kernel.conf

# Apparently these work even as builtins after all
loadables=(
#    CONFIG_NF_CONNTRACK_TFTP
#    CONFIG_NF_NAT_TFTP
)

builtins=(
    # firewalld won't be workable without these

    # profiling/it
    # xt_CT
    CONFIG_NETFILTER_XT_TARGET_CT
    # xt_helper
    CONFIG_NETFILTER_XT_MATCH_HELPER

    # --reload on nftables backend
    # nft_fib_ipv4
    CONFIG_NFT_FIB_IPV4
    # nft_fib_ipv6
    CONFIG_NFT_FIB_IPV6
    # nft_fib
    CONFIG_NFT_FIB
    #nft_fib_inet
    CONFIG_NFT_FIB_INET
)

# Let these stay here until 22.04 is also sorted out
# Reference: https://cateee.net/lkddb/web-lkddb/
#CONFIG_IP_NF_TARGET_REJECT
#CONFIG_NF_CONNTRACK
#CONFIG_IP_NF_IPTABLES
#CONFIG_NF_REJECT_IPV4
#CONFIG_IP6_NF_IPTABLES
#CONFIG_NET_SCH_FQ_CODEL
#CONFIG_BPFILTER_UMH
#CONFIG_IP_SET
#CONFIG_NETFILTER_NETLINK
#CONFIG_NF_REJECT_IPV6
#CONFIG_NF_TABLES
#CONFIG_NFT_COUNTER
#CONFIG_NETFILTER_XTABLES
# I thought these were needed for ipsec and docker-swarm firewalld services
#CONFIG_NETFILTER_XT_MATCH_ESP
#CONFIG_INET_AH
#CONFIG_INET6_AH
# Podman under WSL, but works even without
#CONFIG_BPFILTER
#CONFIG_BPFILTER_UMH
#CONFIG_NETFILTER_XT_MATCH_BPF