2 # Copyright (C) 2006-2016 OpenWrt.org
4 # This is free software, licensed under the GNU General Public License v2.
5 # See /LICENSE for more information.
8 include $(TOPDIR)/rules.mk
9 include $(INCLUDE_DIR)/kernel.mk
15 PKG_SOURCE_URL:=https://netfilter.org/projects/iptables/files
16 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
17 PKG_HASH:=993a3a5490a544c2cbf2ef15cf7e7ed21af1845baf228318d5c36ef8827e157c
25 PKG_CPE_ID:=cpe:/a:netfilter_core_team:iptables
27 include $(INCLUDE_DIR)/package.mk
29 -include $(LINUX_DIR)/.config
30 include $(INCLUDE_DIR)/netfilter.mk
31 STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell grep 'NETFILTER' $(LINUX_DIR)/.config | mkhash md5)
35 define Package/iptables/Default
39 URL:=https://netfilter.org/
42 define Package/iptables/Module
43 $(call Package/iptables/Default)
44 DEPENDS:=iptables $(1)
47 define Package/iptables
48 $(call Package/iptables/Default)
49 TITLE:=IP firewall administration tool
51 DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libxtables
54 define Package/iptables/config
55 config IPTABLES_CONNLABEL
56 bool "Enable Connlabel support"
59 This enable connlabel support in iptables.
61 config IPTABLES_NFTABLES
62 bool "Enable Nftables support"
65 This enable nftables support in iptables.
68 define Package/iptables/description
69 IP firewall administration tool.
108 define Package/iptables-nft
109 $(call Package/iptables/Default)
110 TITLE:=IP firewall administration tool nft
111 DEPENDS:=iptables @IPTABLES_NFTABLES +libxtables-nft
114 define Package/iptables-nft/description
115 Extra iptables nftables nft binaries.
120 iptables-restore-translate
123 define Package/iptables-mod-conntrack-extra
124 $(call Package/iptables/Module, +kmod-ipt-conntrack-extra +kmod-ipt-raw)
125 TITLE:=Extra connection tracking extensions
128 define Package/iptables-mod-conntrack-extra/description
129 Extra iptables extensions for connection tracking.
143 define Package/iptables-mod-conntrack-label
144 $(call Package/iptables/Module, +kmod-ipt-conntrack-label @IPTABLES_CONNLABEL)
145 TITLE:=Connection tracking labeling extension
146 DEFAULT:=y if IPTABLES_CONNLABEL
149 define Package/iptables-mod-conntrack-label/description
150 Match and set label(s) on connection tracking entries
157 define Package/iptables-mod-filter
158 $(call Package/iptables/Module, +kmod-ipt-filter)
159 TITLE:=Content inspection extensions
162 define Package/iptables-mod-filter/description
163 iptables extensions for packet content inspection.
164 Includes support for:
172 define Package/iptables-mod-ipopt
173 $(call Package/iptables/Module, +kmod-ipt-ipopt)
174 TITLE:=IP/Packet option extensions
177 define Package/iptables-mod-ipopt/description
178 iptables extensions for matching/changing IP packet options.
197 define Package/iptables-mod-ipsec
198 $(call Package/iptables/Module, +kmod-ipt-ipsec)
199 TITLE:=IPsec extensions
202 define Package/iptables-mod-ipsec/description
203 iptables extensions for matching ipsec traffic.
212 define Package/iptables-mod-nat-extra
213 $(call Package/iptables/Module, +kmod-ipt-nat-extra)
214 TITLE:=Extra NAT extensions
217 define Package/iptables-mod-nat-extra/description
218 iptables extensions for extra NAT targets.
225 define Package/iptables-mod-ulog
226 $(call Package/iptables/Module, +kmod-ipt-ulog)
227 TITLE:=user-space packet logging
230 define Package/iptables-mod-ulog/description
231 iptables extensions for user-space packet logging.
238 define Package/iptables-mod-nflog
239 $(call Package/iptables/Module, +kmod-nfnetlink-log +kmod-ipt-nflog)
240 TITLE:=Netfilter NFLOG target
243 define Package/iptables-mod-nflog/description
244 iptables extension for user-space logging via NFNETLINK.
251 define Package/iptables-mod-trace
252 $(call Package/iptables/Module, +kmod-ipt-debug)
253 TITLE:=Netfilter TRACE target
256 define Package/iptables-mod-trace/description
257 iptables extension for TRACE target
265 define Package/iptables-mod-nfqueue
266 $(call Package/iptables/Module, +kmod-nfnetlink-queue +kmod-ipt-nfqueue)
267 TITLE:=Netfilter NFQUEUE target
270 define Package/iptables-mod-nfqueue/description
271 iptables extension for user-space queuing via NFNETLINK.
278 define Package/iptables-mod-hashlimit
279 $(call Package/iptables/Module, +kmod-ipt-hashlimit)
280 TITLE:=hashlimit matching
283 define Package/iptables-mod-hashlimit/description
284 iptables extensions for hashlimit matching
291 define Package/iptables-mod-rpfilter
292 $(call Package/iptables/Module, +kmod-ipt-rpfilter)
293 TITLE:=rpfilter iptables extension
296 define Package/iptables-mod-rpfilter/description
297 iptables extensions for reverse path filter test on a packet
304 define Package/iptables-mod-iprange
305 $(call Package/iptables/Module, +kmod-ipt-iprange)
306 TITLE:=IP range extension
309 define Package/iptables-mod-iprange/description
310 iptables extensions for matching ip ranges.
317 define Package/iptables-mod-cluster
318 $(call Package/iptables/Module, +kmod-ipt-cluster)
319 TITLE:=Match cluster extension
322 define Package/iptables-mod-cluster/description
323 iptables extensions for matching cluster.
325 Netfilter (IPv4/IPv6) module for matching cluster
326 This option allows you to build work-load-sharing clusters of
327 network servers/stateful firewalls without having a dedicated
328 load-balancing router/server/switch. Basically, this match returns
329 true when the packet must be handled by this cluster node. Thus,
330 all nodes see all packets and this match decides which node handles
331 what packets. The work-load sharing algorithm is based on source
334 This module is usable for ipv4 and ipv6.
336 If you select it, it enables kmod-ipt-cluster.
338 see `iptables -m cluster --help` for more information.
341 define Package/iptables-mod-clusterip
342 $(call Package/iptables/Module, +kmod-ipt-clusterip)
343 TITLE:=Clusterip extension
346 define Package/iptables-mod-clusterip/description
347 iptables extensions for CLUSTERIP.
348 The CLUSTERIP target allows you to build load-balancing clusters of
349 network servers without having a dedicated load-balancing
350 router/server/switch.
352 If you select it, it enables kmod-ipt-clusterip.
354 see `iptables -j CLUSTERIP --help` for more information.
357 define Package/iptables-mod-extra
358 $(call Package/iptables/Module, +kmod-ipt-extra)
359 TITLE:=Other extra iptables extensions
362 define Package/iptables-mod-extra/description
363 Other extra iptables extensions.
374 define Package/iptables-mod-physdev
375 $(call Package/iptables/Module, +kmod-ipt-physdev)
376 TITLE:=physdev iptables extension
379 define Package/iptables-mod-physdev/description
380 The iptables physdev match.
383 define Package/iptables-mod-led
384 $(call Package/iptables/Module, +kmod-ipt-led)
385 TITLE:=LED trigger iptables extension
388 define Package/iptables-mod-led/description
389 iptables extension for triggering a LED.
396 define Package/iptables-mod-tproxy
397 $(call Package/iptables/Module, +kmod-ipt-tproxy)
398 TITLE:=Transparent proxy iptables extensions
401 define Package/iptables-mod-tproxy/description
402 Transparent proxy iptables extensions.
412 define Package/iptables-mod-tee
413 $(call Package/iptables/Module, +kmod-ipt-tee)
414 TITLE:=TEE iptables extensions
417 define Package/iptables-mod-tee/description
418 TEE iptables extensions.
425 define Package/iptables-mod-u32
426 $(call Package/iptables/Module, +kmod-ipt-u32)
427 TITLE:=U32 iptables extensions
430 define Package/iptables-mod-u32/description
431 U32 iptables extensions.
438 define Package/iptables-mod-checksum
439 $(call Package/iptables/Module, +kmod-ipt-checksum)
440 TITLE:=IP CHECKSUM target extension
443 define Package/iptables-mod-checksum/description
444 iptables extension for the CHECKSUM calculation target
447 define Package/ip6tables
448 $(call Package/iptables/Default)
449 DEPENDS:=@IPV6 +kmod-ip6tables +iptables
451 TITLE:=IPv6 firewall administration tool
455 define Package/ip6tables-nft
456 $(call Package/iptables/Default)
457 DEPENDS:=ip6tables @IPTABLES_NFTABLES +libxtables-nft
458 TITLE:=IP firewall administration tool nft
461 define Package/ip6tables-nft/description
462 Extra ip6tables nftables nft binaries.
467 iptables-restore-translate
470 define Package/ip6tables-extra
471 $(call Package/iptables/Default)
472 DEPENDS:=ip6tables +kmod-ip6tables-extra
473 TITLE:=IPv6 header matching modules
476 define Package/ip6tables-mod-extra/description
477 iptables header matching modules for IPv6
480 define Package/ip6tables-mod-nat
481 $(call Package/iptables/Default)
482 DEPENDS:=ip6tables +kmod-ipt-nat6
483 TITLE:=IPv6 NAT extensions
486 define Package/ip6tables-mod-nat/description
487 iptables extensions for IPv6-NAT targets.
490 define Package/libip4tc
491 $(call Package/iptables/Default)
494 TITLE:=IPv4 firewall - shared libiptc library
499 define Package/libip6tc
500 $(call Package/iptables/Default)
503 TITLE:=IPv6 firewall - shared libiptc library
508 define Package/libxtables
509 $(call Package/iptables/Default)
512 TITLE:=IPv4/IPv6 firewall - shared xtables library
515 +IPTABLES_CONNLABEL:libnetfilter-conntrack \
516 +IPTABLES_NFTABLES:libnftnl
519 define Package/libxtables-nft
520 $(call Package/iptables/Default)
523 TITLE:=IPv4/IPv6 firewall - shared xtables nft library
529 -I$(PKG_BUILD_DIR)/include \
530 -I$(LINUX_DIR)/user_headers/include \
534 -I$(PKG_BUILD_DIR)/include \
535 -I$(LINUX_DIR)/user_headers/include \
536 -ffunction-sections -fdata-sections \
546 --with-kernel="$(LINUX_DIR)/user_headers" \
547 --with-xtlibdir=/usr/lib/iptables \
548 --with-xt-lock-name=/var/run/xtables.lock \
549 $(if $(CONFIG_IPTABLES_CONNLABEL),,--disable-connlabel) \
550 $(if $(CONFIG_IPTABLES_NFTABLES),,--disable-nftables) \
551 $(if $(CONFIG_IPV6),,--disable-ipv6)
554 $(TARGET_CONFIGURE_OPTS) \
555 COPT_FLAGS="$(TARGET_CFLAGS)" \
556 KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
557 KBUILD_OUTPUT="$(LINUX_DIR)" \
558 BUILTIN_MODULES="$(patsubst ip6t_%,%,$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m))))"
560 ifneq ($(wildcard $(PKG_BUILD_DIR)/.config_*),$(subst .configured_,.config_,$(STAMP_CONFIGURED)))
561 define Build/Configure/rebuild
562 $(FIND) $(PKG_BUILD_DIR) -name \*.o -or -name \*.\?o -or -name \*.a | $(XARGS) rm -f
563 rm -f $(PKG_BUILD_DIR)/.config_*
564 rm -f $(PKG_BUILD_DIR)/.configured_*
565 touch $(subst .configured_,.config_,$(STAMP_CONFIGURED))
569 define Build/Configure
570 $(Build/Configure/rebuild)
571 $(Build/Configure/Default)
574 define Build/InstallDev
575 $(INSTALL_DIR) $(1)/usr/include
576 $(INSTALL_DIR) $(1)/usr/include/iptables
577 $(INSTALL_DIR) $(1)/usr/include/net/netfilter
579 # XXX: iptables header fixup, some headers are not installed by iptables anymore
580 $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
581 $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
582 $(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
583 $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
584 $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
586 $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
587 $(INSTALL_DIR) $(1)/usr/lib
588 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
589 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
590 $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
591 $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
592 $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libip*tc.pc $(1)/usr/lib/pkgconfig/
594 # XXX: needed by firewall3
595 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext*.so $(1)/usr/lib/
598 define Package/iptables/install
599 $(INSTALL_DIR) $(1)/usr/sbin
600 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-legacy-multi $(1)/usr/sbin/
601 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/
602 $(INSTALL_DIR) $(1)/usr/lib/iptables
605 define Package/iptables-nft/install
606 $(INSTALL_DIR) $(1)/usr/sbin
607 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-nft-multi $(1)/usr/sbin/
608 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables-nft{,-restore,-save} $(1)/usr/sbin/
609 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore}-translate $(1)/usr/sbin/
612 define Package/ip6tables/install
613 $(INSTALL_DIR) $(1)/usr/sbin
614 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/
617 define Package/ip6tables-nft/install
618 $(INSTALL_DIR) $(1)/usr/sbin
619 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables-nft{,-restore,-save} $(1)/usr/sbin/
620 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore}-translate $(1)/usr/sbin/
623 define Package/libip4tc/install
624 $(INSTALL_DIR) $(1)/usr/lib
625 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so.* $(1)/usr/lib/
626 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext4.so $(1)/usr/lib/
629 define Package/libip6tc/install
630 $(INSTALL_DIR) $(1)/usr/lib
631 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so.* $(1)/usr/lib/
632 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext6.so $(1)/usr/lib/
635 define Package/libxtables/install
636 $(INSTALL_DIR) $(1)/usr/lib
637 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so.* $(1)/usr/lib/
638 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext.so $(1)/usr/lib/
641 define Package/libxtables-nft/install
642 $(INSTALL_DIR) $(1)/usr/lib
643 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext_*.so $(1)/usr/lib/
647 define Package/$(1)/install
648 $(INSTALL_DIR) $$(1)/usr/lib/iptables
649 for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)) $(patsubst xt_%,ip6t_%,$(2)) $(patsubst ip6t_%,xt_%,$(2)); do \
650 if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
651 $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
657 $$(eval $$(call BuildPackage,$(1)))
660 $(eval $(call BuildPackage,iptables))
661 $(eval $(call BuildPackage,iptables-nft))
662 $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
663 $(eval $(call BuildPlugin,iptables-mod-conntrack-label,$(IPT_CONNTRACK_LABEL-m)))
664 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
665 $(eval $(call BuildPlugin,iptables-mod-physdev,$(IPT_PHYSDEV-m)))
666 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m)))
667 $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
668 $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
669 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
670 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
671 $(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m)))
672 $(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m)))
673 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
674 $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
675 $(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m)))
676 $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
677 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
678 $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
679 $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
680 $(eval $(call BuildPlugin,iptables-mod-nflog,$(IPT_NFLOG-m)))
681 $(eval $(call BuildPlugin,iptables-mod-trace,$(IPT_DEBUG-m)))
682 $(eval $(call BuildPlugin,iptables-mod-nfqueue,$(IPT_NFQUEUE-m)))
683 $(eval $(call BuildPlugin,iptables-mod-checksum,$(IPT_CHECKSUM-m)))
684 $(eval $(call BuildPackage,ip6tables))
685 $(eval $(call BuildPackage,ip6tables-nft))
686 $(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m)))
687 $(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m)))
688 $(eval $(call BuildPackage,libip4tc))
689 $(eval $(call BuildPackage,libip6tc))
690 $(eval $(call BuildPackage,libxtables))
691 $(eval $(call BuildPackage,libxtables-nft))