3 # Copyright (C) 2006-2010 OpenWrt.org
5 # This is free software, licensed under the GNU General Public License v2.
6 # See /LICENSE for more information.
9 NF_MENU:=Netfilter Extensions
11 include $(INCLUDE_DIR)/netfilter.mk
14 define KernelPackage/nf-reject
16 TITLE:=Netfilter IPv4 reject support
19 CONFIG_NETFILTER_ADVANCED=y \
21 FILES:=$(foreach mod,$(NF_REJECT-m),$(LINUX_DIR)/net/$(mod).ko)
22 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_REJECT-m)))
25 $(eval $(call KernelPackage,nf-reject))
28 define KernelPackage/nf-reject6
30 TITLE:=Netfilter IPv6 reject support
33 CONFIG_NETFILTER_ADVANCED=y \
36 FILES:=$(foreach mod,$(NF_REJECT6-m),$(LINUX_DIR)/net/$(mod).ko)
37 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_REJECT6-m)))
40 $(eval $(call KernelPackage,nf-reject6))
43 define KernelPackage/nf-ipt
46 KCONFIG:=$(KCONFIG_NF_IPT)
47 FILES:=$(foreach mod,$(NF_IPT-m),$(LINUX_DIR)/net/$(mod).ko)
48 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT-m)))
51 $(eval $(call KernelPackage,nf-ipt))
54 define KernelPackage/nf-ipt6
57 KCONFIG:=$(KCONFIG_NF_IPT6)
58 FILES:=$(foreach mod,$(NF_IPT6-m),$(LINUX_DIR)/net/$(mod).ko)
59 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT6-m)))
63 $(eval $(call KernelPackage,nf-ipt6))
67 define KernelPackage/ipt-core
70 KCONFIG:=$(KCONFIG_IPT_CORE)
71 FILES:=$(foreach mod,$(IPT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
72 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CORE-m)))
73 DEPENDS:=+kmod-nf-reject +kmod-nf-ipt
76 define KernelPackage/ipt-core/description
77 Netfilter core kernel modules
88 $(eval $(call KernelPackage,ipt-core))
91 define KernelPackage/nf-conntrack
93 TITLE:=Netfilter connection tracking
96 CONFIG_NETFILTER_ADVANCED=y \
97 CONFIG_NF_CONNTRACK_MARK=y \
98 CONFIG_NF_CONNTRACK_ZONES=y \
99 $(KCONFIG_NF_CONNTRACK)
100 FILES:=$(foreach mod,$(NF_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
101 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK-m)))
104 define KernelPackage/nf-conntrack/install
105 $(INSTALL_DIR) $(1)/etc/sysctl.d
106 $(INSTALL_DATA) ./files/sysctl-nf-conntrack.conf $(1)/etc/sysctl.d/11-nf-conntrack.conf
109 $(eval $(call KernelPackage,nf-conntrack))
112 define KernelPackage/nf-conntrack6
114 TITLE:=Netfilter IPv6 connection tracking
115 KCONFIG:=$(KCONFIG_NF_CONNTRACK6)
116 DEPENDS:=@IPV6 +kmod-nf-conntrack
117 FILES:=$(foreach mod,$(NF_CONNTRACK6-m),$(LINUX_DIR)/net/$(mod).ko)
118 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK6-m)))
121 $(eval $(call KernelPackage,nf-conntrack6))
124 define KernelPackage/nf-nat
127 KCONFIG:=$(KCONFIG_NF_NAT)
128 DEPENDS:=+kmod-nf-conntrack
129 FILES:=$(foreach mod,$(NF_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
130 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT-m)))
133 $(eval $(call KernelPackage,nf-nat))
136 define KernelPackage/nf-nat6
138 TITLE:=Netfilter IPV6-NAT
139 KCONFIG:=$(KCONFIG_NF_NAT6)
140 DEPENDS:=+kmod-nf-conntrack6 +kmod-nf-nat
141 FILES:=$(foreach mod,$(NF_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
142 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT6-m)))
145 $(eval $(call KernelPackage,nf-nat6))
148 define KernelPackage/nf-flow
150 TITLE:=Netfilter flowtable support
152 CONFIG_NETFILTER_INGRESS=y \
153 CONFIG_NF_FLOW_TABLE \
154 CONFIG_NF_FLOW_TABLE_HW
155 DEPENDS:=+kmod-nf-conntrack @!LINUX_3_18 @!LINUX_4_4 @!LINUX_4_9
157 $(LINUX_DIR)/net/netfilter/nf_flow_table.ko \
158 $(LINUX_DIR)/net/netfilter/nf_flow_table_hw.ko
159 AUTOLOAD:=$(call AutoProbe,nf_flow_table nf_flow_table_hw)
162 $(eval $(call KernelPackage,nf-flow))
165 define AddDepends/ipt
167 DEPENDS+= +kmod-ipt-core $(1)
171 define KernelPackage/ipt-conntrack
172 TITLE:=Basic connection tracking modules
173 KCONFIG:=$(KCONFIG_IPT_CONNTRACK)
174 FILES:=$(foreach mod,$(IPT_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
175 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK-m)))
176 $(call AddDepends/ipt,+kmod-nf-conntrack)
179 define KernelPackage/ipt-conntrack/description
180 Netfilter (IPv4) kernel modules for connection tracking
189 $(eval $(call KernelPackage,ipt-conntrack))
192 define KernelPackage/ipt-conntrack-extra
193 TITLE:=Extra connection tracking modules
194 KCONFIG:=$(KCONFIG_IPT_CONNTRACK_EXTRA)
195 FILES:=$(foreach mod,$(IPT_CONNTRACK_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
196 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_EXTRA-m)))
197 $(call AddDepends/ipt,+kmod-ipt-conntrack)
200 define KernelPackage/ipt-conntrack-extra/description
201 Netfilter (IPv4) extra kernel modules for connection tracking
210 $(eval $(call KernelPackage,ipt-conntrack-extra))
212 define KernelPackage/ipt-conntrack-label
213 TITLE:=Module for handling connection tracking labels
214 KCONFIG:=$(KCONFIG_IPT_CONNTRACK_LABEL)
215 FILES:=$(foreach mod,$(IPT_CONNTRACK_LABEL-m),$(LINUX_DIR)/net/$(mod).ko)
216 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_LABEL-m)))
217 $(call AddDepends/ipt,+kmod-ipt-conntrack)
220 define KernelPackage/ipt-conntrack-label/description
221 Netfilter (IPv4) module for handling connection tracking labels
226 $(eval $(call KernelPackage,ipt-conntrack-label))
228 define KernelPackage/ipt-filter
229 TITLE:=Modules for packet content inspection
230 KCONFIG:=$(KCONFIG_IPT_FILTER)
231 FILES:=$(foreach mod,$(IPT_FILTER-m),$(LINUX_DIR)/net/$(mod).ko)
232 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FILTER-m)))
233 $(call AddDepends/ipt,+kmod-lib-textsearch +kmod-ipt-conntrack)
236 define KernelPackage/ipt-filter/description
237 Netfilter (IPv4) kernel modules for packet content inspection
243 $(eval $(call KernelPackage,ipt-filter))
246 define KernelPackage/ipt-offload
247 TITLE:=Netfilter routing/NAT offload support
248 KCONFIG:=CONFIG_NETFILTER_XT_TARGET_FLOWOFFLOAD
249 FILES:=$(foreach mod,$(IPT_FLOW-m),$(LINUX_DIR)/net/$(mod).ko)
250 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FLOW-m)))
251 $(call AddDepends/ipt,+kmod-nf-flow)
254 $(eval $(call KernelPackage,ipt-offload))
257 define KernelPackage/ipt-ipopt
258 TITLE:=Modules for matching/changing IP packet options
259 KCONFIG:=$(KCONFIG_IPT_IPOPT)
260 FILES:=$(foreach mod,$(IPT_IPOPT-m),$(LINUX_DIR)/net/$(mod).ko)
261 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPOPT-m)))
262 $(call AddDepends/ipt)
265 define KernelPackage/ipt-ipopt/description
266 Netfilter (IPv4) modules for matching/changing IP packet options
281 $(eval $(call KernelPackage,ipt-ipopt))
284 define KernelPackage/ipt-ipsec
285 TITLE:=Modules for matching IPSec packets
286 KCONFIG:=$(KCONFIG_IPT_IPSEC)
287 FILES:=$(foreach mod,$(IPT_IPSEC-m),$(LINUX_DIR)/net/$(mod).ko)
288 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPSEC-m)))
289 $(call AddDepends/ipt)
292 define KernelPackage/ipt-ipsec/description
293 Netfilter (IPv4) modules for matching IPSec packets
300 $(eval $(call KernelPackage,ipt-ipsec))
304 ipset/ip_set_bitmap_ip \
305 ipset/ip_set_bitmap_ipmac \
306 ipset/ip_set_bitmap_port \
307 ipset/ip_set_hash_ip \
308 ipset/ip_set_hash_ipmark \
309 ipset/ip_set_hash_ipport \
310 ipset/ip_set_hash_ipportip \
311 ipset/ip_set_hash_ipportnet \
312 ipset/ip_set_hash_mac \
313 ipset/ip_set_hash_netportnet \
314 ipset/ip_set_hash_net \
315 ipset/ip_set_hash_netnet \
316 ipset/ip_set_hash_netport \
317 ipset/ip_set_hash_netiface \
318 ipset/ip_set_list_set \
321 define KernelPackage/ipt-ipset
322 SUBMENU:=Netfilter Extensions
323 TITLE:=IPset netfilter modules
324 DEPENDS+= +kmod-ipt-core +kmod-nfnetlink
327 CONFIG_IP_SET_MAX=256 \
328 CONFIG_NETFILTER_XT_SET \
329 CONFIG_IP_SET_BITMAP_IP \
330 CONFIG_IP_SET_BITMAP_IPMAC \
331 CONFIG_IP_SET_BITMAP_PORT \
332 CONFIG_IP_SET_HASH_IP \
333 CONFIG_IP_SET_HASH_IPMARK \
334 CONFIG_IP_SET_HASH_IPPORT \
335 CONFIG_IP_SET_HASH_IPPORTIP \
336 CONFIG_IP_SET_HASH_IPPORTNET \
337 CONFIG_IP_SET_HASH_MAC \
338 CONFIG_IP_SET_HASH_NET \
339 CONFIG_IP_SET_HASH_NETNET \
340 CONFIG_IP_SET_HASH_NETIFACE \
341 CONFIG_IP_SET_HASH_NETPORT \
342 CONFIG_IP_SET_HASH_NETPORTNET \
343 CONFIG_IP_SET_LIST_SET \
344 CONFIG_NET_EMATCH_IPSET=n
345 FILES:=$(foreach mod,$(IPSET_MODULES),$(LINUX_DIR)/net/netfilter/$(mod).ko)
346 AUTOLOAD:=$(call AutoLoad,49,$(notdir $(IPSET_MODULES)))
348 $(eval $(call KernelPackage,ipt-ipset))
351 define KernelPackage/ipt-nat
352 TITLE:=Basic NAT targets
353 KCONFIG:=$(KCONFIG_IPT_NAT)
354 FILES:=$(foreach mod,$(IPT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
355 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT-m)))
356 $(call AddDepends/ipt,+kmod-nf-nat)
359 define KernelPackage/ipt-nat/description
360 Netfilter (IPv4) kernel modules for basic NAT targets
365 $(eval $(call KernelPackage,ipt-nat))
368 define KernelPackage/ipt-raw
369 TITLE:=Netfilter IPv4 raw table support
370 KCONFIG:=CONFIG_IP_NF_RAW
371 FILES:=$(LINUX_DIR)/net/ipv4/netfilter/iptable_raw.ko
372 AUTOLOAD:=$(call AutoProbe,iptable_raw)
373 $(call AddDepends/ipt)
376 $(eval $(call KernelPackage,ipt-raw))
379 define KernelPackage/ipt-raw6
380 TITLE:=Netfilter IPv6 raw table support
381 KCONFIG:=CONFIG_IP6_NF_RAW
382 FILES:=$(LINUX_DIR)/net/ipv6/netfilter/ip6table_raw.ko
383 AUTOLOAD:=$(call AutoProbe,ip6table_raw)
384 $(call AddDepends/ipt,+kmod-ip6tables)
387 $(eval $(call KernelPackage,ipt-raw6))
390 define KernelPackage/ipt-nat6
391 TITLE:=IPv6 NAT targets
392 KCONFIG:=$(KCONFIG_IPT_NAT6)
393 FILES:=$(foreach mod,$(IPT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
394 AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_NAT6-m)))
395 $(call AddDepends/ipt,+kmod-nf-nat6)
396 $(call AddDepends/ipt,+kmod-ipt-conntrack)
397 $(call AddDepends/ipt,+kmod-ipt-nat)
398 $(call AddDepends/ipt,+kmod-ip6tables)
401 define KernelPackage/ipt-nat6/description
402 Netfilter (IPv6) kernel modules for NAT targets
405 $(eval $(call KernelPackage,ipt-nat6))
408 define KernelPackage/ipt-nat-extra
409 TITLE:=Extra NAT targets
410 KCONFIG:=$(KCONFIG_IPT_NAT_EXTRA)
411 FILES:=$(foreach mod,$(IPT_NAT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
412 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT_EXTRA-m)))
413 $(call AddDepends/ipt,+kmod-ipt-nat)
416 define KernelPackage/ipt-nat-extra/description
417 Netfilter (IPv4) kernel modules for extra NAT targets
423 $(eval $(call KernelPackage,ipt-nat-extra))
426 define KernelPackage/nf-nathelper
428 TITLE:=Basic Conntrack and NAT helpers
429 KCONFIG:=$(KCONFIG_NF_NATHELPER)
430 FILES:=$(foreach mod,$(NF_NATHELPER-m),$(LINUX_DIR)/net/$(mod).ko)
431 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER-m)))
432 DEPENDS:=+kmod-nf-nat
435 define KernelPackage/nf-nathelper/description
436 Default Netfilter (IPv4) Conntrack and NAT helpers
441 $(eval $(call KernelPackage,nf-nathelper))
444 define KernelPackage/nf-nathelper-extra
446 TITLE:=Extra Conntrack and NAT helpers
447 KCONFIG:=$(KCONFIG_NF_NATHELPER_EXTRA)
448 FILES:=$(foreach mod,$(NF_NATHELPER_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
449 AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER_EXTRA-m)))
450 DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch
453 define KernelPackage/nf-nathelper-extra/description
454 Extra Netfilter (IPv4) Conntrack and NAT helpers
468 $(eval $(call KernelPackage,nf-nathelper-extra))
471 define KernelPackage/ipt-ulog
472 TITLE:=Module for user-space packet logging
473 KCONFIG:=$(KCONFIG_IPT_ULOG)
474 FILES:=$(foreach mod,$(IPT_ULOG-m),$(LINUX_DIR)/net/$(mod).ko)
475 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_ULOG-m)))
476 $(call AddDepends/ipt)
479 define KernelPackage/ipt-ulog/description
480 Netfilter (IPv4) module for user-space packet logging
485 $(eval $(call KernelPackage,ipt-ulog))
488 define KernelPackage/ipt-nflog
489 TITLE:=Module for user-space packet logging
490 KCONFIG:=$(KCONFIG_IPT_NFLOG)
491 FILES:=$(foreach mod,$(IPT_NFLOG-m),$(LINUX_DIR)/net/$(mod).ko)
492 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFLOG-m)))
493 $(call AddDepends/ipt,+kmod-nfnetlink-log)
496 define KernelPackage/ipt-nflog/description
497 Netfilter module for user-space packet logging
502 $(eval $(call KernelPackage,ipt-nflog))
505 define KernelPackage/ipt-nfqueue
506 TITLE:=Module for user-space packet queuing
507 KCONFIG:=$(KCONFIG_IPT_NFQUEUE)
508 FILES:=$(foreach mod,$(IPT_NFQUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
509 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFQUEUE-m)))
510 $(call AddDepends/ipt,+kmod-nfnetlink-queue)
513 define KernelPackage/ipt-nfqueue/description
514 Netfilter module for user-space packet queuing
519 $(eval $(call KernelPackage,ipt-nfqueue))
522 define KernelPackage/ipt-debug
523 TITLE:=Module for debugging/development
524 KCONFIG:=$(KCONFIG_IPT_DEBUG)
525 FILES:=$(foreach mod,$(IPT_DEBUG-m),$(LINUX_DIR)/net/$(mod).ko)
526 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_DEBUG-m)))
527 $(call AddDepends/ipt,+kmod-ipt-raw +IPV6:kmod-ipt-raw6)
530 define KernelPackage/ipt-debug/description
531 Netfilter modules for debugging/development of the firewall
536 $(eval $(call KernelPackage,ipt-debug))
539 define KernelPackage/ipt-led
540 TITLE:=Module to trigger a LED with a Netfilter rule
541 KCONFIG:=$(KCONFIG_IPT_LED)
542 FILES:=$(foreach mod,$(IPT_LED-m),$(LINUX_DIR)/net/$(mod).ko)
543 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_LED-m)))
544 $(call AddDepends/ipt)
547 define KernelPackage/ipt-led/description
548 Netfilter target to trigger a LED when a network packet is matched.
551 $(eval $(call KernelPackage,ipt-led))
553 define KernelPackage/ipt-tproxy
554 TITLE:=Transparent proxying support
555 DEPENDS+=+kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +IPV6:kmod-ip6tables
557 CONFIG_NETFILTER_XT_MATCH_SOCKET \
558 CONFIG_NETFILTER_XT_TARGET_TPROXY
560 $(foreach mod,$(IPT_TPROXY-m),$(LINUX_DIR)/net/$(mod).ko)
561 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_TPROXY-m)))
562 $(call AddDepends/ipt)
565 define KernelPackage/ipt-tproxy/description
566 Kernel modules for Transparent Proxying
569 $(eval $(call KernelPackage,ipt-tproxy))
571 define KernelPackage/ipt-tee
573 DEPENDS:=+kmod-ipt-conntrack
575 CONFIG_NETFILTER_XT_TARGET_TEE
577 $(LINUX_DIR)/net/netfilter/xt_TEE.ko \
578 $(foreach mod,$(IPT_TEE-m),$(LINUX_DIR)/net/$(mod).ko)
579 AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_TEE-m)))
580 $(call AddDepends/ipt)
583 define KernelPackage/ipt-tee/description
584 Kernel modules for TEE
587 $(eval $(call KernelPackage,ipt-tee))
590 define KernelPackage/ipt-u32
593 CONFIG_NETFILTER_XT_MATCH_U32
595 $(LINUX_DIR)/net/netfilter/xt_u32.ko \
596 $(foreach mod,$(IPT_U32-m),$(LINUX_DIR)/net/$(mod).ko)
597 AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_U32-m)))
598 $(call AddDepends/ipt)
601 define KernelPackage/ipt-u32/description
602 Kernel modules for U32
605 $(eval $(call KernelPackage,ipt-u32))
607 define KernelPackage/ipt-checksum
608 TITLE:=CHECKSUM support
610 CONFIG_NETFILTER_XT_TARGET_CHECKSUM
612 $(LINUX_DIR)/net/netfilter/xt_CHECKSUM.ko \
613 $(foreach mod,$(IPT_CHECKSUM-m),$(LINUX_DIR)/net/$(mod).ko)
614 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CHECKSUM-m)))
615 $(call AddDepends/ipt)
618 define KernelPackage/ipt-checksum/description
619 Kernel modules for CHECKSUM fillin target
622 $(eval $(call KernelPackage,ipt-checksum))
625 define KernelPackage/ipt-iprange
626 TITLE:=Module for matching ip ranges
627 KCONFIG:=$(KCONFIG_IPT_IPRANGE)
628 FILES:=$(foreach mod,$(IPT_IPRANGE-m),$(LINUX_DIR)/net/$(mod).ko)
629 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPRANGE-m)))
630 $(call AddDepends/ipt)
633 define KernelPackage/ipt-iprange/description
634 Netfilter (IPv4) module for matching ip ranges
639 $(eval $(call KernelPackage,ipt-iprange))
641 define KernelPackage/ipt-cluster
642 TITLE:=Module for matching cluster
643 KCONFIG:=$(KCONFIG_IPT_CLUSTER)
644 FILES:=$(foreach mod,$(IPT_CLUSTER-m),$(LINUX_DIR)/net/$(mod).ko)
645 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTER-m)))
646 $(call AddDepends/ipt)
649 define KernelPackage/ipt-cluster/description
650 Netfilter (IPv4/IPv6) module for matching cluster
651 This option allows you to build work-load-sharing clusters of
652 network servers/stateful firewalls without having a dedicated
653 load-balancing router/server/switch. Basically, this match returns
654 true when the packet must be handled by this cluster node. Thus,
655 all nodes see all packets and this match decides which node handles
656 what packets. The work-load sharing algorithm is based on source
659 This module is usable for ipv4 and ipv6.
661 To use it also enable iptables-mod-cluster
663 see `iptables -m cluster --help` for more information.
666 $(eval $(call KernelPackage,ipt-cluster))
668 define KernelPackage/ipt-clusterip
669 TITLE:=Module for CLUSTERIP
670 KCONFIG:=$(KCONFIG_IPT_CLUSTERIP)
671 FILES:=$(foreach mod,$(IPT_CLUSTERIP-m),$(LINUX_DIR)/net/$(mod).ko)
672 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTERIP-m)))
673 $(call AddDepends/ipt,+kmod-nf-conntrack)
676 define KernelPackage/ipt-clusterip/description
677 Netfilter (IPv4-only) module for CLUSTERIP
678 The CLUSTERIP target allows you to build load-balancing clusters of
679 network servers without having a dedicated load-balancing
680 router/server/switch.
682 To use it also enable iptables-mod-clusterip
684 see `iptables -j CLUSTERIP --help` for more information.
687 $(eval $(call KernelPackage,ipt-clusterip))
690 define KernelPackage/ipt-extra
692 KCONFIG:=$(KCONFIG_IPT_EXTRA)
693 FILES:=$(foreach mod,$(IPT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
694 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_EXTRA-m)))
695 $(call AddDepends/ipt)
698 define KernelPackage/ipt-extra/description
699 Other Netfilter (IPv4) kernel modules
707 $(eval $(call KernelPackage,ipt-extra))
710 define KernelPackage/ipt-physdev
711 TITLE:=physdev module
712 KCONFIG:=$(KCONFIG_IPT_PHYSDEV)
713 FILES:=$(foreach mod,$(IPT_PHYSDEV-m),$(LINUX_DIR)/net/$(mod).ko)
714 AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_PHYSDEV-m)))
715 $(call AddDepends/ipt,+kmod-br-netfilter)
718 define KernelPackage/ipt-physdev/description
719 The iptables physdev kernel module
722 $(eval $(call KernelPackage,ipt-physdev))
725 define KernelPackage/ip6tables
728 DEPENDS:=+kmod-nf-reject6 +kmod-nf-ipt6 +kmod-ipt-core
729 KCONFIG:=$(KCONFIG_IPT_IPV6)
730 FILES:=$(foreach mod,$(IPT_IPV6-m),$(LINUX_DIR)/net/$(mod).ko)
731 AUTOLOAD:=$(call AutoLoad,42,$(notdir $(IPT_IPV6-m)))
734 define KernelPackage/ip6tables/description
735 Netfilter IPv6 firewalling support
738 $(eval $(call KernelPackage,ip6tables))
740 define KernelPackage/ip6tables-extra
742 TITLE:=Extra IPv6 modules
743 DEPENDS:=+kmod-ip6tables
744 KCONFIG:=$(KCONFIG_IPT_IPV6_EXTRA)
745 FILES:=$(foreach mod,$(IPT_IPV6_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
746 AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_IPV6_EXTRA-m)))
749 define KernelPackage/ip6tables-extra/description
750 Netfilter IPv6 extra header matching modules
753 $(eval $(call KernelPackage,ip6tables-extra))
755 ARP_MODULES = arp_tables arpt_mangle arptable_filter
756 define KernelPackage/arptables
758 TITLE:=ARP firewalling modules
759 DEPENDS:=+kmod-ipt-core
760 FILES:=$(LINUX_DIR)/net/ipv4/netfilter/arp*.ko
761 KCONFIG:=CONFIG_IP_NF_ARPTABLES \
762 CONFIG_IP_NF_ARPFILTER \
763 CONFIG_IP_NF_ARP_MANGLE
764 AUTOLOAD:=$(call AutoProbe,$(ARP_MODULES))
767 define KernelPackage/arptables/description
768 Kernel modules for ARP firewalling
771 $(eval $(call KernelPackage,arptables))
774 define KernelPackage/br-netfilter
776 TITLE:=Bridge netfilter support modules
777 DEPENDS:=+kmod-ipt-core
778 FILES:=$(LINUX_DIR)/net/bridge/br_netfilter.ko
779 KCONFIG:=CONFIG_BRIDGE_NETFILTER
780 AUTOLOAD:=$(call AutoProbe,br_netfilter)
783 define KernelPackage/br-netfilter/install
784 $(INSTALL_DIR) $(1)/etc/sysctl.d
785 $(INSTALL_DATA) ./files/sysctl-br-netfilter.conf $(1)/etc/sysctl.d/11-br-netfilter.conf
788 $(eval $(call KernelPackage,br-netfilter))
791 define KernelPackage/ebtables
793 TITLE:=Bridge firewalling modules
794 DEPENDS:=+kmod-ipt-core
795 FILES:=$(foreach mod,$(EBTABLES-m),$(LINUX_DIR)/net/$(mod).ko)
796 KCONFIG:=$(KCONFIG_EBTABLES)
797 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES-m)))
800 define KernelPackage/ebtables/description
801 ebtables is a general, extensible frame/packet identification
802 framework. It provides you to do Ethernet
803 filtering/NAT/brouting on the Ethernet bridge.
806 $(eval $(call KernelPackage,ebtables))
809 define AddDepends/ebtables
811 DEPENDS+= +kmod-ebtables $(1)
815 define KernelPackage/ebtables-ipv4
816 TITLE:=ebtables: IPv4 support
817 FILES:=$(foreach mod,$(EBTABLES_IP4-m),$(LINUX_DIR)/net/$(mod).ko)
818 KCONFIG:=$(KCONFIG_EBTABLES_IP4)
819 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP4-m)))
820 $(call AddDepends/ebtables)
823 define KernelPackage/ebtables-ipv4/description
824 This option adds the IPv4 support to ebtables, which allows basic
825 IPv4 header field filtering, ARP filtering as well as SNAT, DNAT targets.
828 $(eval $(call KernelPackage,ebtables-ipv4))
831 define KernelPackage/ebtables-ipv6
832 TITLE:=ebtables: IPv6 support
833 FILES:=$(foreach mod,$(EBTABLES_IP6-m),$(LINUX_DIR)/net/$(mod).ko)
834 KCONFIG:=$(KCONFIG_EBTABLES_IP6)
835 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP6-m)))
836 $(call AddDepends/ebtables)
839 define KernelPackage/ebtables-ipv6/description
840 This option adds the IPv6 support to ebtables, which allows basic
841 IPv6 header field filtering and target support.
844 $(eval $(call KernelPackage,ebtables-ipv6))
847 define KernelPackage/ebtables-watchers
848 TITLE:=ebtables: watchers support
849 FILES:=$(foreach mod,$(EBTABLES_WATCHERS-m),$(LINUX_DIR)/net/$(mod).ko)
850 KCONFIG:=$(KCONFIG_EBTABLES_WATCHERS)
851 AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_WATCHERS-m)))
852 $(call AddDepends/ebtables)
855 define KernelPackage/ebtables-watchers/description
856 This option adds the log watchers, that you can use in any rule
857 in any ebtables table.
860 $(eval $(call KernelPackage,ebtables-watchers))
863 define KernelPackage/nfnetlink
865 TITLE:=Netlink-based userspace interface
866 FILES:=$(foreach mod,$(NFNETLINK-m),$(LINUX_DIR)/net/$(mod).ko)
867 KCONFIG:=$(KCONFIG_NFNETLINK)
868 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK-m)))
871 define KernelPackage/nfnetlink/description
872 Kernel modules support for a netlink-based userspace interface
875 $(eval $(call KernelPackage,nfnetlink))
878 define AddDepends/nfnetlink
880 DEPENDS+=+kmod-nfnetlink $(1)
884 define KernelPackage/nfnetlink-log
885 TITLE:=Netfilter LOG over NFNETLINK interface
886 FILES:=$(foreach mod,$(NFNETLINK_LOG-m),$(LINUX_DIR)/net/$(mod).ko)
887 KCONFIG:=$(KCONFIG_NFNETLINK_LOG)
888 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_LOG-m)))
889 $(call AddDepends/nfnetlink)
892 define KernelPackage/nfnetlink-log/description
893 Kernel modules support for logging packets via NFNETLINK
898 $(eval $(call KernelPackage,nfnetlink-log))
901 define KernelPackage/nfnetlink-queue
902 TITLE:=Netfilter QUEUE over NFNETLINK interface
903 FILES:=$(foreach mod,$(NFNETLINK_QUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
904 KCONFIG:=$(KCONFIG_NFNETLINK_QUEUE)
905 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_QUEUE-m)))
906 $(call AddDepends/nfnetlink)
909 define KernelPackage/nfnetlink-queue/description
910 Kernel modules support for queueing packets via NFNETLINK
915 $(eval $(call KernelPackage,nfnetlink-queue))
918 define KernelPackage/nf-conntrack-netlink
919 TITLE:=Connection tracking netlink interface
920 FILES:=$(LINUX_DIR)/net/netfilter/nf_conntrack_netlink.ko
921 KCONFIG:=CONFIG_NF_CT_NETLINK CONFIG_NF_CONNTRACK_EVENTS=y
922 AUTOLOAD:=$(call AutoProbe,nf_conntrack_netlink)
923 $(call AddDepends/nfnetlink,+kmod-ipt-conntrack)
926 define KernelPackage/nf-conntrack-netlink/description
927 Kernel modules support for a netlink-based connection tracking
931 $(eval $(call KernelPackage,nf-conntrack-netlink))
933 define KernelPackage/ipt-hashlimit
935 TITLE:=Netfilter hashlimit match
936 DEPENDS:=+kmod-ipt-core
937 KCONFIG:=$(KCONFIG_IPT_HASHLIMIT)
938 FILES:=$(LINUX_DIR)/net/netfilter/xt_hashlimit.ko
939 AUTOLOAD:=$(call AutoProbe,xt_hashlimit)
940 $(call KernelPackage/ipt)
943 define KernelPackage/ipt-hashlimit/description
944 Kernel modules support for the hashlimit bucket match module
947 $(eval $(call KernelPackage,ipt-hashlimit))
949 define KernelPackage/ipt-rpfilter
951 TITLE:=Netfilter rpfilter match
952 DEPENDS:=+kmod-ipt-core
953 KCONFIG:=$(KCONFIG_IPT_RPFILTER)
955 $(LINUX_DIR)/net/ipv4/netfilter/ipt_rpfilter.ko \
956 $(LINUX_DIR)/net/ipv6/netfilter/ip6t_rpfilter.ko)
957 AUTOLOAD:=$(call AutoProbe,ipt_rpfilter ip6t_rpfilter)
958 $(call KernelPackage/ipt)
961 define KernelPackage/ipt-rpfilter/description
962 Kernel modules support for the Netfilter rpfilter match
965 $(eval $(call KernelPackage,ipt-rpfilter))
968 define KernelPackage/nft-core
970 TITLE:=Netfilter nf_tables support
971 DEPENDS:=+kmod-nfnetlink +kmod-nf-reject +kmod-nf-reject6 +kmod-nf-conntrack6
972 FILES:=$(foreach mod,$(NFT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
973 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CORE-m)))
975 CONFIG_NFT_COMPAT=n \
980 define KernelPackage/nft-core/description
981 Kernel module support for nftables
984 $(eval $(call KernelPackage,nft-core))
987 define KernelPackage/nft-arp
989 TITLE:=Netfilter nf_tables ARP table support
990 DEPENDS:=+kmod-nft-core
991 FILES:=$(foreach mod,$(NFT_ARP-m),$(LINUX_DIR)/net/$(mod).ko)
992 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_ARP-m)))
993 KCONFIG:=$(KCONFIG_NFT_ARP)
996 $(eval $(call KernelPackage,nft-arp))
999 define KernelPackage/nft-bridge
1001 TITLE:=Netfilter nf_tables bridge table support
1002 DEPENDS:=+kmod-nft-core
1003 FILES:=$(foreach mod,$(NFT_BRIDGE-m),$(LINUX_DIR)/net/$(mod).ko)
1004 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_BRIDGE-m)))
1006 CONFIG_NF_LOG_BRIDGE=n \
1007 $(KCONFIG_NFT_BRIDGE)
1010 $(eval $(call KernelPackage,nft-bridge))
1013 define KernelPackage/nft-nat
1015 TITLE:=Netfilter nf_tables NAT support
1016 DEPENDS:=+kmod-nft-core +kmod-nf-nat
1017 FILES:=$(foreach mod,$(NFT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
1018 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT-m)))
1019 KCONFIG:=$(KCONFIG_NFT_NAT)
1022 $(eval $(call KernelPackage,nft-nat))
1025 define KernelPackage/nft-offload
1027 TITLE:=Netfilter nf_tables routing/NAT offload support
1028 DEPENDS:=+kmod-nf-flow +kmod-nft-nat
1030 CONFIG_NF_FLOW_TABLE_INET \
1031 CONFIG_NF_FLOW_TABLE_IPV4 \
1032 CONFIG_NF_FLOW_TABLE_IPV6 \
1033 CONFIG_NFT_FLOW_OFFLOAD
1035 $(LINUX_DIR)/net/netfilter/nf_flow_table_inet.ko \
1036 $(LINUX_DIR)/net/ipv4/netfilter/nf_flow_table_ipv4.ko \
1037 $(LINUX_DIR)/net/ipv6/netfilter/nf_flow_table_ipv6.ko \
1038 $(LINUX_DIR)/net/netfilter/nft_flow_offload.ko
1039 AUTOLOAD:=$(call AutoProbe,nf_flow_table_inet nf_flow_table_ipv4 nf_flow_table_ipv6 nft_flow_offload)
1042 $(eval $(call KernelPackage,nft-offload))
1045 define KernelPackage/nft-nat6
1047 TITLE:=Netfilter nf_tables IPv6-NAT support
1048 DEPENDS:=+kmod-nft-nat +kmod-nf-nat6
1049 FILES:=$(foreach mod,$(NFT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
1050 AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT6-m)))
1051 KCONFIG:=$(KCONFIG_NFT_NAT6)
1054 $(eval $(call KernelPackage,nft-nat6))