mod,$(IPT_CONNTRACK_LABEL-m),$(LINUX_DIR)/net/$(mod).ko)
216 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_LABEL-m)))
217 $(call AddDepends/ipt,+kmod-ipt-conntrack)
220 define KernelPackage/ipt-conntrack-label/description
221 Netfilter (IPv4) module for handling connection tracking labels
226 $(eval $(call KernelPackage,ipt-conntrack-label))
228 define KernelPackage/ipt-filter
229 TITLE:=Modules for packet content inspection
230 KCONFIG:=$(KCONFIG_IPT_FILTER)
231 FILES:=$(foreach mod,$(IPT_FILTER-m),$(LINUX_DIR)/net/$(mod).ko)
232 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FILTER-m)))
233 $(call AddDepends/ipt,+kmod-lib-textsearch +kmod-ipt-conntrack)
236 define KernelPackage/ipt-filter/description
237 Netfilter (IPv4) kernel modules for packet content inspection
243 $(eval $(call KernelPackage,ipt-filter))
246 define KernelPackage/ipt-offload
247 TITLE:=Netfilter routing/NAT offload support
248 KCONFIG:=CONFIG_NETFILTER_XT_TARGET_FLOWOFFLOAD
249 FILES:=$(foreach mod,$(IPT_FLOW-m),$(LINUX_DIR)/net/$(mod).ko)
250 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FLOW-m)))
251 $(call AddDepends/ipt,+kmod-nf-flow)
254 $(eval $(call KernelPackage,ipt-offload))
257 define KernelPackage/ipt-ipopt
258 TITLE:=Modules for matching/changing IP packet options
259 KCONFIG:=$(KCONFIG_IPT_IPOPT)
260 FILES:=$(foreach mod,$(IPT_IPOPT-m),$(LINUX_DIR)/net/$(mod).ko)
261 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPOPT-m)))
262 $(call AddDepends/ipt)
265 define KernelPackage/ipt-ipopt/description
266 Netfilter (IPv4) modules for matching/changing IP packet options
281 $(eval $(call KernelPackage,ipt-ipopt))
284 define KernelPackage/ipt-ipsec
285 TITLE:=Modules for matching IPSec packets
286 KCONFIG:=$(KCONFIG_IPT_IPSEC)
287 FILES:=$(foreach mod,$(IPT_IPSEC-m),$(LINUX_DIR)/net/$(mod).ko)
288 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPSEC-m)))
289 $(call AddDepends/ipt)
292 define KernelPackage/ipt-ipsec/description
293 Netfilter (IPv4) modules for matching IPSec packets
300 $(eval $(call KernelPackage,ipt-ipsec))
304 ipset/ip_set_bitmap_ip \
305 ipset/ip_set_bitmap_ipmac \
306 ipset/ip_set_bitmap_port \
307 ipset/ip_set_hash_ip \
308 ipset/ip_set_hash_ipmark \
309 ipset/ip_set_hash_ipport \
310 ipset/ip_set_hash_ipportip \
311 ipset/ip_set_hash_ipportnet \
312 ipset/ip_set_hash_mac \
313 ipset/ip_set_hash_netportnet \
314 ipset/ip_set_hash_net \
315 ipset/ip_set_hash_netnet \
316 ipset/ip_set_hash_netport \
317 ipset/ip_set_hash_netiface \
318 ipset/ip_set_list_set \
321 define KernelPackage/ipt-ipset
322 SUBMENU:=Netfilter Extensions
323 TITLE:=IPset netfilter modules
324 DEPENDS+= +kmod-ipt-core +kmod-nfnetlink
327 CONFIG_IP_SET_MAX=256 \
328 CONFIG_NETFILTER_XT_SET \
329 CONFIG_IP_SET_BITMAP_IP \
330 CONFIG_IP_SET_BITMAP_IPMAC \
331 CONFIG_IP_SET_BITMAP_PORT \
332 CONFIG_IP_SET_HASH_IP \
333 CONFIG_IP_SET_HASH_IPMARK \
334 CONFIG_IP_SET_HASH_IPPORT \
335 CONFIG_IP_SET_HASH_IPPORTIP \
336 CONFIG_IP_SET_HASH_IPPORTNET \
337 CONFIG_IP_SET_HASH_MAC \
338 CONFIG_IP_SET_HASH_NET \
339 CONFIG_IP_SET_HASH_NETNET \
340 CONFIG_IP_SET_HASH_NETIFACE \
341 CONFIG_IP_SET_HASH_NETPORT \
342 CONFIG_IP_SET_HASH_NETPORTNET \
343 CONFIG_IP_SET_LIST_SET \
344 CONFIG_NET_EMATCH_IPSET=n
345 FILES:=$(foreach mod,$(IPSET_MODULES),$(LINUX_DIR)/net/netfilter/$(mod).ko)
346 AUTOLOAD:=$(call AutoLoad,49,$(notdir $(IPSET_MODULES)))
348 $(eval $(call KernelPackage,ipt-ipset))
351 define KernelPackage/ipt-nat
352 TITLE:=Basic NAT targets
353 KCONFIG:=$(KCONFIG_IPT_NAT)
354 FILES:=$(foreach mod,$(IPT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
355 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT-m)))
356 $(call AddDepends/ipt,+kmod-nf-nat)
359 define KernelPackage/ipt-nat/description
360 Netfilter (IPv4) kernel modules for basic NAT targets
365 $(eval $(call KernelPackage,ipt-nat))
368 define KernelPackage/ipt-raw
369 TITLE:=Netfilter IPv4 raw table support
370 KCONFIG:=CONFIG_IP_NF_RAW
371 FILES:=$(LINUX_DIR)/net/ipv4/netfilter/iptable_raw.ko
372 AUTOLOAD:=$(call AutoProbe,iptable_raw)
373 $(call AddDepends/ipt)
376 $(eval $(call KernelPackage,ipt-raw))
379 define KernelPackage/ipt-raw6
380 TITLE:=Netfilter IPv6 raw table support
381 KCONFIG:=CONFIG_IP6_NF_RAW
382 FILES:=$(LINUX_DIR)/net/ipv6/netfilter/ip6table_raw.ko
383 AUTOLOAD:=$(call AutoProbe,ip6table_raw)
384 $(call AddDepends/ipt,+kmod-ip6tables)
387 $(eval $(call KernelPackage,ipt-raw6))
390 define KernelPackage/ipt-nat6
391 TITLE:=IPv6 NAT targets
392 KCONFIG:=$(KCONFIG_IPT_NAT6)
393 FILES:=$(foreach mod,$(IPT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
394 AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_NAT6-m)))
395 $(call AddDepends/ipt,+kmod-nf-nat6)
396 $(call AddDepends/ipt,+kmod-ipt-conntrack)
397 $(call AddDepends/ipt,+kmod-ipt-nat)
398 $(call AddDepends/ipt,+kmod-ip6tables)
401 define KernelPackage/ipt-nat6/description
402 Netfilter (IPv6) kernel modules for NAT targets
405 $(eval $(call KernelPackage,ipt-nat6))
408 define KernelPackage/ipt-nat-extra
409 TITLE:=Extra NAT targets
410 KCONFIG:=$(KCONFIG_IPT_NAT_EXTRA)
411 FILES:=$(foreach mod,$(IPT_NAT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
412 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT_EXTRA-m)))
413 $(call AddDepends/ipt,+kmod-ipt-nat)
416 define KernelPackage/ipt-nat-extra/description
417 Netfilter (IPv4) kernel modules for extra NAT targets
423 $(eval $(call KernelPackage,ipt-nat-extra))
426 define KernelPackage/nf-nathelper
428 TITLE:=Basic Conntrack and NAT helpers
429 KCONFIG:=$(KCONFIG_NF_NATHELPER)
430 FILES:=$(foreach mod,$(NF_NATHELPER-m),$(LINUX_DIR)/net/$(mod).ko)
431 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER-m)))
432 DEPENDS:=+kmod-nf-nat
435 define KernelPackage/nf-nathelper/description
436 Default Netfilter (IPv4) Conntrack and NAT helpers
441 $(eval $(call KernelPackage,nf-nathelper))
444 define KernelPackage/nf-nathelper-extra
446 TITLE:=Extra Conntrack and NAT helpers
447 KCONFIG:=$(KCONFIG_NF_NATHELPER_EXTRA)
448 FILES:=$(foreach mod,$(NF_NATHELPER_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
449 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER_EXTRA-m)))
450 DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch
453 define KernelPackage/nf-nathelper-extra/description
454 Extra Netfilter (IPv4) Conntrack and NAT helpers
468 $(eval $(call KernelPackage,nf-nathelper-extra))
471 define KernelPackage/ipt-ulog
472 TITLE:=Module for user-space packet logging
473 KCONFIG:=$(KCONFIG_IPT_ULOG)
474 FILES:=$(foreach mod,$(IPT_ULOG-m),$(LINUX_DIR)/net/$(mod).ko)
475 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_ULOG-m)))
476 $(call AddDepends/ipt)
479 define KernelPackage/ipt-ulog/description
480 Netfilter (IPv4) module for user-space packet logging
485 $(eval $(call KernelPackage,ipt-ulog))
488 define KernelPackage/ipt-nflog
489 TITLE:=Module for user-space packet logging
490 KCONFIG:=$(KCONFIG_IPT_NFLOG)
491 FILES:=$(foreach mod,$(IPT_NFLOG-m),$(LINUX_DIR)/net/$(mod).ko)
492 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFLOG-m)))
493 $(call AddDepends/ipt,+kmod-nfnetlink-log)
496 define KernelPackage/ipt-nflog/description
497 Netfilter module for user-space packet logging
502 $(eval $(call KernelPackage,ipt-nflog))
505 define KernelPackage/ipt-nfqueue
506 TITLE:=Module for user-space packet queuing
507 KCONFIG:=$(KCONFIG_IPT_NFQUEUE)
508 FILES:=$(foreach mod,$(IPT_NFQUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
509 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFQUEUE-m)))
510 $(call AddDepends/ipt,+kmod-nfnetlink-queue)
513 define KernelPackage/ipt-nfqueue/description
514 Netfilter module for user-space packet queuing
519 $(eval $(call KernelPackage,ipt-nfqueue))
522 define KernelPackage/ipt-debug
523 TITLE:=Module for debugging/development
524 KCONFIG:=$(KCONFIG_IPT_DEBUG)
525 FILES:=$(foreach mod,$(IPT_DEBUG-m),$(LINUX_DIR)/net/$(mod).ko)
526 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_DEBUG-m)))
527 $(call AddDepends/ipt,+kmod-ipt-raw +IPV6:kmod-ipt-raw6)
530 define KernelPackage/ipt-debug/description
531 Netfilter modules for debugging/development of the firewall
536 $(eval $(call KernelPackage,ipt-debug))
539 define KernelPackage/ipt-led
540 TITLE:=Module to trigger a LED with a Netfilter rule
541 KCONFIG:=$(KCONFIG_IPT_LED)
542 FILES:=$(foreach mod,$(IPT_LED-m),$(LINUX_DIR)/net/$(mod).ko)
543 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_LED-m)))
544 $(call AddDepends/ipt)
547 define KernelPackage/ipt-led/description
548 Netfilter target to trigger a LED when a network packet is matched.
551 $(eval $(call KernelPackage,ipt-led))
553 define KernelPackage/ipt-tproxy
554 TITLE:=Transparent proxying support
555 DEPENDS+=+kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +IPV6:kmod-ip6tables
557 CONFIG_NETFILTER_XT_MATCH_SOCKET \
558 CONFIG_NETFILTER_XT_TARGET_TPROXY
560 $(foreach mod,$(IPT_TPROXY-m),$(LINUX_DIR)/net/$(mod).ko)
561 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_TPROXY-m)))
562 $(call AddDepends/ipt)
565 define KernelPackage/ipt-tproxy/description
566 Kernel modules for Transparent Proxying
569 $(eval $(call KernelPackage,ipt-tproxy))
571 define KernelPackage/ipt-tee
573 DEPENDS:=+kmod-ipt-conntrack
575 CONFIG_NETFILTER_XT_TARGET_TEE
577 $(LINUX_DIR)/net/netfilter/xt_TEE.ko \
578 $(foreach mod,$(IPT_TEE-m),$(LINUX_DIR)/net/$(mod).ko)
579 AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_TEE-m)))
580 $(call AddDepends/ipt)
583 define KernelPackage/ipt-tee/description
584 Kernel modules for TEE
587 $(eval $(call KernelPackage,ipt-tee))
589 define KernelPackage/ip6t-tee
590 TITLE:=TEE support (IPv6)
591 DEPENDS:=+kmod-ipt-tee
592 FILES:= $(foreach mod,$(IP6T_TEE-m),$(LINUX_DIR)/net/$(mod).ko)
593 AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IP6T_TEE-m)))
594 $(call AddDepends/ipt)
597 define KernelPackage/ip6t-tee/description
598 Kernel modules for TEE (IPv6)
601 $(eval $(call KernelPackage,ip6t-tee))
603 define KernelPackage/ipt-u32
606 CONFIG_NETFILTER_XT_MATCH_U32
608 $(LINUX_DIR)/net/netfilter/xt_u32.ko \
609 $(foreach mod,$(IPT_U32-m),$(LINUX_DIR)/net/$(mod).ko)
610 AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_U32-m)))
611 $(call AddDepends/ipt)
614 define KernelPackage/ipt-u32/description
615 Kernel modules for U32
618 $(eval $(call KernelPackage,ipt-u32))
620 define KernelPackage/ipt-checksum
621 TITLE:=CHECKSUM support
623 CONFIG_NETFILTER_XT_TARGET_CHECKSUM
625 $(LINUX_DIR)/net/netfilter/xt_CHECKSUM.ko \
626 $(foreach mod,$(IPT_CHECKSUM-m),$(LINUX_DIR)/net/$(mod).ko)
627 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CHECKSUM-m)))
628 $(call AddDepends/ipt)
631 define KernelPackage/ipt-checksum/description
632 Kernel modules for CHECKSUM fillin target
635 $(eval $(call KernelPackage,ipt-checksum))
638 define KernelPackage/ipt-iprange
639 TITLE:=Module for matching ip ranges
640 KCONFIG:=$(KCONFIG_IPT_IPRANGE)
641 FILES:=$(foreach mod,$(IPT_IPRANGE-m),$(LINUX_DIR)/net/$(mod).ko)
642 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPRANGE-m)))
643 $(call AddDepends/ipt)
646 define KernelPackage/ipt-iprange/description
647 Netfilter (IPv4) module for matching ip ranges
652 $(eval $(call KernelPackage,ipt-iprange))
654 define KernelPackage/ipt-cluster
655 TITLE:=Module for matching cluster
656 KCONFIG:=$(KCONFIG_IPT_CLUSTER)
657 FILES:=$(foreach mod,$(IPT_CLUSTER-m),$(LINUX_DIR)/net/$(mod).ko)
658 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTER-m)))
659 $(call AddDepends/ipt)
662 define KernelPackage/ipt-cluster/description
663 Netfilter (IPv4/IPv6) module for matching cluster
664 This option allows you to build work-load-sharing clusters of
665 network servers/stateful firewalls without having a dedicated
666 load-balancing router/server/switch. Basically, this match returns
667 true when the packet must be handled by this cluster node. Thus,
668 all nodes see all packets and this match decides which node handles
669 what packets. The work-load sharing algorithm is based on source
672 This module is usable for ipv4 and ipv6.
674 To use it also enable iptables-mod-cluster
676 see `iptables -m cluster --help` for more information.
679 $(eval $(call KernelPackage,ipt-cluster))
681 define KernelPackage/ipt-clusterip
682 TITLE:=Module for CLUSTERIP
683 KCONFIG:=$(KCONFIG_IPT_CLUSTERIP)
684 FILES:=$(foreach mod,$(IPT_CLUSTERIP-m),$(LINUX_DIR)/net/$(mod).ko)
685 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTERIP-m)))
686 $(call AddDepends/ipt,+kmod-nf-conntrack)
689 define KernelPackage/ipt-clusterip/description
690 Netfilter (IPv4-only) module for CLUSTERIP
691 The CLUSTERIP target allows you to build load-balancing clusters of
692 network servers without having a dedicated load-balancing
693 router/server/switch.
695 To use it also enable iptables-mod-clusterip
697 see `iptables -j CLUSTERIP --help` for more information.
700 $(eval $(call KernelPackage,ipt-clusterip))
703 define KernelPackage/ipt-extra
705 KCONFIG:=$(KCONFIG_IPT_EXTRA)
706 FILES:=$(foreach mod,$(IPT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
707 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_EXTRA-m)))
708 $(call AddDepends/ipt)
711 define KernelPackage/ipt-extra/description
712 Other Netfilter (IPv4) kernel modules
720 $(eval $(call KernelPackage,ipt-extra))
723 define KernelPackage/ipt-physdev
724 TITLE:=physdev module
725 KCONFIG:=$(KCONFIG_IPT_PHYSDEV)
726 FILES:=$(foreach mod,$(IPT_PHYSDEV-m),$(LINUX_DIR)/net/$(mod).ko)
727 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_PHYSDEV-m)))
728 $(call AddDepends/ipt,+kmod-br-netfilter)
731 define KernelPackage/ipt-physdev/description
732 The iptables physdev kernel module
735 $(eval $(call KernelPackage,ipt-physdev))
738 define KernelPackage/ip6tables
741 DEPENDS:=+kmod-nf-reject6 +kmod-nf-ipt6 +kmod-ipt-core
742 KCONFIG:=$(KCONFIG_IPT_IPV6)
743 FILES:=$(foreach mod,$(IPT_IPV6-m),$(LINUX_DIR)/net/$(mod).ko)
744 AUTOLOAD:=$(call AutoLoad,42,$(notdir $(IPT_IPV6-m)))
747 define KernelPackage/ip6tables/description
748 Netfilter IPv6 firewalling support
751 $(eval $(call KernelPackage,ip6tables))
753 define KernelPackage/ip6tables-extra
755 TITLE:=Extra IPv6 modules
756 DEPENDS:=+kmod-ip6tables
757 KCONFIG:=$(KCONFIG_IPT_IPV6_EXTRA)
758 FILES:=$(foreach mod,$(IPT_IPV6_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
759 AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_IPV6_EXTRA-m)))
762 define KernelPackage/ip6tables-extra/description
763 Netfilter IPv6 extra header matching modules
766 $(eval $(call KernelPackage,ip6tables-extra))
768 ARP_MODULES = arp_tables arpt_mangle arptable_filter
769 define KernelPackage/arptables
771 TITLE:=ARP firewalling modules
772 DEPENDS:=+kmod-ipt-core
773 FILES:=$(LINUX_DIR)/net/ipv4/netfilter/arp*.ko
774 KCONFIG:=CONFIG_IP_NF_ARPTABLES \
775 CONFIG_IP_NF_ARPFILTER \
776 CONFIG_IP_NF_ARP_MANGLE
777 AUTOLOAD:=$(call AutoProbe,$(ARP_MODULES))
780 define KernelPackage/arptables/description
781 Kernel modules for ARP firewalling
784 $(eval $(call KernelPackage,arptables))
787 define KernelPackage/br-netfilter
789 TITLE:=Bridge netfilter support modules
790 DEPENDS:=+kmod-ipt-core
791 FILES:=$(LINUX_DIR)/net/bridge/br_netfilter.ko
792 KCONFIG:=CONFIG_BRIDGE_NETFILTER
793 AUTOLOAD:=$(call AutoProbe,br_netfilter)
796 define KernelPackage/br-netfilter/install
797 $(INSTALL_DIR) $(1)/etc/sysctl.d
798 $(INSTALL_DATA) ./files/sysctl-br-netfilter.conf $(1)/etc/sysctl.d/11-br-netfilter.conf
801 $(eval $(call KernelPackage,br-netfilter))
804 define KernelPackage/ebtables
806 TITLE:=Bridge firewalling modules
807 DEPENDS:=+kmod-ipt-core
808 FILES:=$(foreach mod,$(EBTABLES-m),$(LINUX_DIR)/net/$(mod).ko)
809 KCONFIG:=$(KCONFIG_EBTABLES)
810 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES-m)))
813 define KernelPackage/ebtables/description
814 ebtables is a general, extensible frame/packet identification
815 framework. It provides you to do Ethernet
816 filtering/NAT/brouting on the Ethernet bridge.
819 $(eval $(call KernelPackage,ebtables))
822 define AddDepends/ebtables
824 DEPENDS+= +kmod-ebtables $(1)
828 define KernelPackage/ebtables-ipv4
829 TITLE:=ebtables: IPv4 support
830 FILES:=$(foreach mod,$(EBTABLES_IP4-m),$(LINUX_DIR)/net/$(mod).ko)
831 KCONFIG:=$(KCONFIG_EBTABLES_IP4)
832 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP4-m)))
833 $(call AddDepends/ebtables)
836 define KernelPackage/ebtables-ipv4/description
837 This option adds the IPv4 support to ebtables, which allows basic
838 IPv4 header field filtering, ARP filtering as well as SNAT, DNAT targets.
841 $(eval $(call KernelPackage,ebtables-ipv4))
844 define KernelPackage/ebtables-ipv6
845 TITLE:=ebtables: IPv6 support
846 FILES:=$(foreach mod,$(EBTABLES_IP6-m),$(LINUX_DIR)/net/$(mod).ko)
847 KCONFIG:=$(KCONFIG_EBTABLES_IP6)
848 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP6-m)))
849 $(call AddDepends/ebtables)
852 define KernelPackage/ebtables-ipv6/description
853 This option adds the IPv6 support to ebtables, which allows basic
854 IPv6 header field filtering and target support.
857 $(eval $(call KernelPackage,ebtables-ipv6))
860 define KernelPackage/ebtables-watchers
861 TITLE:=ebtables: watchers support
862 FILES:=$(foreach mod,$(EBTABLES_WATCHERS-m),$(LINUX_DIR)/net/$(mod).ko)
863 KCONFIG:=$(KCONFIG_EBTABLES_WATCHERS)
864 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_WATCHERS-m)))
865 $(call AddDepends/ebtables)
868 define KernelPackage/ebtables-watchers/description
869 This option adds the log watchers, that you can use in any rule
870 in any ebtables table.
873 $(eval $(call KernelPackage,ebtables-watchers))
876 define KernelPackage/nfnetlink
878 TITLE:=Netlink-based userspace interface
879 FILES:=$(foreach mod,$(NFNETLINK-m),$(LINUX_DIR)/net/$(mod).ko)
880 KCONFIG:=$(KCONFIG_NFNETLINK)
881 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK-m)))
884 define KernelPackage/nfnetlink/description
885 Kernel modules support for a netlink-based userspace interface
888 $(eval $(call KernelPackage,nfnetlink))
891 define AddDepends/nfnetlink
893 DEPENDS+=+kmod-nfnetlink $(1)
897 define KernelPackage/nfnetlink-log
898 TITLE:=Netfilter LOG over NFNETLINK interface
899 FILES:=$(foreach mod,$(NFNETLINK_LOG-m),$(LINUX_DIR)/net/$(mod).ko)
900 KCONFIG:=$(KCONFIG_NFNETLINK_LOG)
901 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_LOG-m)))
902 $(call AddDepends/nfnetlink)
905 define KernelPackage/nfnetlink-log/description
906 Kernel modules support for logging packets via NFNETLINK
911 $(eval $(call KernelPackage,nfnetlink-log))
914 define KernelPackage/nfnetlink-queue
915 TITLE:=Netfilter QUEUE over NFNETLINK interface
916 FILES:=$(foreach mod,$(NFNETLINK_QUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
917 KCONFIG:=$(KCONFIG_NFNETLINK_QUEUE)
918 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_QUEUE-m)))
919 $(call AddDepends/nfnetlink)
922 define KernelPackage/nfnetlink-queue/description
923 Kernel modules support for queueing packets via NFNETLINK
928 $(eval $(call KernelPackage,nfnetlink-queue))
931 define KernelPackage/nf-conntrack-netlink
932 TITLE:=Connection tracking netlink interface
933 FILES:=$(LINUX_DIR)/net/netfilter/nf_conntrack_netlink.ko
934 KCONFIG:=CONFIG_NF_CT_NETLINK CONFIG_NF_CONNTRACK_EVENTS=y
935 AUTOLOAD:=$(call AutoProbe,nf_conntrack_netlink)
936 $(call AddDepends/nfnetlink,+kmod-ipt-conntrack)
939 define KernelPackage/nf-conntrack-netlink/description
940 Kernel modules support for a netlink-based connection tracking
944 $(eval $(call KernelPackage,nf-conntrack-netlink))
946 define KernelPackage/ipt-hashlimit
948 TITLE:=Netfilter hashlimit match
949 DEPENDS:=+kmod-ipt-core
950 KCONFIG:=$(KCONFIG_IPT_HASHLIMIT)
951 FILES:=$(LINUX_DIR)/net/netfilter/xt_hashlimit.ko
952 AUTOLOAD:=$(call AutoProbe,xt_hashlimit)
953 $(call KernelPackage/ipt)
956 define KernelPackage/ipt-hashlimit/description
957 Kernel modules support for the hashlimit bucket match module
960 $(eval $(call KernelPackage,ipt-hashlimit))
962 define KernelPackage/ipt-rpfilter
964 TITLE:=Netfilter rpfilter match
965 DEPENDS:=+kmod-ipt-core
966 KCONFIG:=$(KCONFIG_IPT_RPFILTER)
967 FILES:=$(realpath $(LINUX_DIR)/net/ipv4/netfilter/ipt_rpfilter.ko)
968 AUTOLOAD:=$(call AutoProbe,ipt_rpfilter)
969 $(call KernelPackage/ipt)
972 define KernelPackage/ipt-rpfilter/description
973 Kernel modules support for the Netfilter rpfilter match
976 $(eval $(call KernelPackage,ipt-rpfilter))
979 define KernelPackage/ip6t-rpfilter
981 TITLE:=Netfilter rpfilter match (IPv6)
982 DEPENDS:=+kmod-ipt-core
983 KCONFIG:=$(KCONFIG_IP6T_RPFILTER)
984 FILES:=$(realpath $(LINUX_DIR)/net/ipv6/netfilter/ip6t_rpfilter.ko)
985 AUTOLOAD:=$(call AutoProbe,ip6t_rpfilter)
986 $(call KernelPackage/ipt)
989 define KernelPackage/ip6t-rpfilter/description
990 Kernel modules support for the Netfilter rpfilter match (IPv6)
993 $(eval $(call KernelPackage,ip6t-rpfilter))
996 define KernelPackage/nft-core
998 TITLE:=Netfilter nf_tables support
999 DEPENDS:=+kmod-nfnetlink +kmod-nf-reject +kmod-nf-conntrack
1000 FILES:=$(foreach mod,$(NFT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
1001 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CORE-m)))
1003 CONFIG_NFT_COMPAT=n \
1004 CONFIG_NFT_QUEUE=n \
1008 define KernelPackage/nft-core/description
1009 Kernel module support for nftables
1012 $(eval $(call KernelPackage,nft-core))
1014 define KernelPackage/nft-core6
1016 TITLE:=Netfilter nf_tables support (IPv6)
1017 DEPENDS:=+kmod-nft-core +kmod-nf-reject6 +kmod-nf-conntrack6
1018 FILES:=$(foreach mod,$(NFT_CORE6-m),$(LINUX_DIR)/net/$(mod).ko)
1019 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CORE6-m)))
1020 KCONFIG:= $(KCONFIG_NFT_CORE6)
1023 define KernelPackage/nft-core6/description
1024 Kernel module support for nftables (IPv6)
1027 $(eval $(call KernelPackage,nft-core6))
1029 define KernelPackage/nft-arp
1031 TITLE:=Netfilter nf_tables ARP table support
1032 DEPENDS:=+kmod-nft-core
1033 FILES:=$(foreach mod,$(NFT_ARP-m),$(LINUX_DIR)/net/$(mod).ko)
1034 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_ARP-m)))
1035 KCONFIG:=$(KCONFIG_NFT_ARP)
1038 $(eval $(call KernelPackage,nft-arp))
1041 define KernelPackage/nft-bridge
1043 TITLE:=Netfilter nf_tables bridge table support
1044 DEPENDS:=+kmod-nft-core
1045 FILES:=$(foreach mod,$(NFT_BRIDGE-m),$(LINUX_DIR)/net/$(mod).ko)
1046 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_BRIDGE-m)))
1048 CONFIG_NF_LOG_BRIDGE=n \
1049 $(KCONFIG_NFT_BRIDGE)
1052 $(eval $(call KernelPackage,nft-bridge))
1055 define KernelPackage/nft-nat
1057 TITLE:=Netfilter nf_tables NAT support
1058 DEPENDS:=+kmod-nft-core +kmod-nf-nat
1059 FILES:=$(foreach mod,$(NFT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
1060 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT-m)))
1061 KCONFIG:=$(KCONFIG_NFT_NAT)
1064 $(eval $(call KernelPackage,nft-nat))
1067 define KernelPackage/nft-offload
1069 TITLE:=Netfilter nf_tables routing/NAT offload support
1070 DEPENDS:=+kmod-nf-flow +kmod-nft-nat
1072 CONFIG_NF_FLOW_TABLE_INET \
1073 CONFIG_NF_FLOW_TABLE_IPV4 \
1074 CONFIG_NF_FLOW_TABLE_IPV6 \
1075 CONFIG_NFT_FLOW_OFFLOAD
1077 $(LINUX_DIR)/net/netfilter/nf_flow_table_inet.ko \
1078 $(LINUX_DIR)/net/ipv4/netfilter/nf_flow_table_ipv4.ko \
1079 $(LINUX_DIR)/net/ipv6/netfilter/nf_flow_table_ipv6.ko \
1080 $(LINUX_DIR)/net/netfilter/nft_flow_offload.ko
1081 AUTOLOAD:=$(call AutoProbe,nf_flow_table_inet nf_flow_table_ipv4 nf_flow_table_ipv6 nft_flow_offload)
1084 $(eval $(call KernelPackage,nft-offload))
1087 define KernelPackage/nft-offload6
1089 TITLE:=Netfilter nf_tables routing/NAT offload support (IPv6)
1090 DEPENDS:=+kmod-nft-offload
1091 KCONFIG:=CONFIG_NF_FLOW_TABLE_IPV6
1092 FILES:=$(LINUX_DIR)/net/ipv6/netfilter/nf_flow_table_ipv6.ko
1093 AUTOLOAD:=$(call AutoProbe,nf_flow_table_ipv6)
1096 $(eval $(call KernelPackage,nft-offload6))
1098 define KernelPackage/nft-nat6
1100 TITLE:=Netfilter nf_tables IPv6-NAT support
1101 DEPENDS:=+kmod-nft-nat +kmod-nf-nat6
1102 FILES:=$(foreach mod,$(NFT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
1103 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT6-m)))
1104 KCONFIG:=$(KCONFIG_NFT_NAT6)
1107 $(eval $(call KernelPackage,nft-nat6))
1109 define KernelPackage/nft-netdev
1111 TITLE:=Netfilter nf_tables netdev support
1112 DEPENDS:=+kmod-nft-core
1114 CONFIG_NETFILTER_INGRESS=y \
1115 CONFIG_NF_TABLES_NETDEV \
1116 CONFIG_NF_DUP_NETDEV \
1117 CONFIG_NFT_DUP_NETDEV \
1118 CONFIG_NFT_FWD_NETDEV
1120 $(LINUX_DIR)/net/netfilter/nf_tables_netdev.ko \
1121 $(LINUX_DIR)/net/netfilter/nf_dup_netdev.ko \
1122 $(LINUX_DIR)/net/netfilter/nft_dup_netdev.ko \
1123 $(LINUX_DIR)/net/netfilter/nft_fwd_netdev.ko
1124 AUTOLOAD:=$(call AutoProbe,nf_tables_netdev nf_dup_netdev nft_dup_netdev nft_fwd_netdev)
1127 $(eval $(call KernelPackage,nft-netdev))