Xtables-addons

Xtables-addons is the successor to patch-o-matic(-ng). Likewise, it contains extensions that were not, or are not yet, accepted in the main kernel/iptables packages.

Xtables-addons is different from patch-o-matic in that you do not have to patch or recompile the kernel, sometimes recompiling iptables is also not needed. But please see the INSTALL file for the minimum requirements of this package.

(The name stems from Xtables, which is the protocol-agnostic code part of the table-based firewalling schema.)

patch-o-matic suffered from a number of problems:

• patch-o-matic was designed to patch and recompile kernel (using up valuable time)
• multiarch and endianess issues often ignored, making the modules not work on x86_64, much less on sparc64.
• some security issues — error handling was missing sometimes that could lead to an oops
• code was generally unreviewed
• pom modules have not received any real updates in months
• and from a purely maintenance pov: pom modules replicated the glue to work with multiple kernels in their files...

Availability

Some distributions have precompiled packages (varying age of version). Among those are: Alpine Linux, CRUX, Debian, Gentoo, PLD Linux, openSUSE, openWRT, Shorewall, Slackware, and possibly more.

Support

Send anything Xtables-addons related to the netfilter-devel list that is handled through vger.kernel.org or various alternate services, such as Gmane.

Alternatively, you can try in irc.freenode.net's #netfilter channel; but the mailing list is a place where things do not go unseen as easily.

Additional resources

• Slides for the presentation “Introduction to Xtables-addons” from NFWS2008 [jengelh.medozas.de]
• Writing Netfilter modules e-book [jengelh.medozas.de]

 

List of some extensions for search engine convenience: xt_CHAOS xt_DELUDE xt_DHCPMAC xt_ECHO xt_IPMARK xt_LOGMARK xt_RAWNAT xt_RAWDNAT xt_RAWSNAT xt_STEAL xt_SYSRQ xt_TARPIT xt_TEE xt_condition xt_fuzzy xt_geoip xt_iface xt_ipp2p xt_ipv4options xt_length2 xt_lscan xt_quota2 xt_portscan