3 # Copyright (C) 2006-2010 OpenWrt.org
5 # This is free software, licensed under the GNU General Public License v2.
6 # See /LICENSE for more information.
9 NF_MENU:=Netfilter Extensions
11 include $(INCLUDE_DIR)/netfilter.mk
14 define KernelPackage/nf-reject
16 TITLE:=Netfilter IPv4 reject support
19 CONFIG_NETFILTER_ADVANCED=y \
21 FILES:=$(foreach mod,$(NF_REJECT-m),$(LINUX_DIR)/net/$(mod).ko)
22 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_REJECT-m)))
25 $(eval $(call KernelPackage,nf-reject))
28 define KernelPackage/nf-reject6
30 TITLE:=Netfilter IPv6 reject support
33 CONFIG_NETFILTER_ADVANCED=y \
36 FILES:=$(foreach mod,$(NF_REJECT6-m),$(LINUX_DIR)/net/$(mod).ko)
37 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_REJECT6-m)))
40 $(eval $(call KernelPackage,nf-reject6))
43 define KernelPackage/nf-ipt
46 KCONFIG:=$(KCONFIG_NF_IPT)
47 FILES:=$(foreach mod,$(NF_IPT-m),$(LINUX_DIR)/net/$(mod).ko)
48 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT-m)))
51 $(eval $(call KernelPackage,nf-ipt))
54 define KernelPackage/nf-ipt6
57 KCONFIG:=$(KCONFIG_NF_IPT6)
58 FILES:=$(foreach mod,$(NF_IPT6-m),$(LINUX_DIR)/net/$(mod).ko)
59 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT6-m)))
63 $(eval $(call KernelPackage,nf-ipt6))
67 define KernelPackage/ipt-core
70 KCONFIG:=$(KCONFIG_IPT_CORE)
71 FILES:=$(foreach mod,$(IPT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
72 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CORE-m)))
73 DEPENDS:=+kmod-nf-reject +kmod-nf-ipt
76 define KernelPackage/ipt-core/description
77 Netfilter core kernel modules
88 $(eval $(call KernelPackage,ipt-core))
91 define KernelPackage/nf-conntrack
93 TITLE:=Netfilter connection tracking
96 CONFIG_NETFILTER_ADVANCED=y \
97 CONFIG_NF_CONNTRACK_MARK=y \
98 CONFIG_NF_CONNTRACK_ZONES=y \
99 $(KCONFIG_NF_CONNTRACK)
100 FILES:=$(foreach mod,$(NF_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
101 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK-m)))
104 $(eval $(call KernelPackage,nf-conntrack))
107 define KernelPackage/nf-conntrack6
109 TITLE:=Netfilter IPv6 connection tracking
110 KCONFIG:=$(KCONFIG_NF_CONNTRACK6)
111 DEPENDS:=@IPV6 +kmod-nf-conntrack
112 FILES:=$(foreach mod,$(NF_CONNTRACK6-m),$(LINUX_DIR)/net/$(mod).ko)
113 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK6-m)))
116 $(eval $(call KernelPackage,nf-conntrack6))
119 define KernelPackage/nf-nat
122 KCONFIG:=$(KCONFIG_NF_NAT)
123 DEPENDS:=+kmod-nf-conntrack
124 FILES:=$(foreach mod,$(NF_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
125 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT-m)))
128 $(eval $(call KernelPackage,nf-nat))
131 define KernelPackage/nf-nat6
133 TITLE:=Netfilter IPV6-NAT
134 KCONFIG:=$(KCONFIG_NF_NAT6)
135 DEPENDS:=+kmod-nf-conntrack6 +kmod-nf-nat
136 FILES:=$(foreach mod,$(NF_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
137 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT6-m)))
140 $(eval $(call KernelPackage,nf-nat6))
143 define KernelPackage/nf-flow
145 TITLE:=Netfilter flowtable support
147 CONFIG_NETFILTER_INGRESS=y \
148 CONFIG_NF_FLOW_TABLE \
149 CONFIG_NF_FLOW_TABLE_HW
150 DEPENDS:=+kmod-nf-conntrack @!LINUX_3_18 @!LINUX_4_4 @!LINUX_4_9
152 $(LINUX_DIR)/net/netfilter/nf_flow_table.ko \
153 $(LINUX_DIR)/net/netfilter/nf_flow_table_hw.ko
154 AUTOLOAD:=$(call AutoProbe,nf_flow_table nf_flow_table_hw)
157 $(eval $(call KernelPackage,nf-flow))
160 define AddDepends/ipt
162 DEPENDS+= +kmod-ipt-core $(1)
166 define KernelPackage/ipt-conntrack
167 TITLE:=Basic connection tracking modules
168 KCONFIG:=$(KCONFIG_IPT_CONNTRACK)
169 FILES:=$(foreach mod,$(IPT_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
170 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK-m)))
171 $(call AddDepends/ipt,+kmod-nf-conntrack)
174 define KernelPackage/ipt-conntrack/description
175 Netfilter (IPv4) kernel modules for connection tracking
184 $(eval $(call KernelPackage,ipt-conntrack))
187 define KernelPackage/ipt-conntrack-extra
188 TITLE:=Extra connection tracking modules
189 KCONFIG:=$(KCONFIG_IPT_CONNTRACK_EXTRA)
190 FILES:=$(foreach mod,$(IPT_CONNTRACK_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
191 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_EXTRA-m)))
192 $(call AddDepends/ipt,+kmod-ipt-conntrack)
195 define KernelPackage/ipt-conntrack-extra/description
196 Netfilter (IPv4) extra kernel modules for connection tracking
205 $(eval $(call KernelPackage,ipt-conntrack-extra))
207 define KernelPackage/ipt-conntrack-label
208 TITLE:=Module for handling connection tracking labels
209 KCONFIG:=$(KCONFIG_IPT_CONNTRACK_LABEL)
210 FILES:=$(foreach mod,$(IPT_CONNTRACK_LABEL-m),$(LINUX_DIR)/net/$(mod).ko)
211 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_LABEL-m)))
212 $(call AddDepends/ipt,+kmod-ipt-conntrack)
215 define KernelPackage/ipt-conntrack-label/description
216 Netfilter (IPv4) module for handling connection tracking labels
221 $(eval $(call KernelPackage,ipt-conntrack-label))
223 define KernelPackage/ipt-filter
224 TITLE:=Modules for packet content inspection
225 KCONFIG:=$(KCONFIG_IPT_FILTER)
226 FILES:=$(foreach mod,$(IPT_FILTER-m),$(LINUX_DIR)/net/$(mod).ko)
227 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FILTER-m)))
228 $(call AddDepends/ipt,+kmod-lib-textsearch +kmod-ipt-conntrack)
231 define KernelPackage/ipt-filter/description
232 Netfilter (IPv4) kernel modules for packet content inspection
237 $(eval $(call KernelPackage,ipt-filter))
240 define KernelPackage/ipt-offload
241 TITLE:=Netfilter routing/NAT offload support
242 KCONFIG:=CONFIG_NETFILTER_XT_TARGET_FLOWOFFLOAD
243 FILES:=$(foreach mod,$(IPT_FLOW-m),$(LINUX_DIR)/net/$(mod).ko)
244 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FLOW-m)))
245 $(call AddDepends/ipt,+kmod-nf-flow)
248 $(eval $(call KernelPackage,ipt-offload))
251 define KernelPackage/ipt-ipopt
252 TITLE:=Modules for matching/changing IP packet options
253 KCONFIG:=$(KCONFIG_IPT_IPOPT)
254 FILES:=$(foreach mod,$(IPT_IPOPT-m),$(LINUX_DIR)/net/$(mod).ko)
255 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPOPT-m)))
256 $(call AddDepends/ipt)
259 define KernelPackage/ipt-ipopt/description
260 Netfilter (IPv4) modules for matching/changing IP packet options
275 $(eval $(call KernelPackage,ipt-ipopt))
278 define KernelPackage/ipt-ipsec
279 TITLE:=Modules for matching IPSec packets
280 KCONFIG:=$(KCONFIG_IPT_IPSEC)
281 FILES:=$(foreach mod,$(IPT_IPSEC-m),$(LINUX_DIR)/net/$(mod).ko)
282 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPSEC-m)))
283 $(call AddDepends/ipt)
286 define KernelPackage/ipt-ipsec/description
287 Netfilter (IPv4) modules for matching IPSec packets
294 $(eval $(call KernelPackage,ipt-ipsec))
298 ipset/ip_set_bitmap_ip \
299 ipset/ip_set_bitmap_ipmac \
300 ipset/ip_set_bitmap_port \
301 ipset/ip_set_hash_ip \
302 ipset/ip_set_hash_ipmark \
303 ipset/ip_set_hash_ipport \
304 ipset/ip_set_hash_ipportip \
305 ipset/ip_set_hash_ipportnet \
306 ipset/ip_set_hash_mac \
307 ipset/ip_set_hash_netportnet \
308 ipset/ip_set_hash_net \
309 ipset/ip_set_hash_netnet \
310 ipset/ip_set_hash_netport \
311 ipset/ip_set_hash_netiface \
312 ipset/ip_set_list_set \
315 define KernelPackage/ipt-ipset
316 SUBMENU:=Netfilter Extensions
317 TITLE:=IPset netfilter modules
318 DEPENDS+= +kmod-ipt-core +kmod-nfnetlink
321 CONFIG_IP_SET_MAX=256 \
322 CONFIG_NETFILTER_XT_SET \
323 CONFIG_IP_SET_BITMAP_IP \
324 CONFIG_IP_SET_BITMAP_IPMAC \
325 CONFIG_IP_SET_BITMAP_PORT \
326 CONFIG_IP_SET_HASH_IP \
327 CONFIG_IP_SET_HASH_IPMARK \
328 CONFIG_IP_SET_HASH_IPPORT \
329 CONFIG_IP_SET_HASH_IPPORTIP \
330 CONFIG_IP_SET_HASH_IPPORTNET \
331 CONFIG_IP_SET_HASH_MAC \
332 CONFIG_IP_SET_HASH_NET \
333 CONFIG_IP_SET_HASH_NETNET \
334 CONFIG_IP_SET_HASH_NETIFACE \
335 CONFIG_IP_SET_HASH_NETPORT \
336 CONFIG_IP_SET_HASH_NETPORTNET \
337 CONFIG_IP_SET_LIST_SET \
338 CONFIG_NET_EMATCH_IPSET=n
339 FILES:=$(foreach mod,$(IPSET_MODULES),$(LINUX_DIR)/net/netfilter/$(mod).ko)
340 AUTOLOAD:=$(call AutoLoad,49,$(notdir $(IPSET_MODULES)))
342 $(eval $(call KernelPackage,ipt-ipset))
345 define KernelPackage/ipt-nat
346 TITLE:=Basic NAT targets
347 KCONFIG:=$(KCONFIG_IPT_NAT)
348 FILES:=$(foreach mod,$(IPT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
349 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT-m)))
350 $(call AddDepends/ipt,+kmod-nf-nat)
353 define KernelPackage/ipt-nat/description
354 Netfilter (IPv4) kernel modules for basic NAT targets
359 $(eval $(call KernelPackage,ipt-nat))
362 define KernelPackage/ipt-raw
363 TITLE:=Netfilter IPv4 raw table support
364 KCONFIG:=CONFIG_IP_NF_RAW
365 FILES:=$(LINUX_DIR)/net/ipv4/netfilter/iptable_raw.ko
366 AUTOLOAD:=$(call AutoProbe,iptable_raw)
367 $(call AddDepends/ipt)
370 $(eval $(call KernelPackage,ipt-raw))
373 define KernelPackage/ipt-raw6
374 TITLE:=Netfilter IPv6 raw table support
375 KCONFIG:=CONFIG_IP6_NF_RAW
376 FILES:=$(LINUX_DIR)/net/ipv6/netfilter/ip6table_raw.ko
377 AUTOLOAD:=$(call AutoProbe,ip6table_raw)
378 $(call AddDepends/ipt,+kmod-ip6tables)
381 $(eval $(call KernelPackage,ipt-raw6))
384 define KernelPackage/ipt-nat6
385 TITLE:=IPv6 NAT targets
386 KCONFIG:=$(KCONFIG_IPT_NAT6)
387 FILES:=$(foreach mod,$(IPT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
388 AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_NAT6-m)))
389 $(call AddDepends/ipt,+kmod-nf-nat6)
390 $(call AddDepends/ipt,+kmod-ipt-conntrack)
391 $(call AddDepends/ipt,+kmod-ipt-nat)
392 $(call AddDepends/ipt,+kmod-ip6tables)
395 define KernelPackage/ipt-nat6/description
396 Netfilter (IPv6) kernel modules for NAT targets
399 $(eval $(call KernelPackage,ipt-nat6))
402 define KernelPackage/ipt-nat-extra
403 TITLE:=Extra NAT targets
404 KCONFIG:=$(KCONFIG_IPT_NAT_EXTRA)
405 FILES:=$(foreach mod,$(IPT_NAT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
406 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT_EXTRA-m)))
407 $(call AddDepends/ipt,+kmod-ipt-nat)
410 define KernelPackage/ipt-nat-extra/description
411 Netfilter (IPv4) kernel modules for extra NAT targets
417 $(eval $(call KernelPackage,ipt-nat-extra))
420 define KernelPackage/nf-nathelper
422 TITLE:=Basic Conntrack and NAT helpers
423 KCONFIG:=$(KCONFIG_NF_NATHELPER)
424 FILES:=$(foreach mod,$(NF_NATHELPER-m),$(LINUX_DIR)/net/$(mod).ko)
425 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER-m)))
426 DEPENDS:=+kmod-nf-nat
429 define KernelPackage/nf-nathelper/description
430 Default Netfilter (IPv4) Conntrack and NAT helpers
435 $(eval $(call KernelPackage,nf-nathelper))
438 define KernelPackage/nf-nathelper-extra
440 TITLE:=Extra Conntrack and NAT helpers
441 KCONFIG:=$(KCONFIG_NF_NATHELPER_EXTRA)
442 FILES:=$(foreach mod,$(NF_NATHELPER_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
443 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER_EXTRA-m)))
444 DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch
447 define KernelPackage/nf-nathelper-extra/description
448 Extra Netfilter (IPv4) Conntrack and NAT helpers
462 $(eval $(call KernelPackage,nf-nathelper-extra))
465 define KernelPackage/ipt-ulog
466 TITLE:=Module for user-space packet logging
467 KCONFIG:=$(KCONFIG_IPT_ULOG)
468 FILES:=$(foreach mod,$(IPT_ULOG-m),$(LINUX_DIR)/net/$(mod).ko)
469 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_ULOG-m)))
470 $(call AddDepends/ipt)
473 define KernelPackage/ipt-ulog/description
474 Netfilter (IPv4) module for user-space packet logging
479 $(eval $(call KernelPackage,ipt-ulog))
482 define KernelPackage/ipt-nflog
483 TITLE:=Module for user-space packet logging
484 KCONFIG:=$(KCONFIG_IPT_NFLOG)
485 FILES:=$(foreach mod,$(IPT_NFLOG-m),$(LINUX_DIR)/net/$(mod).ko)
486 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFLOG-m)))
487 $(call AddDepends/ipt,+kmod-nfnetlink-log)
490 define KernelPackage/ipt-nflog/description
491 Netfilter module for user-space packet logging
496 $(eval $(call KernelPackage,ipt-nflog))
499 define KernelPackage/ipt-nfqueue
500 TITLE:=Module for user-space packet queuing
501 KCONFIG:=$(KCONFIG_IPT_NFQUEUE)
502 FILES:=$(foreach mod,$(IPT_NFQUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
503 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFQUEUE-m)))
504 $(call AddDepends/ipt,+kmod-nfnetlink-queue)
507 define KernelPackage/ipt-nfqueue/description
508 Netfilter module for user-space packet queuing
513 $(eval $(call KernelPackage,ipt-nfqueue))
516 define KernelPackage/ipt-debug
517 TITLE:=Module for debugging/development
518 KCONFIG:=$(KCONFIG_IPT_DEBUG)
519 FILES:=$(foreach mod,$(IPT_DEBUG-m),$(LINUX_DIR)/net/$(mod).ko)
520 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_DEBUG-m)))
521 $(call AddDepends/ipt,+kmod-ipt-raw +IPV6:kmod-ipt-raw6)
524 define KernelPackage/ipt-debug/description
525 Netfilter modules for debugging/development of the firewall
530 $(eval $(call KernelPackage,ipt-debug))
533 define KernelPackage/ipt-led
534 TITLE:=Module to trigger a LED with a Netfilter rule
535 KCONFIG:=$(KCONFIG_IPT_LED)
536 FILES:=$(foreach mod,$(IPT_LED-m),$(LINUX_DIR)/net/$(mod).ko)
537 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_LED-m)))
538 $(call AddDepends/ipt)
541 define KernelPackage/ipt-led/description
542 Netfilter target to trigger a LED when a network packet is matched.
545 $(eval $(call KernelPackage,ipt-led))
547 define KernelPackage/ipt-tproxy
548 TITLE:=Transparent proxying support
549 DEPENDS+=+kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +IPV6:kmod-ip6tables
551 CONFIG_NETFILTER_XT_MATCH_SOCKET \
552 CONFIG_NETFILTER_XT_TARGET_TPROXY
554 $(foreach mod,$(IPT_TPROXY-m),$(LINUX_DIR)/net/$(mod).ko)
555 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_TPROXY-m)))
556 $(call AddDepends/ipt)
559 define KernelPackage/ipt-tproxy/description
560 Kernel modules for Transparent Proxying
563 $(eval $(call KernelPackage,ipt-tproxy))
565 define KernelPackage/ipt-tee
567 DEPENDS:=+kmod-ipt-conntrack
569 CONFIG_NETFILTER_XT_TARGET_TEE
571 $(LINUX_DIR)/net/netfilter/xt_TEE.ko \
572 $(foreach mod,$(IPT_TEE-m),$(LINUX_DIR)/net/$(mod).ko)
573 AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_TEE-m)))
574 $(call AddDepends/ipt)
577 define KernelPackage/ipt-tee/description
578 Kernel modules for TEE
581 $(eval $(call KernelPackage,ipt-tee))
584 define KernelPackage/ipt-u32
587 CONFIG_NETFILTER_XT_MATCH_U32
589 $(LINUX_DIR)/net/netfilter/xt_u32.ko \
590 $(foreach mod,$(IPT_U32-m),$(LINUX_DIR)/net/$(mod).ko)
591 AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_U32-m)))
592 $(call AddDepends/ipt)
595 define KernelPackage/ipt-u32/description
596 Kernel modules for U32
599 $(eval $(call KernelPackage,ipt-u32))
601 define KernelPackage/ipt-checksum
602 TITLE:=CHECKSUM support
604 CONFIG_NETFILTER_XT_TARGET_CHECKSUM
606 $(LINUX_DIR)/net/netfilter/xt_CHECKSUM.ko \
607 $(foreach mod,$(IPT_CHECKSUM-m),$(LINUX_DIR)/net/$(mod).ko)
608 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CHECKSUM-m)))
609 $(call AddDepends/ipt)
612 define KernelPackage/ipt-checksum/description
613 Kernel modules for CHECKSUM fillin target
616 $(eval $(call KernelPackage,ipt-checksum))
619 define KernelPackage/ipt-iprange
620 TITLE:=Module for matching ip ranges
621 KCONFIG:=$(KCONFIG_IPT_IPRANGE)
622 FILES:=$(foreach mod,$(IPT_IPRANGE-m),$(LINUX_DIR)/net/$(mod).ko)
623 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPRANGE-m)))
624 $(call AddDepends/ipt)
627 define KernelPackage/ipt-iprange/description
628 Netfilter (IPv4) module for matching ip ranges
633 $(eval $(call KernelPackage,ipt-iprange))
635 define KernelPackage/ipt-cluster
636 TITLE:=Module for matching cluster
637 KCONFIG:=$(KCONFIG_IPT_CLUSTER)
638 FILES:=$(foreach mod,$(IPT_CLUSTER-m),$(LINUX_DIR)/net/$(mod).ko)
639 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTER-m)))
640 $(call AddDepends/ipt)
643 define KernelPackage/ipt-cluster/description
644 Netfilter (IPv4/IPv6) module for matching cluster
645 This option allows you to build work-load-sharing clusters of
646 network servers/stateful firewalls without having a dedicated
647 load-balancing router/server/switch. Basically, this match returns
648 true when the packet must be handled by this cluster node. Thus,
649 all nodes see all packets and this match decides which node handles
650 what packets. The work-load sharing algorithm is based on source
653 This module is usable for ipv4 and ipv6.
655 To use it also enable iptables-mod-cluster
657 see `iptables -m cluster --help` for more information.
660 $(eval $(call KernelPackage,ipt-cluster))
662 define KernelPackage/ipt-clusterip
663 TITLE:=Module for CLUSTERIP
664 KCONFIG:=$(KCONFIG_IPT_CLUSTERIP)
665 FILES:=$(foreach mod,$(IPT_CLUSTERIP-m),$(LINUX_DIR)/net/$(mod).ko)
666 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTERIP-m)))
667 $(call AddDepends/ipt,+kmod-nf-conntrack)
670 define KernelPackage/ipt-clusterip/description
671 Netfilter (IPv4-only) module for CLUSTERIP
672 The CLUSTERIP target allows you to build load-balancing clusters of
673 network servers without having a dedicated load-balancing
674 router/server/switch.
676 To use it also enable iptables-mod-clusterip
678 see `iptables -j CLUSTERIP --help` for more information.
681 $(eval $(call KernelPackage,ipt-clusterip))
684 define KernelPackage/ipt-extra
686 KCONFIG:=$(KCONFIG_IPT_EXTRA)
687 FILES:=$(foreach mod,$(IPT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
688 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_EXTRA-m)))
689 $(call AddDepends/ipt)
692 define KernelPackage/ipt-extra/description
693 Other Netfilter (IPv4) kernel modules
701 $(eval $(call KernelPackage,ipt-extra))
704 define KernelPackage/ipt-physdev
705 TITLE:=physdev module
706 KCONFIG:=$(KCONFIG_IPT_PHYSDEV)
707 FILES:=$(foreach mod,$(IPT_PHYSDEV-m),$(LINUX_DIR)/net/$(mod).ko)
708 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_PHYSDEV-m)))
709 $(call AddDepends/ipt,+kmod-br-netfilter)
712 define KernelPackage/ipt-physdev/description
713 The iptables physdev kernel module
716 $(eval $(call KernelPackage,ipt-physdev))
719 define KernelPackage/ip6tables
722 DEPENDS:=+kmod-nf-reject6 +kmod-nf-ipt6 +kmod-ipt-core
723 KCONFIG:=$(KCONFIG_IPT_IPV6)
724 FILES:=$(foreach mod,$(IPT_IPV6-m),$(LINUX_DIR)/net/$(mod).ko)
725 AUTOLOAD:=$(call AutoLoad,42,$(notdir $(IPT_IPV6-m)))
728 define KernelPackage/ip6tables/description
729 Netfilter IPv6 firewalling support
732 $(eval $(call KernelPackage,ip6tables))
734 define KernelPackage/ip6tables-extra
736 TITLE:=Extra IPv6 modules
737 DEPENDS:=+kmod-ip6tables
738 KCONFIG:=$(KCONFIG_IPT_IPV6_EXTRA)
739 FILES:=$(foreach mod,$(IPT_IPV6_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
740 AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_IPV6_EXTRA-m)))
743 define KernelPackage/ip6tables-extra/description
744 Netfilter IPv6 extra header matching modules
747 $(eval $(call KernelPackage,ip6tables-extra))
749 ARP_MODULES = arp_tables arpt_mangle arptable_filter
750 define KernelPackage/arptables
752 TITLE:=ARP firewalling modules
753 DEPENDS:=+kmod-ipt-core
754 FILES:=$(LINUX_DIR)/net/ipv4/netfilter/arp*.ko
755 KCONFIG:=CONFIG_IP_NF_ARPTABLES \
756 CONFIG_IP_NF_ARPFILTER \
757 CONFIG_IP_NF_ARP_MANGLE
758 AUTOLOAD:=$(call AutoProbe,$(ARP_MODULES))
761 define KernelPackage/arptables/description
762 Kernel modules for ARP firewalling
765 $(eval $(call KernelPackage,arptables))
768 define KernelPackage/br-netfilter
770 TITLE:=Bridge netfilter support modules
771 DEPENDS:=+kmod-ipt-core
772 FILES:=$(LINUX_DIR)/net/bridge/br_netfilter.ko
773 KCONFIG:=CONFIG_BRIDGE_NETFILTER
774 AUTOLOAD:=$(call AutoProbe,br_netfilter)
777 $(eval $(call KernelPackage,br-netfilter))
780 define KernelPackage/ebtables
782 TITLE:=Bridge firewalling modules
783 DEPENDS:=+kmod-ipt-core
784 FILES:=$(foreach mod,$(EBTABLES-m),$(LINUX_DIR)/net/$(mod).ko)
785 KCONFIG:=$(KCONFIG_EBTABLES)
786 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES-m)))
789 define KernelPackage/ebtables/description
790 ebtables is a general, extensible frame/packet identification
791 framework. It provides you to do Ethernet
792 filtering/NAT/brouting on the Ethernet bridge.
795 $(eval $(call KernelPackage,ebtables))
798 define AddDepends/ebtables
800 DEPENDS+= +kmod-ebtables $(1)
804 define KernelPackage/ebtables-ipv4
805 TITLE:=ebtables: IPv4 support
806 FILES:=$(foreach mod,$(EBTABLES_IP4-m),$(LINUX_DIR)/net/$(mod).ko)
807 KCONFIG:=$(KCONFIG_EBTABLES_IP4)
808 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP4-m)))
809 $(call AddDepends/ebtables)
812 define KernelPackage/ebtables-ipv4/description
813 This option adds the IPv4 support to ebtables, which allows basic
814 IPv4 header field filtering, ARP filtering as well as SNAT, DNAT targets.
817 $(eval $(call KernelPackage,ebtables-ipv4))
820 define KernelPackage/ebtables-ipv6
821 TITLE:=ebtables: IPv6 support
822 FILES:=$(foreach mod,$(EBTABLES_IP6-m),$(LINUX_DIR)/net/$(mod).ko)
823 KCONFIG:=$(KCONFIG_EBTABLES_IP6)
824 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP6-m)))
825 $(call AddDepends/ebtables)
828 define KernelPackage/ebtables-ipv6/description
829 This option adds the IPv6 support to ebtables, which allows basic
830 IPv6 header field filtering and target support.
833 $(eval $(call KernelPackage,ebtables-ipv6))
836 define KernelPackage/ebtables-watchers
837 TITLE:=ebtables: watchers support
838 FILES:=$(foreach mod,$(EBTABLES_WATCHERS-m),$(LINUX_DIR)/net/$(mod).ko)
839 KCONFIG:=$(KCONFIG_EBTABLES_WATCHERS)
840 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_WATCHERS-m)))
841 $(call AddDepends/ebtables)
844 define KernelPackage/ebtables-watchers/description
845 This option adds the log watchers, that you can use in any rule
846 in any ebtables table.
849 $(eval $(call KernelPackage,ebtables-watchers))
852 define KernelPackage/nfnetlink
854 TITLE:=Netlink-based userspace interface
855 FILES:=$(foreach mod,$(NFNETLINK-m),$(LINUX_DIR)/net/$(mod).ko)
856 KCONFIG:=$(KCONFIG_NFNETLINK)
857 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK-m)))
860 define KernelPackage/nfnetlink/description
861 Kernel modules support for a netlink-based userspace interface
864 $(eval $(call KernelPackage,nfnetlink))
867 define AddDepends/nfnetlink
869 DEPENDS+=+kmod-nfnetlink $(1)
873 define KernelPackage/nfnetlink-log
874 TITLE:=Netfilter LOG over NFNETLINK interface
875 FILES:=$(foreach mod,$(NFNETLINK_LOG-m),$(LINUX_DIR)/net/$(mod).ko)
876 KCONFIG:=$(KCONFIG_NFNETLINK_LOG)
877 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_LOG-m)))
878 $(call AddDepends/nfnetlink)
881 define KernelPackage/nfnetlink-log/description
882 Kernel modules support for logging packets via NFNETLINK
887 $(eval $(call KernelPackage,nfnetlink-log))
890 define KernelPackage/nfnetlink-queue
891 TITLE:=Netfilter QUEUE over NFNETLINK interface
892 FILES:=$(foreach mod,$(NFNETLINK_QUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
893 KCONFIG:=$(KCONFIG_NFNETLINK_QUEUE)
894 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_QUEUE-m)))
895 $(call AddDepends/nfnetlink)
898 define KernelPackage/nfnetlink-queue/description
899 Kernel modules support for queueing packets via NFNETLINK
904 $(eval $(call KernelPackage,nfnetlink-queue))
907 define KernelPackage/nf-conntrack-netlink
908 TITLE:=Connection tracking netlink interface
909 FILES:=$(LINUX_DIR)/net/netfilter/nf_conntrack_netlink.ko
910 KCONFIG:=CONFIG_NF_CT_NETLINK CONFIG_NF_CONNTRACK_EVENTS=y
911 AUTOLOAD:=$(call AutoProbe,nf_conntrack_netlink)
912 $(call AddDepends/nfnetlink,+kmod-ipt-conntrack)
915 define KernelPackage/nf-conntrack-netlink/description
916 Kernel modules support for a netlink-based connection tracking
920 $(eval $(call KernelPackage,nf-conntrack-netlink))
922 define KernelPackage/ipt-hashlimit
924 TITLE:=Netfilter hashlimit match
925 DEPENDS:=+kmod-ipt-core
926 KCONFIG:=$(KCONFIG_IPT_HASHLIMIT)
927 FILES:=$(LINUX_DIR)/net/netfilter/xt_hashlimit.ko
928 AUTOLOAD:=$(call AutoProbe,xt_hashlimit)
929 $(call KernelPackage/ipt)
932 define KernelPackage/ipt-hashlimit/description
933 Kernel modules support for the hashlimit bucket match module
936 $(eval $(call KernelPackage,ipt-hashlimit))
938 define KernelPackage/ipt-rpfilter
940 TITLE:=Netfilter rpfilter match
941 DEPENDS:=+kmod-ipt-core
942 KCONFIG:=$(KCONFIG_IPT_RPFILTER)
944 $(LINUX_DIR)/net/ipv4/netfilter/ipt_rpfilter.ko \
945 $(LINUX_DIR)/net/ipv6/netfilter/ip6t_rpfilter.ko)
946 AUTOLOAD:=$(call AutoProbe,ipt_rpfilter ip6t_rpfilter)
947 $(call KernelPackage/ipt)
950 define KernelPackage/ipt-rpfilter/description
951 Kernel modules support for the Netfilter rpfilter match
954 $(eval $(call KernelPackage,ipt-rpfilter))
957 define KernelPackage/nft-core
959 TITLE:=Netfilter nf_tables support
960 DEPENDS:=+kmod-nfnetlink +kmod-nf-reject +kmod-nf-reject6 +kmod-nf-conntrack6
961 FILES:=$(foreach mod,$(NFT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
962 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CORE-m)))
964 CONFIG_NFT_COMPAT=n \
969 define KernelPackage/nft-core/description
970 Kernel module support for nftables
973 $(eval $(call KernelPackage,nft-core))
976 define KernelPackage/nft-arp
978 TITLE:=Netfilter nf_tables ARP table support
979 DEPENDS:=+kmod-nft-core
980 FILES:=$(foreach mod,$(NFT_ARP-m),$(LINUX_DIR)/net/$(mod).ko)
981 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_ARP-m)))
982 KCONFIG:=$(KCONFIG_NFT_ARP)
985 $(eval $(call KernelPackage,nft-arp))
988 define KernelPackage/nft-bridge
990 TITLE:=Netfilter nf_tables bridge table support
991 DEPENDS:=+kmod-nft-core
992 FILES:=$(foreach mod,$(NFT_BRIDGE-m),$(LINUX_DIR)/net/$(mod).ko)
993 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_BRIDGE-m)))
995 CONFIG_NF_LOG_BRIDGE=n \
996 $(KCONFIG_NFT_BRIDGE)
999 $(eval $(call KernelPackage,nft-bridge))
1002 define KernelPackage/nft-nat
1004 TITLE:=Netfilter nf_tables NAT support
1005 DEPENDS:=+kmod-nft-core +kmod-nf-nat
1006 FILES:=$(foreach mod,$(NFT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
1007 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT-m)))
1008 KCONFIG:=$(KCONFIG_NFT_NAT)
1011 $(eval $(call KernelPackage,nft-nat))
1014 define KernelPackage/nft-offload
1016 TITLE:=Netfilter nf_tables routing/NAT offload support
1017 DEPENDS:=+kmod-nf-flow +kmod-nft-nat
1019 CONFIG_NF_FLOW_TABLE_INET \
1020 CONFIG_NF_FLOW_TABLE_IPV4 \
1021 CONFIG_NF_FLOW_TABLE_IPV6 \
1022 CONFIG_NFT_FLOW_OFFLOAD
1024 $(LINUX_DIR)/net/netfilter/nf_flow_table_inet.ko \
1025 $(LINUX_DIR)/net/ipv4/netfilter/nf_flow_table_ipv4.ko \
1026 $(LINUX_DIR)/net/ipv6/netfilter/nf_flow_table_ipv6.ko \
1027 $(LINUX_DIR)/net/netfilter/nft_flow_offload.ko
1028 AUTOLOAD:=$(call AutoProbe,nf_flow_table_inet nf_flow_table_ipv4 nf_flow_table_ipv6 nft_flow_offload)
1031 $(eval $(call KernelPackage,nft-offload))
1034 define KernelPackage/nft-nat6
1036 TITLE:=Netfilter nf_tables IPv6-NAT support
1037 DEPENDS:=+kmod-nft-nat +kmod-nf-nat6
1038 FILES:=$(foreach mod,$(NFT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
1039 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT6-m)))
1040 KCONFIG:=$(KCONFIG_NFT_NAT6)
1043 $(eval $(call KernelPackage,nft-nat6))