1SHOREWALL-FILES(5) Configuration Files SHOREWALL-FILES(5)
2
6 files - Shorewall Configuration Files
7
9 /etc/shorewall[6]/*
10
12 The following are the Shorewall[6] configuration files:
13 • /etc/shorewall/shorewall.conf and
15 /etc/shorewall6/shorewall6.conf[1] - used to set global firewall
16 parameters.
17 • /etc/shorewall[6]/params[2] - use this file to set shell variables
19 that you will expand in other files. It is always processed by
20 /bin/sh or by the shell specified through SHOREWALL_SHELL in
21 /etc/shorewall/shorewall.conf.
22 • /etc/shorewall[6]/zones[3] - partition the firewall's view of the
24 world into zones.
25 • /etc/shorewall[6]/policy[4] - establishes firewall high-level
27 policy.
28 • /etc/shorewall[6]/initdone - An optional Perl script that will be
30 invoked by the Shorewall rules compiler when the compiler has
31 finished it's initialization.
32 • /etc/shorewall[6]/interfaces[5] - describes the interfaces on the
34 firewall system.
35 • /etc/shorewall[6]/hosts[6] - allows defining zones in terms of
37 individual hosts and subnetworks.
38 • /etc/shorewall[6]/masq[7] - directs the firewall where to use
40 many-to-one (dynamic) Network Address Translation (a.k.a.
41 Masquerading) and Source Network Address Translation (SNAT).
42 Superseded by /etc/shorewall[6]/snat in Shorewall 5.0.14 and not
43 supported in Shorewall 5.1.0 and later versions.
44 • /etc/shorewall[6]/mangle[8] - supersedes /etc/shorewall/tcrules in
46 Shorewall 4.6.0. Contains rules for packet marking, TTL, TPROXY,
47 etc.
48 • /etc/shorewall[6]/rules[9] - defines rules that are exceptions to
50 the overall policies established in /etc/shorewall/policy.
51 • /etc/shorewall[6]/nat[10] - defines one-to-one NAT rules.
53 • /etc/shorewall6/proxyarp[11] - defines use of Proxy ARP.
55 • /etc/shorewall6/proxyndp[12] - defines use of Proxy NDP.
57 • /etc/shorewall[6]/routestopped - defines hosts accessible when
59 Shorewall is stopped. Superseded in Shorewall 4.6.8 by
60 /etc/shorewall/stoppedrules. Not supported in Shorewall 5.0.0 and
61 later versions.
62 • /etc/shorewall[6]/tcrules[13]- The file has a rather unfortunate
64 name because it is used to define marking of packets for later use
65 by both traffic control/shaping and policy routing. This file is
66 superseded by /etc/shorewall/mangle in Shorewall 4.6.0. Not
67 supported in Shorewall 5.0.0 and later releases.
68 • /etc/shorewall[6]/tos[14] - defines rules for setting the TOS field
70 in packet headers. Superseded in Shorewall 4.5.1 by the TOS target
71 in /etc/shorewall/tcrules (which file has since been superseded by
72 /etc/shorewall/mangle). Not supported in Shorewall 5.0.0 and later
73 versions.
74 • /etc/shorewall[6]/tunnels[15] - defines tunnels (VPN) with
76 end-points on the firewall system.
77 • /etc/shorewall[6]/blacklist[16] - Deprecated in favor of
79 /etc/shorewall/blrules. Lists blacklisted IP/subnet/MAC addresses.
80 Not supported in Shorewall 5.0.0 and later releases.
81 • /etc/shorewall[6]/blrules — Added in Shorewall 4.5.0. Define
83 blacklisting and whitelisting. Supersedes /etc/shorewall/blacklist.
84 • /etc/shorewall[6]/init - shell commands that you wish to execute at
86 the beginning of a “shorewall start”, "shorewall reload" or
87 “shorewall restart”.
88 • /etc/shorewall[6]/start - shell commands that you wish to execute
90 near the completion of a “shorewall start”, "shorewall reload" or
91 “shorewall restart”
92 • /etc/shorewall[6]/started - shell commands that you wish to execute
94 after the completion of a “shorewall start”, "shorewall reload" or
95 “shorewall restart”
96 • /etc/shorewall[6]/stop- commands that you wish to execute at the
98 beginning of a “shorewall stop”.
99 • /etc/shorewall[6]/stopped - shell commands that you wish to execute
101 at the completion of a “shorewall stop”.
102 • /etc/shorewall/ecn[17] - disable Explicit Congestion Notification
104 (ECN - RFC 3168) to remote hosts or networks. Superseded by ECN
105 entries in /etc/shorewall/mangle in Shorewall 5.0.6.
106 • /etc/shorewall/accounting[18] - define IP traffic accounting rules
108 • /etc/shorewall[6]/actions[19] and
110 /usr/share/shorewall[6]/action.template allow user-defined actions.
111 • /etc/shorewall[6]/providers[20] - defines alternate routing tables.
113 • /etc/shorewall[6]/rtrules[21] - Defines routing rules to be used in
115 conjunction with the routing tables defined in
116 /etc/shorewall/providers.
117 • /etc/shorewall[6]/tcdevices[22], /etc/shorewall[6]/tcclasses[23],
119 /etc/shorewall[6]/tcfilters[24] - Define complex traffic shaping.
120 • /etc/shorewall[6]/tcrules[13] - Mark or classify traffic for
122 traffic shaping or multiple providers. Deprecated in Shorewall
123 4.6.0 in favor of /etc/shorewall/mangle. Not supported in Shorewall
124 5.0.0 and later releases.
125 • /etc/shorewall[6]/tcinterfaces[25] and /etc/shorewall[6]/tcpri[26]
127 - Define simple traffic shaping.
128 • /etc/shorewall[6]/secmarks[27] - Added in Shorewall 4.4.13. Attach
130 an SELinux context to selected packets.
131 • /etc/shorewall[6]/vardir[28] - Determines the directory where
133 Shorewall maintains its state.
134 • /etc/shorewall/arprules[29] — Added in Shorewall 4.5.12. Allows
136 specification of arptables rules.
137 • /etc/shorewall/mangle[8] -- Added in Shorewall 4.6.0.
139 Supersedes/etc/shorewall/tcrules.
140 • /etc/shorewall[6]/snat[30] - directs the firewall where to use
142 many-to-one (dynamic) Network Address Translation (a.k.a.
143 Masquerading) and Source Network Address Translation (SNAT).
144 Superseded /etc/shorewall[6]/masq in Shorewall 5.0.14
145 • /usr/share/shorewall[6]/actions.std - Actions defined by Shorewall.
147 • /usr/share/shorewall[6]/action.* - Details of actions defined by
149 Shorewall.
150 • /usr/share/shorewall[6]/macro.* - Details of macros defined by
152 Shorewall.
153 • /usr/share/shorewall[6]/modules — Specifies the kernel modules to
155 be loaded during shorewall start/restart.
156 • /usr/share/shorewall[6]/helpers — Added in Shorewall 4.4.7.
158 Specifies the kernel modules to be loaded during shorewall
159 start/restart when LOAD_HELPERS_ONLY=Yes in shorewall.conf.
160
162 The CONFIG_PATH option in shorewall[6].conf(5)[20] determines where the
163 compiler searches for configuration files. The default setting is
164 CONFIG_PATH=/etc/shorewall:/usr/share/shorewall which means that the
165 compiler first looks in /etc/shorewall and if it doesn't find the file,
166 it then looks in /usr/share/shorewall.
167 You can change this setting to have the compiler look in different
169 places. For example, if you want to put your own versions of standard
170 macros in /etc/shorewall/Macros, then you could set
171 CONFIG_PATH=/etc/shorewall:/etc/shorewall/Macros:/usr/share/shorewall
172 and the compiler will use your versions rather than the standard ones.
173
175 You may place comments in configuration files by making the first
176 non-whitespace character a pound sign (“#”). You may also place
177 comments at the end of any line, again by delimiting the comment from
178 the rest of the line with a pound sign.
179 Example 1. Comments in a Configuration File
181 # This is a comment
183 ACCEPT net $FW tcp www #This is an end-of-line comment
184 Important
186 Except in shorewall.conf(5)[1] and params(5)[2], if a comment ends
187 with a backslash ("\"), the next line will also be treated as a
188 comment. See Line Continuation below.
189
191 Most of the configuration files are organized into space-separated
192 columns. If you don't want to supply a value in a column but want to
193 supply a value in a following column, simply enter '-' to make the
194 column appear empty.
195 Example:
197 #INTERFACE BROADCAST OPTIONS
199 br0 - routeback
200
202 Lines may be continued using the usual backslash (“\”) followed
203 immediately by a new line character (Enter key).
204 ACCEPT net $FW tcp \↵
206 smtp,www,pop3,imap #Services running on the firewall
207 Important
210 What follows does NOT apply to shorewall-params(5)[31] and
211 shorewall.conf(5)[1].
212 In certain cases, leading white space is ignored in continuation lines:
214 1. The continued line ends with a colon (":")
216 2. The continued line ends with a comma (",")
218 Example (/etc/shorewall/rules):
220 #ACTION SOURCE DEST PROTO DPORT
222 ACCEPT net:\
223 206.124.146.177,\
224 206.124.146.178,\
225 206.124.146.180\
226 dmz tcp 873
227 The leading white space on the first through third continuation lines
229 is ignored so the SOURCE column effectively contains
230 "net:206.124.146.177,206.124.147.178,206.124.146.180". Because the
231 third continuation line does not end with a comma or colon, the leading
232 white space in the last line is not ignored.
233 Important
235 A trailing backslash is not ignored in a comment. So the continued
236 rule above can be commented out with a single '#' as follows:
237 #ACTION SOURCE DEST PROTO DPORT
239 #ACCEPT net:\
240 206.124.146.177,\
241 206.124.146.178,\
242 206.124.146.180\
243 dmz tcp 873
244
246 Some of the configuration files now have a large number of columns.
247 That makes it awkward to specify a value for one of the right-most
248 columns as you must have the correct number of intervening '-' columns.
249 This problem is addressed by allowing column values to be specified as
251 column-name/value pairs.
252 There is considerable flexibility in how you specify the pairs:
254 • At any point, you can enter a left curly bracket ('{') followed by
256 one or more specifications of the following forms:
257 column-name=value
258 column-name=>value
259 column-name:value
260 The pairs must be followed by a right curly bracket ("}").
261 The value may optionally be enclosed in double quotes.
263 The pairs must be separated by white space, but you can add a comma
265 adjacent to the values for readability as in:
266 { proto=>udp, port=1024
267 }
268 • You can also separate the pairs from columns by using a semicolon:
270 ; proto:udp,
271 port:1024
272 In Shorewall 5.0.3, the sample configuration files and the man pages
274 were updated to use the same column names in both the column headings
275 and in the alternate specification format. The following table shows
276 the column names for each of the table-oriented configuration files.
277 Note
279 Column names are case-insensitive.
280 ┌──────────────────────┬───────────────────────────────────────────────────────────────────────────────────────────────────┐
282 │File │ Column names │
283 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
284 │accounting │ action,chain, source, │
285 │ │ dest, proto, dport, sport, │
286 │ │ user, │
287 │ │ mark, ipsec, │
288 │ │ headers │
289 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
290 │conntrack │ action,source,dest,proto,dport,sport,user,switch │
291 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
292 │blacklist │ networks,proto,port,options │
293 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
294 │blrules │ action,source,dest,proto,dport,sport,origdest,rate,user,mark,connlimit,time,headers,switch,helper │
295 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
296 │ecn │ interface,hosts. Beginning with Shorewall 4.5.4, 'host' is │
297 │ │ a synonym for 'hosts'. │
298 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
299 │hosts │ zone,hosts,options. Beginning with Shorewall 4.5.4, 'host' │
300 │ │ is a synonym for 'hosts'. │
301 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
302 │interfaces │ zone,interface,broadcast,options │
303 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
304 │maclist │ disposition,interface,mac,addresses │
305 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
306 │mangle │ action,source,dest,proto,dport,sport,user,test,length,tos,connbytes,helper,headers │
307 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
308 │masq │ interface,source,address,proto,port,ipsec,mark,user,switch │
309 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
310 │nat │ external,interface,internal,allints,local │
311 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
312 │netmap │ type,net1,interface,net2,net3,proto,dport,sport │
313 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
314 │notrack │ source,dest,proto,dport,sport,user │
315 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
316 │policy │ source,dest,policy,loglevel,limit,connlimit │
317 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
318 │providers │ table,number,mark,duplicate,interface,gateway,options,copy │
319 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
320 │proxyarp and proxyndp │ address,interface,external,haveroute,persistent │
321 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
322 │rtrules │ source,dest,provider,priority │
323 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
324 │routes │ provider,dest,gateway,device │
325 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
326 │routestopped │ interface,hosts,options,proto,dport,sport │
327 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
328 │rules │ action,source,dest,proto,dport,sport,origdest,rate,user,mark,connlimit,time,headers,switch,helper │
329 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
330 │secmarks │ secmark,chain,source,dest,proto,dport,sport,user,mark │
331 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
332 │tcclasses │ interface,mark,rate,ceil,prio,options │
333 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
334 │tcdevices │ interface,in_bandwidth,out_bandwidth,options,redirect │
335 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
336 │tcfilters │ class,source,dest,proto,dport,sport,tos,length │
337 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
338 │tcinterfaces │ interface,type,in_bandwidth,out_bandwidth │
339 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
340 │tcpri │ band,proto,port,address,interface,helper │
341 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
342 │tcrules │ mark,source,dest,proto,dport,sport,user,test,length,tos,connbytes,helper,headers. │
343 │ │ Beginning with Shorewall 4.5.3, 'action' is a synonym for │
344 │ │ 'mark'. │
345 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
346 │tos │ source,dest,proto,dport,sport,tos,mark │
347 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
348 │tunnels │ type,zone,gateway,gateway_zone. Beginning with Shorewall │
349 │ │ 4.5.3, 'gateways' is a synonym for 'gateway'. Beginning with │
350 │ │ Shorewall 4.5.4, 'gateway_zones' is a synonym for │
351 │ │ 'gateway_zone'. │
352 ├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤
353 │zones │ zone,type,options,in_options,out_options │
354 └──────────────────────┴───────────────────────────────────────────────────────────────────────────────────────────────────┘
355 Example (rules file):
357 #ACTION SOURCE DEST PROTO DPORT
359 DNAT net loc:10.0.0.1 tcp 80 ; mark="88"
360 Here's the same line in several equivalent formats:
362 { action=>DNAT, source=>net, dest=>loc:10.0.0.1, proto=>tcp, dport=>80, mark=>88 }
364 ; action:"DNAT" source:"net" dest:"loc:10.0.0.1" proto:"tcp" dport:"80" mark:"88"
365 DNAT { source=net dest=loc:10.0.0.1 proto=tcp dport=80 mark=88 }
366 Beginning with Shorewall 5.0.11, ip[6]table comments can be attached to
368 individual rules using the comment keyword.
369 Example from the rules file:
371 ACCEPT net $FW { proto=tcp, dport=22, comment="Accept \"SSH\"" }
373 As shown in that example, when the comment contains whitespace, it must
375 be enclosed in double quotes and any embedded double quotes must be
376 escaped using a backslash ("\").
377
379 Several of the files include a TIME column that allows you to specify
380 times when the rule is to be applied. Contents of this column is a list
381 of timeelements separated by apersands (&).
382 Each timeelement is one of the following:
384 timestart=hh:mm[:ss]
386 Defines the starting time of day.
387 timestop=hh:mm[:ss]
389 Defines the ending time of day.
390 contiguous
392 Added in Shoreawll 5.0.12. When timestop is smaller than timestart
393 value, match this as a single time period instead of distinct
394 intervals. See the Examples below.
395 utc
397 Times are expressed in Greenwich Mean Time.
398 localtz
400 Deprecated by the Netfilter team in favor of kerneltz. Times are
401 expressed in Local Civil Time (default).
402 kerneltz
404 Added in Shorewall 4.5.2. Times are expressed in Local Kernel Time
405 (requires iptables 1.4.12 or later).
406 weekdays=ddd[,ddd]...
408 where ddd is one of Mon, Tue, Wed, Thu, Fri, Sat or Sun
409 monthdays=dd[,dd],...
411 where dd is an ordinal day of the month
412 datestart=yyyy[-mm[-dd[Thh[:mm[:ss]]]]]
414 Defines the starting date and time.
415 datestop=yyyy[-mm[-dd[Thh[:mm[:ss]]]]]
417 Defines the ending date and time.
418 Examples:
420 To match on weekends, use:
422 weekdays=Sat,Sun
424 Or, to match (once) on a national holiday block:
426 datestart=2016-12-24&datestop=2016-12-27
428 Since the stop time is actually inclusive, you would need the following
430 stop time to not match the first second of the new day:
431 datestart=2016-12-24T17:00&datestop=2016-12-27T23:59:59
433 During Lunch Hour
435 The fourth Friday in the month:
437 weekdays=Fri&monthdays=22,23,24,25,26,27,28
439 Matching across days might not do what is expected. For instance,
441 weekdays=Mon×tart=23:00×top=01:00
443 Will match Monday, for one hour from midnight to 1 a.m., and then
445 again for another hour from 23:00 onwards. If this is unwanted,
446 e.g. if you would like 'match for two hours from Montay 23:00
447 onwards' you need to also specify the contiguous option in the
448 example above.
449
451 here are times when you would like to enable or disable one or more
452 rules in the configuration without having to do a shorewall reload or
453 shorewall restart. This may be accomplished using the SWITCH column in
454 shorewall-rules[32] (5) or shorewall6-rules[32] (5). Using this column
455 requires that your kernel and iptables include Condition Match Support
456 and you must be running Shorewall 4.4.24 or later. See the output of
457 shorewall show capabilities and shorewall version to determine if you
458 can use this feature.
459 The SWITCH column contains the name of a switch. Each switch is
461 initially in the off position. You can turn on the switch named switch1
462 by:
463 echo 1 >
464 /proc/net/nf_condition/switch1
465 You can turn it off again by:
467 echo 0 >
468 /proc/net/nf_condition/switch1
469 If you simply include the switch name in the SWITCH column, then the
471 rule is enabled only when the switch is on. If you precede the switch
472 name with ! (e.g., !switch1), then the rule is enabled only when the
473 switch is off. Switch settings are retained over shorewall reload.
474 Shorewall requires that switch names:
476 • begin with a letter and be composed of letters, digits, underscore
478 ('_') or hyphen ('-'); and
479 • be 30 characters or less in length.
481 Multiple rules can be controlled by the same switch.
483 Example:
485 Forward port 80 to dmz host $BACKUP if switch 'primary_down' is on.
487 #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER MARK CONNLIMIT TIME HEADERS SWITCH
489 DNAT net dmz:$BACKUP tcp 80 - - - - - - - - primary_down
490
492 /etc/shorewall[6]/*
493
495 1. /etc/shorewall/shorewall.conf
496 and /etc/shorewall6/shorewall6.conf
497 https://shorewall.org/manpages/shorewall.conf.html
498 2. /etc/shorewall[6]/params
500 https://shorewall.org/manpages/shorewall-params.html
501 3. /etc/shorewall[6]/zones
503 https://shorewall.org/manpages/shorewall-zones.html
504 4. /etc/shorewall[6]/policy
506 https://shorewall.org/manpages/shorewall-policy.html
507 5. /etc/shorewall[6]/interfaces
509 https://shorewall.org/manpages/shorewall-interfaces.html
510 6. /etc/shorewall[6]/hosts
512 https://shorewall.org/manpages/shorewall-hosts.html
513 7. /etc/shorewall[6]/masq
515 https://shorewall.org/manpages/shorewall-masq.html
516 8. /etc/shorewall[6]/mangle
518 https://shorewall.org/manpages/shorewall-mangle.html
519 9. /etc/shorewall[6]/rules
521 https://shorewall.org/manpages/shorewall-rules.html
522 10. /etc/shorewall[6]/nat
524 https://shorewall.org/manpages/shorewall-nat.html
525 11. /etc/shorewall6/proxyarp
527 https://shorewall.org/manpages/shorewall-proxyarp.html
528 12. /etc/shorewall6/proxyndp
530 https://shorewall.org/manpages/shorewall-proxyndp.html
531 13. /etc/shorewall[6]/tcrules
533 https://shorewall.org/manpages/shorewall-tcrules.html
534 14. /etc/shorewall[6]/tos
536 https://shorewall.org/manpages/shorewall-tos.html
537 15. /etc/shorewall[6]/tunnels
539 https://shorewall.org/manpages/shorewall-tunnels.html
540 16. /etc/shorewall[6]/blacklist
542 https://shorewall.org/manpages/shorewall-blacklist.html
543 17. /etc/shorewall/ecn
545 https://shorewall.org/manpages/shorewall-ecn.html
546 18. /etc/shorewall/accounting
548 https://shorewall.org/manpages/shorewall-accounting.html
549 19. /etc/shorewall[6]/actions
551 https://shorewall.org/manpages/shorewall-actions.html
552 20. /etc/shorewall[6]/providers
554 https://shorewall.org/manpages/???
555 21. /etc/shorewall[6]/rtrules
557 https://shorewall.org/manpages/shorewall-rtrules.html
558 22. /etc/shorewall[6]/tcdevices
560 https://shorewall.org/manpages/shorewall-tcdevices.html
561 23. /etc/shorewall[6]/tcclasses
563 https://shorewall.org/manpages/shorewall-tcclasses.html
564 24. /etc/shorewall[6]/tcfilters
566 https://shorewall.org/manpages/shorewall-tcfilters.html
567 25. /etc/shorewall[6]/tcinterfaces
569 https://shorewall.org/manpages/shorewall-tcinterfaces.html
570 26. /etc/shorewall[6]/tcpri
572 https://shorewall.org/manpages/shorewall-tcpri.html
573 27. /etc/shorewall[6]/secmarks
575 https://shorewall.org/manpages/shorewall-secmarks.html
576 28. /etc/shorewall[6]/vardir
578 https://shorewall.org/manpages/shorewall-vardir.html
579 29. /etc/shorewall/arprules
581 https://shorewall.org/manpages/shorewall-arprules.html
582 30. /etc/shorewall[6]/snat
584 https://shorewall.org/manpages/shorewall-snat.html
585 31. shorewall-params(5)
587 https://shorewall.org/manpages/shorewall-params.html
588 32. shorewall-rules
590 https://shorewall.org/manpages/shorewall-rules.html
591Configuration Files 09/24/2020 SHOREWALL-FILES(5)