Xtables-addons

---

Xtables-addons is a set of additional extensions for the Xtables packet filter that is present in the Linux kernel (which is loosely known by its administrative commands iptables/ip6tables/etc.).

Xtables-addons is the successor to patch-o-matic(-ng). Likewise, it contains extensions that were not, or are not yet, accepted in the main kernel/iptables packages.

Xtables-addons is different from patch-o-matic in that you do not have to patch or recompile the kernel, sometimes recompiling iptables is also not needed. See the INSTALL file for the minimum requirements of this package.

patch-o-matic suffered from a number of problems:

• patch-o-matic was designed to patch and recompile kernel (using up valuable time)
• multiarch and endianess issues often ignored, making the modules not work on x86_64, much less on sparc64.
• some security issues — error handling was missing sometimes that could lead to an oops
• and from a purely maintenance pov: pom modules replicated the glue to work with multiple kernels in their files...

Availability

• Many distributions already have packages ready for installation. (Use them.)
• xt_geoip database installation instructions

Support

Send anything Xtables-addons related to the netfilter-devel list that is handled through vger.kernel.org or various alternate services, such as Gmane. Subscription is not necessary, just post to it.

Additional resources

• Slides for the presentation “Introduction to Xtables-addons” from NFWS2008
• Writing Netfilter modules e-book