Xtables-addons

---

Xtables-addons is the successor to patch-o-matic(-ng). Likewise, it contains extensions that were not, or are not yet, accepted in the main kernel/iptables packages.

Xtables-addons is different from patch-o-matic in that you do not have to patch or recompile the kernel, sometimes recompiling iptables is also not needed. But please see the INSTALL file for the minimum requirements of this package.

(The name stems from Xtables, which is the protocol-agnostic code part of the table-based firewalling schema.)

patch-o-matic suffered from a number of problems:

• patch-o-matic was designed to patch and recompile kernel (using up valuable time)
• multiarch and endianess issues often ignored, making the modules not work on x86_64, much less on sparc64.
• some security issues — error handling was missing sometimes that could lead to an oops
• code was generally unreviewed
• pom modules have not received any real updates in months
• and from a purely maintenance pov: pom modules replicated the glue to work with multiple kernels in their files...

Availability

Many distributions have precompiled packages ready! See the distro availability matrix for details.

• xt_geoip database installation instructions

Module list

Listing of the incorporated modules.

Support

Send anything Xtables-addons related to the netfilter-devel list that is handled through vger.kernel.org or various alternate services, such as Gmane. Subscription is not necessary, just post to it.

Alternatively, you can try in irc.freenode.net's #netfilter channel; but the mailing list is a place where things do not go unseen as easily.

Additional resources

• Slides for the presentation “Introduction to Xtables-addons” from NFWS2008 [jengelh.medozas.de]
• Writing Netfilter modules e-book [jengelh.medozas.de]