{"id":4342,"date":"2022-12-20T17:49:01","date_gmt":"2022-12-20T20:49:01","guid":{"rendered":"http:\/\/lode.uno\/linux-man\/index.php\/2022\/12\/20\/shorewallaccountin-man5\/"},"modified":"2022-12-20T17:49:01","modified_gmt":"2022-12-20T20:49:01","slug":"shorewallaccountin-man5","status":"publish","type":"post","link":"https:\/\/lode.uno\/linux-man\/2022\/12\/20\/shorewallaccountin-man5\/","title":{"rendered":"SHOREWALL−ACCOUNTIN (man5)"},"content":{"rendered":"

SHOREWALL\u2212ACCOUNTIN<\/h1>\n

NAME<\/a>
SYNOPSIS<\/a>
DESCRIPTION<\/a>
FILES<\/a>
SEE ALSO<\/a>
NOTES<\/a> <\/p>\n

\n

NAME <\/a> <\/h2>\n

accounting \u2212 Shorewall Accounting file<\/p>\n

SYNOPSIS <\/a> <\/h2>\n\n\n
<\/td>\n\n

\/etc\/shorewall[6]\/accounting<\/b><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

DESCRIPTION <\/a> <\/h2>\n

Accounting rules exist simply to count packets and bytes in categories that you define in this file. You may display these rules and their packet and byte counters using the shorewall show accounting<\/b> command.<\/p>\n

Beginning with Shorewall 4.4.18, the accounting structure can be created with three root chains:<\/p>\n

\u2022 accountin<\/b>: Rules that are valid in the INPUT<\/b> chain (may not specify an output interface).<\/p>\n

\u2022 accountout<\/b>: Rules that are valid in the OUTPUT chain (may not specify an input interface or a MAC address).<\/p>\n

\u2022 accounting<\/b>: Other rules.<\/p>\n

The new structure is enabled by sectioning the accounting file in a manner similar to the rules file<\/font><\/b> [1]<\/font><\/small> . The sections are INPUT<\/b>, OUTPUT<\/b> and FORWARD<\/b> and must appear in that order (although any of them may be omitted). The first non\u2212commentary record in the accounting file must be a section header when sectioning is used.<\/font><\/p>\n

Warning<\/big><\/b>
If sections are not used, the Shorewall rules compiler cannot detect certain violations of netfilter restrictions. These violations can result in run\u2212time errors such as the following:<\/font><\/p>\n

iptables\u2212restore v1.4.13: Can’t use \u2212o with INPUT<\/b><\/font><\/p>\n

Beginning with Shorewall 4.4.20, the ACCOUNTING_TABLE setting was added to shorewall.conf and shorewall6.conf. That setting determines the Netfilter table (filter or mangle) where the accounting rules are added. When ACCOUNTING_TABLE=mangle is specified, the available sections are PREROUTING<\/b>, INPUT<\/b>, OUTPUT<\/b>, FORWARD<\/b> and POSTROUTING<\/b>.<\/font><\/p>\n

Section headers have the form:<\/font><\/p>\n

?SECTION<\/b> section\u2212name<\/i><\/font><\/p>\n

When sections are enabled:<\/font><\/p>\n

\u2022 A jump to a user\u2212defined accounting chain must appear before entries that add rules to that chain. This eliminates loops and unreferenced chains.<\/font><\/p>\n

\u2022 An output interface may not be specified in the PREROUTING<\/b> and INPUT<\/b> sections.<\/font><\/p>\n

\u2022 In the OUTPUT<\/b> and POSTROUTING<\/b> sections:<\/font><\/p>\n

\u2022 An input interface may not be specified<\/font><\/p>\n

\u2022 Jumps to a chain defined in the INPUT<\/b> or PREROUTING<\/b> sections that specifies an input interface are prohibited<\/font><\/p>\n

\u2022 MAC addresses may not be used<\/font><\/p>\n

\u2022 Jump to a chain defined in the INPUT<\/b> or PREROUTING<\/b> section that specifies a MAC address are prohibited.<\/font><\/p>\n

\u2022 The default value of the CHAIN column is:<\/font><\/p>\n

\u2022 accountin<\/b> in the INPUT<\/b> section<\/font><\/p>\n

\u2022 accountout<\/b> in the OUTPUT<\/b> section<\/font><\/p>\n

\u2022 accountfwd<\/b> in the FORWARD<\/b> section<\/font><\/p>\n

\u2022 accountpre<\/b> in the PREROUTING<\/b> section<\/font><\/p>\n

\u2022 accountpost<\/b> in the POSTROUTING<\/b> section<\/font><\/p>\n

\u2022 Traffic addressed to the firewall goes through the rules defined in the INPUT section.<\/font><\/p>\n

\u2022 Traffic originating on the firewall goes through the rules defined in the OUTPUT section.<\/font><\/p>\n

\u2022 Traffic being forwarded through the firewall goes through the rules from the FORWARD sections.<\/font><\/p>\n

The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in the alternate specification syntax):<\/font><\/p>\n

ACTION<\/b> \u2212 {COUNT<\/b>|DONE<\/b>|chain<\/i>[:{COUNT<\/b>|JUMP}]|ACCOUNT(table<\/i>,network<\/i>)|[?]COMMENT comment<\/i>}<\/font><\/p>\n

What to do when a matching packet is found.<\/font><\/p>\n

COUNT<\/b><\/font><\/p>\n

Simply count the match and continue with the next rule<\/font><\/p>\n

DONE<\/b><\/font><\/p>\n

Count the match and don’t attempt to match any other accounting rules in the chain specified in the CHAIN<\/b> column.<\/font><\/p>\n

chain<\/i>[:COUNT<\/b>]<\/font><\/p>\n

Where chain<\/i> is the name of a chain; shorewall will create the chain automatically if it doesn’t already exist. If a second chain is mentioned in the CHAIN column, then a jump from this second chain to chain<\/i> is created. If no chain is named in the CHAIN column, then a jump from the default chain to chain<\/i> is created. If :COUNT<\/b> is included, a counting rule matching this entry will be added to chain<\/i>. The chain<\/i> may not exceed 29 characters in length and may be composed of letters, digits, dash (‘\u2212’) and underscore (‘_’).<\/font><\/p>\n

chain<\/i>:JUMP<\/font><\/p>\n

Like the previous option without the :COUNT<\/b> part.<\/font><\/p>\n

ACCOUNT(<\/b>table<\/i>,network<\/i>)<\/b><\/font><\/p>\n

This action implements per\u2212IP accounting and was added in Shorewall 4.4.17. Requires the ACCOUNT Target<\/i> capability in your iptables and kernel (see the output of shorewall show capabilities<\/b>).<\/font><\/p>\n

table<\/i><\/font><\/p>\n

is the name of an accounting table (you choose the name). All rules specifying the same name will have their per\u2212IP counters accumulated in the same table.<\/font><\/p>\n

network<\/i><\/font><\/p>\n

is an IPv4 network<\/b> in CIDR notation (e.g., 192.168.1.0\/24). The network can be as large as a \/8 (class A).<\/font><\/p>\n

One nice feature of per\u2212IP accounting is that the counters survive shorewall restart<\/b>. This has a downside, however. If you change the network associated with an accounting table, then you must shorewall stop; shorewall start<\/b> to have a successful restart (counters will be cleared).<\/font><\/p>\n

The counters in a table<\/i> are printed using the iptaccount<\/b> utility. For a command synopsis, type:<\/font><\/p>\n

iptaccount \u2212\u2212help<\/b><\/font><\/p>\n

As of February 2011, the ACCOUNT Target capability and the iptaccount utility are only available when<\/font> xtables\u2212addons<\/font><\/b> [2]<\/font><\/small> is installed. See<\/font> https:\/\/shorewall.org\/Accounting.html#perIP<\/font><\/b> [3]<\/font><\/small> for additional information.<\/font><\/p>\n

INLINE<\/b><\/font><\/p>\n

Added in Shorewall 4.5.16. Allows free form iptables matches to be specified following a ‘;’. In the generated iptables rule(s), the free form matches will follow any matches that are generated by the column contents.<\/font><\/p>\n

NFACCT<\/b>({object<\/i>[!]}[,…])<\/font><\/p>\n

Added in Shorewall 4.5.7. Provides a form of accounting that survives shorewall stop\/shorewall<\/b> start and shorewall restart<\/b>. Requires the NFaccnt Match capability in your kernel and iptables. object<\/i> names an nfacct object (see man nfaccnt(8)). Multiple rules can specify the same object<\/i>; all packets that match any of the rules increment the packet and bytes count of the object.<\/font><\/p>\n

Prior to Shorewall 4.5.16, only one object<\/i> could be specified. Beginning with Shorewall 4.5.16, an arbitrary number of objects may be given.<\/font><\/p>\n

With Shorewall 4.5.16 or later, an nfacct object<\/i> in the list may optionally be followed by !<\/b> to indicate that the nfacct object<\/i> will be incremented unconditionally for each packet. When !<\/b> is omitted, the object<\/i> will be incremented only if all of the matches in the rule succeed.<\/font><\/p>\n

NFLOG<\/b>[(nflog\u2212parameters)] \u2212 Added in Shorewall\u22124.4.20.<\/font><\/p>\n

Causes each matching packet to be sent via the currently loaded logging back\u2212end (usually nfnetlink_log) where it is available to accounting daemons through a netlink socket.<\/font><\/p>\n

?COMMENT<\/b><\/font><\/p>\n

The remainder of the line is treated as a comment which is attached to subsequent rules until another COMMENT line is found or until the end of the file is reached. To stop adding comments to rules, use a line with only the word ?COMMENT.<\/font><\/p>\n

CHAIN<\/b> \u2212 {\u2212<\/b>|chain<\/i>}<\/font><\/p>\n

The name of a chain<\/i>. If specified as \u2212<\/b> the accounting<\/b> chain is assumed when the file is un\u2212sectioned. When the file is sectioned, the default is one of accountin, accountout, etc. depending on the section. This is the chain where the accounting rule is added. The chain<\/i> will be created if it doesn’t already exist. The chain<\/i> may not exceed 29 characters in length.<\/font><\/p>\n

SOURCE<\/b> \u2212 {\u2212<\/b>|any<\/b>|all<\/b>|interface<\/i>|interface<\/i>:<\/b>address<\/i>|address<\/i>}<\/font><\/p>\n

Packet Source.<\/font><\/p>\n

The name of an interface<\/i>, an address<\/i> (host or net) or an interface<\/i> name followed by “:” and a host or net address<\/i>. An ipset name is also accepted as an address<\/i>.<\/font><\/p>\n

DEST<\/b> \u2212 {\u2212<\/b>|any<\/b>|all<\/b>|interface<\/i>|interface<\/i>:<\/b>address<\/i>|address<\/i>}<\/font><\/p>\n

This column was formerly named DESTINATION.<\/font><\/p>\n

Packet Destination.<\/font><\/p>\n

Format same as SOURCE<\/b> column.<\/font><\/p>\n

PROTO<\/b> \u2212 {\u2212<\/b>|{any<\/b>|all<\/b>|protocol\u2212name<\/i>|protocol\u2212number<\/i>|ipp2p<\/b>[:<\/b>{udp<\/b>|all<\/b>}]}[,…]}<\/font><\/p>\n

This column was formerly named PROTOCOL<\/font><\/p>\n

A protocol\u2212name<\/i> (from protocols(5)), a protocol\u2212number<\/i>, ipp2p<\/b>, ipp2p:udp<\/b> or ipp2p:all<\/b><\/font><\/p>\n

Beginning with Shorewall 4.5.12, this column can accept a comma\u2212separated list of protocols.<\/font><\/p>\n

DPORT<\/b> \u2212 {\u2212<\/b>|any<\/b>|all<\/b>|ipp2p\u2212option<\/i>|port\u2212name\u2212or\u2212number<\/i>[,port\u2212name\u2212or\u2212number<\/i>]…}<\/font><\/p>\n

Destination Port number. Service name from services(5) or port number<\/i>. May only be specified if the protocol is TCP (6), UDP (17), DCCP (33), SCTP (132) or UDPLITE (136).<\/font><\/p>\n

You may place a comma\u2212separated list of port names or numbers in this column if your kernel and iptables include multi\u2212port match support.<\/font><\/p>\n

If the PROTOCOL is ipp2p<\/b> then this column must contain an ipp2p\u2212option<\/i> (“iptables \u2212m ipp2p \u2212\u2212help”) without the leading “\u2212\u2212”. If no option is given in this column, ipp2p<\/b> is assumed.<\/font><\/p>\n

This column was formerly named DEST PORT(S).<\/font><\/p>\n

SPORT<\/b> \u2212 {\u2212<\/b>|any<\/b>|all<\/b>|port\u2212name\u2212or\u2212number<\/i>[,port\u2212name\u2212or\u2212number<\/i>]…}<\/font><\/p>\n

Service name from services(5) or port number<\/i>. May only be specified if the protocol is TCP (6), UDP (17), DCCP (33), SCTP (132) or UDPLITE (136).<\/font><\/p>\n

You may place a comma\u2212separated list of port numbers in this column if your kernel and iptables include multi\u2212port match support.<\/font><\/p>\n

Beginning with Shorewall 4.5.15, you may place ‘=’ in this column, provided that the DEST PORT(S) column is non\u2212empty. This causes the rule to match when either the source port or the destination port in a packet matches one of the ports specified in DPORT. Use of ‘=’ requires multi\u2212port match in your iptables and kernel.<\/font><\/p>\n

This column was formerly labelled SOURCE PORT(S).<\/font><\/p>\n

USER<\/b> \u2212 [!<\/b>][user\u2212name\u2212or\u2212number<\/i>][:<\/b>group\u2212name\u2212or\u2212number<\/i>][+<\/b>program\u2212name<\/i>]<\/font><\/p>\n

This column was formerly named USER\/GROUP and may only be non\u2212empty if the CHAIN<\/b> is OUTPUT<\/b>.<\/font><\/p>\n

When this column is non\u2212empty, the rule applies only if the program generating the output is running under the effective user<\/i> and\/or group<\/i> specified (or is NOT running under that id if “!” is given).<\/font><\/p>\n

Examples:<\/font><\/p>\n

joe<\/font><\/p>\n

program must be run by joe<\/font><\/p>\n

:kids<\/font><\/p>\n

program must be run by a member of the ‘kids’ group<\/font><\/p>\n

!:kids<\/font><\/p>\n

program must not be run by a member of the ‘kids’ group<\/font><\/p>\n

+upnpd<\/font><\/p>\n

#program named upnpd<\/font><\/p>\n

Important<\/big><\/b>
The ability to specify a program name was removed from Netfilter in kernel version 2.6.14.<\/font><\/p>\n

MARK<\/big><\/b> \u2212 [!<\/b>]value<\/i>[\/mask<\/i>][:C<\/b>]<\/big><\/font><\/p>\n

Defines a test on the existing packet or connection mark. The rule will match only if the test returns true.<\/big><\/font><\/p>\n

If you don’t want to define a test but need to specify anything in the following columns, place a “\u2212” in this field.<\/big><\/font><\/p>\n

!<\/big><\/font><\/p>\n

Inverts the test (not equal)<\/big><\/font><\/p>\n

value<\/i><\/big><\/font><\/p>\n

Value of the packet or connection mark.<\/big><\/font><\/p>\n

mask<\/i><\/big><\/font><\/p>\n

A mask to be applied to the mark before testing.<\/big><\/font><\/p>\n

:C<\/b><\/big><\/font><\/p>\n

Designates a connection mark. If omitted, the packet mark’s value is tested.<\/big><\/font><\/p>\n

IPSEC \u2212<\/b> option\u2212list<\/i> (Optional \u2212 Added in Shorewall 4.4.13 but broken until 4.5.4.1 )<\/b><\/big><\/font><\/p>\n

The option\u2212list consists of a comma\u2212separated list of options from the following list. Only packets that will be encrypted or have been decrypted via an SA that matches these options will have their source address changed.<\/big><\/font><\/p>\n

reqid=<\/b>number<\/i><\/big><\/font><\/p>\n

where number<\/i> is specified using setkey(8) using the ‘unique:number<\/i> option for the SPD level.<\/big><\/font><\/p>\n

spi=<\/b><\/big><\/font><\/p>\n

where number<\/i> is the SPI of the SA used to encrypt\/decrypt packets.<\/big><\/font><\/p>\n

proto=ah<\/b>|esp<\/b>|ipcomp<\/b><\/big><\/font><\/p>\n

IPSEC Encapsulation Protocol<\/big><\/font><\/p>\n

mss=<\/b>number<\/i><\/big><\/font><\/p>\n

sets the MSS field in TCP packets<\/big><\/font><\/p>\n

mode=transport<\/b>|tunnel<\/b><\/big><\/font><\/p>\n

IPSEC mode<\/big><\/font><\/p>\n

tunnel\u2212src=<\/b>address<\/i>[\/mask<\/i>]<\/big><\/font><\/p>\n

only available with mode=tunnel<\/big><\/font><\/p>\n

tunnel\u2212dst=<\/b>address<\/i>[\/mask<\/i>]<\/big><\/font><\/p>\n

only available with mode=tunnel<\/big><\/font><\/p>\n

strict<\/b><\/big><\/font><\/p>\n

Means that packets must match all rules.<\/big><\/font><\/p>\n

next<\/b><\/big><\/font><\/p>\n

Separates rules; can only be used with strict<\/big><\/font><\/p>\n

yes<\/b> or ipsec<\/b><\/big><\/font><\/p>\n

When used by itself, causes all traffic that will be encrypted\/encapsulated or has been decrypted\/un\u2212encapsulated to match the rule.<\/big><\/font><\/p>\n

no<\/b> or none<\/b><\/big><\/font><\/p>\n

When used by itself, causes all traffic that will not be encrypted\/encapsulated or has been decrypted\/un\u2212encapsulated to match the rule.<\/big><\/font><\/p>\n

in<\/b><\/big><\/font><\/p>\n

May only be used in the FORWARD section and must be the first or the only item the list. Indicates that matching packets have been decrypted in input.<\/big><\/font><\/p>\n

out<\/b><\/big><\/font><\/p>\n

May only be used in the FORWARD section and must be the first or the only item in the list. Indicates that matching packets will be encrypted on output.<\/big><\/font><\/p>\n

If this column is non\u2212empty and sections are not used, then:<\/big><\/font><\/p>\n

\u2022 A chain NAME appearing in the ACTION column must be a chain branched either directly or indirectly from the accipsecin<\/b> or accipsecout<\/b> chain.<\/big><\/font><\/p>\n

\u2022 The CHAIN column must contain either accipsecin<\/b> or accipsecout<\/b> or a chain branched either directly or indirectly from those chains.<\/big><\/font><\/p>\n

\u2022 These rules will NOT appear in the accounting<\/b> chain.<\/big><\/font><\/p>\n

In all of the above columns except ACTION<\/b> and CHAIN<\/b>, the values \u2212<\/b>, any<\/b> and all<\/b> may be used as wildcard’gs. Omitted trailing columns are also treated as wildcard’g.<\/big><\/font><\/p>\n

FILES <\/a> <\/h2>\n

\/etc\/shorewall\/accounting<\/big><\/font><\/p>\n

\/etc\/shorewall6\/accounting<\/big><\/font><\/p>\n

SEE ALSO <\/a> <\/h2>\n

shorewall\u2212logging(5)<\/font><\/b><\/big> [4]<\/font><\/p>\n

https:\/\/shorewall.org\/configuration_file_basics.htm#Pairs<\/font><\/big><\/b> [5]<\/font><\/p>\n

shorewall(8)<\/big><\/font><\/p>\n

NOTES <\/a> <\/h2>\n\n\n
<\/td>\n\n

1.<\/big><\/font><\/p>\n<\/td>\n

<\/td>\n\n

rules file<\/big><\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/manpages\/shorewall-rules.html<\/big><\/font><\/p>\n\n\n
<\/td>\n\n

2.<\/big><\/font><\/p>\n<\/td>\n

<\/td>\n\n

xtables-addons<\/big><\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

http:\/\/xtables-addons.sourceforge.net\/<\/big><\/font><\/p>\n\n\n
<\/td>\n\n

3.<\/big><\/font><\/p>\n<\/td>\n

<\/td>\n\n

https:\/\/shorewall.org\/Accounting.html#perIP<\/big><\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/Accounting.html#perIP<\/big><\/font><\/p>\n\n\n
<\/td>\n\n

4.<\/big><\/font><\/p>\n<\/td>\n

<\/td>\n\n

shorewall-logging(5)<\/big><\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/manpages\/shorewall-logging.htm<\/big><\/font><\/p>\n\n\n
<\/td>\n\n

5.<\/big><\/font><\/p>\n<\/td>\n

<\/td>\n\n

https:\/\/shorewall.org\/configuration_file_basics.htm#Pairs<\/big><\/font><\/p>\n<\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/configuration_file_basics.htm#Pairs<\/big><\/font><\/p>\n

\n","protected":false},"excerpt":{"rendered":"

accounting \u2212 Shorewall Accounting file <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[959],"tags":[961,1291,1356],"class_list":["post-4342","post","type-post","status-publish","format-standard","hentry","category-5-formatos-de-ficheros","tag-961","tag-man5","tag-shorewall-accounting"],"gutentor_comment":0,"_links":{"self":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/4342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/comments?post=4342"}],"version-history":[{"count":0,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/4342\/revisions"}],"wp:attachment":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/media?parent=4342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/categories?post=4342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/tags?post=4342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}