diff --git a/debian/changelog b/debian/changelog
index 5676fc2e0..597f2c6f4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -41,6 +41,8 @@ linux (4.12.6-1) UNRELEASED; urgency=medium
   * blk-mq: Enable IOSCHED_BFQ as module (Closes: #869028); enable
     BFQ_GROUP_IOSCHED
   * bfq: Enable auto-loading when built as a module
+  * netfilter: Enable NFT_FIB_IPV4, NFT_FIB_IPV6, NFT_FIB_INET as modules
+    (Closes: #868803)
 
   [ Salvatore Bonaccorso ]
   * packet: fix tp_reserve race in packet_set_ring (CVE-2017-1000111)
diff --git a/debian/config/config b/debian/config/config
index 951ce4966..97eb07b9f 100644
--- a/debian/config/config
+++ b/debian/config/config
@@ -6508,6 +6508,7 @@ CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NF_TABLES_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
+CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=m
 CONFIG_NF_LOG_ARP=m
 CONFIG_NF_LOG_IPV4=m
@@ -6573,6 +6574,7 @@ CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NF_TABLES_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
+CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_REJECT_IPV6=m
 CONFIG_NF_LOG_IPV6=m
 CONFIG_NF_NAT_IPV6=m
@@ -6710,6 +6712,7 @@ CONFIG_NFT_QUOTA=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=m
 CONFIG_NF_DUP_NETDEV=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m