{"id":4446,"date":"2022-12-20T17:49:19","date_gmt":"2022-12-20T20:49:19","guid":{"rendered":"http:\/\/lode.uno\/linux-man\/index.php\/2022\/12\/20\/shorewalltcfilters-man5\/"},"modified":"2022-12-20T17:49:19","modified_gmt":"2022-12-20T20:49:19","slug":"shorewalltcfilters-man5","status":"publish","type":"post","link":"https:\/\/lode.uno\/linux-man\/2022\/12\/20\/shorewalltcfilters-man5\/","title":{"rendered":"SHOREWALL−TCFILTERS (man5)"},"content":{"rendered":"

SHOREWALL\u2212TCFILTERS<\/h1>\n

NAME<\/a>
SYNOPSIS<\/a>
DESCRIPTION<\/a>
EXAMPLE<\/a>
FILES<\/a>
SEE ALSO<\/a>
NOTES<\/a> <\/p>\n

\n

NAME <\/a> <\/h2>\n

tcfilters \u2212 Shorewall u32\/basic classifier rules file<\/p>\n

SYNOPSIS <\/a> <\/h2>\n\n\n
<\/td>\n\n

\/etc\/shorewall[6]\/tcfilters<\/b><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

DESCRIPTION <\/a> <\/h2>\n

Entries in this file cause packets to be classified for traffic shaping.<\/p>\n

Beginning with Shorewall 4.4.15, the file may contain entries for both IPv4 and IPv6. By default, all rules apply to IPv4 but that can be changed by inserting a line as follows:<\/p>\n

IPV4<\/p>\n

Following entries apply to IPv4.<\/p>\n

IPV6<\/p>\n

Following entries apply to IPv6<\/p>\n

ALL<\/p>\n

Following entries apply to both IPv4 and IPv6. Each entry is processed twice; once for IPv4 and once for IPv6.<\/p>\n

The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in the alternate specification syntax).<\/p>\n

CLASS<\/b> \u2212 interface<\/i>:<\/b>class<\/i><\/p>\n

The name or number of an interface defined in shorewall\u2212tcdevices<\/font><\/b> [1]<\/font><\/small> (5) followed by a class<\/i> number defined for that interface in<\/font> shorewall\u2212tcclasses<\/font><\/b> [2]<\/font><\/small> (5).<\/font><\/p>\n

SOURCE<\/b> \u2212 {\u2212<\/b>|address<\/i>|+ipset<\/i>}<\/font><\/p>\n

Source of the packet. May be a host or network address<\/i>. DNS names are not allowed. Beginning with Shorewall 4.6.0, an ipset name (prefixed with ‘+’) may be used if your kernel and ip6tables have the Basic Ematch capability and you set BASIC_FILTERS=Yes in<\/font> shorewall.conf (5)<\/font><\/b> [3]<\/font><\/small> . The ipset name may optionally be followed by a number or a comma separated list of src and\/or dst enclosed in square brackets ([…]). See<\/font> shorewall\u2212ipsets(5)<\/font><\/b> [4]<\/font><\/small> for details.<\/font><\/p>\n

DEST<\/b> \u2212 {\u2212<\/b>|address<\/i>|+ipset<\/i>}<\/font><\/p>\n

Destination of the packet. May be a host or network address<\/i>. DNS names are not allowed. Beginning with Shorewall 4.6.0, an ipset name (prefixed with ‘+’) may be used if your kernel and ip6tables have the Basic Ematch capability and you set BASIC_FILTERS=Yes in<\/font> shorewall.conf (5)<\/font><\/b> [3]<\/font><\/small> . The ipset name may optionally be followed by a number or a comma separated list of src and\/or dst enclosed in square brackets ([…]). See<\/font> shorewall\u2212ipsets(5)<\/font><\/b> [4]<\/font><\/small> for details.<\/font><\/p>\n

You may exclude certain hosts from the set already defined through use of an exclusion<\/i> (see<\/font> shorewall\u2212exclusion<\/font><\/b> [5]<\/font><\/small> (5)).<\/font><\/p>\n

PROTO<\/b> \u2212 {\u2212<\/b>|{protocol\u2212number<\/i>|protocol\u2212name<\/i>|all}[,…]}<\/b><\/font><\/p>\n

Protocol.<\/font><\/p>\n

Beginning with Shorewall 4.5.12, this column can accept a comma\u2212separated list of protocols.<\/font><\/p>\n

DPORT<\/b> \u2212 [\u2212<\/b>|port\u2212name\u2212or\u2212number<\/i>]<\/font><\/p>\n

Optional destination Ports. A Port name (from services(5)) or a port number<\/i>; if the protocol is icmp<\/b>, this column is interpreted as the destination icmp\u2212type(s).<\/font><\/p>\n

This column was previously labelled DEST PORT(S).<\/font><\/p>\n

SPORT<\/b> \u2212 [\u2212<\/b>|port\u2212name\u2212or\u2212number<\/i>]<\/font><\/p>\n

Optional source port.<\/font><\/p>\n

This column was previously labelled SOURCE PORT(S).<\/font><\/p>\n

TOS<\/b> (Optional) \u2212 [\u2212<\/b>|tos<\/i>]<\/font><\/p>\n

Specifies the value of the TOS field. The tos<\/i> value can be any of the following:<\/font><\/p>\n

\u2022 tos\u2212minimize\u2212delay<\/b><\/font><\/p>\n

\u2022 tos\u2212maximize\u2212throughput<\/b><\/font><\/p>\n

\u2022 tos\u2212maximize\u2212reliability<\/b><\/font><\/p>\n

\u2022 tos\u2212minimize\u2212cost<\/b><\/font><\/p>\n

\u2022 tos\u2212normal\u2212service<\/b><\/font><\/p>\n

\u2022 hex\u2212number<\/i><\/font><\/p>\n

\u2022 hex\u2212number<\/i>\/hex\u2212number<\/i><\/font><\/p>\n

The hex\u2212number<\/i>s must be exactly two digits (e.g., 0x04)x.<\/font><\/p>\n

LENGTH<\/b> \u2212 [\u2212<\/b>|number<\/i>]<\/font><\/p>\n

Optional \u2212 Must be a power of 2 between 32 and 8192 inclusive. Packets with a total length that is strictly less than the specified number<\/i> will match the rule.<\/font><\/p>\n

PRIORITY<\/b> \u2212 [\u2212<\/b>|priority<\/i>]<\/font><\/p>\n

Added in Shorewall 4.5.8. Specifies the rule priority<\/i>. The priority<\/i> value must be > 0 and <= 65535.<\/font><\/p>\n

When a priority<\/i> is not given:<\/font><\/p>\n

\u2022 For Shorewall versions prior to 4.5.8 \u2212 all filters have priority 10.<\/font><\/p>\n

\u2022 For Shorewall 4.5.8 and later \u2212 for each device, the compiler maintains a high\u2212water priority with an initial value of 0. When a filter has no priority<\/i>, the high\u2212water priority is incremented by 1 and assigned to the filter. When a priority<\/i> greater than the high\u2212water priority is entered in this column, the high\u2212water priority is set to the specified priority<\/i>. An attempt to assign a priority value greater than 65535 (explicitly or implicitly) raises an error.<\/font><\/p>\n

The default priority values used by other Shorewall\u2212generated filters are as follows:<\/font><\/p>\n

\u2022 Classify by packet mark \u2212 ( class priority<\/i> << 8 ) | 20.<\/font><\/p>\n

\u2022 Ingress policing \u2212 10<\/font><\/p>\n

\u2022 Simple TC ACK packets \u2212 1<\/font><\/p>\n

\u2022 Complex TC ACK packets \u2212 ( class priority<\/i> << 8 ) | 10.<\/font><\/p>\n

\u2022 Classify by TOS \u2212 ( class priority<\/i> << 8 ) | 15.<\/font><\/p>\n

\u2022 Class with ‘occurs’ \u2212 65535<\/font><\/p>\n

EXAMPLE <\/a> <\/h2>\n

IPv4 Example 1:<\/font><\/p>\n

Place all ‘ping’ traffic on interface 1 in class 10. Note that ALL cannot be used because IPv4 ICMP and IPv6 ICMP are two different protocols.<\/font><\/p>\n

#CLASS SOURCE DEST PROTO DPORT<\/font><\/p>\n

IPV4<\/font><\/p>\n

1:10 0.0.0.0\/0 0.0.0.0\/0 icmp echo\u2212request
1:10 0.0.0.0\/0 0.0.0.0\/0 icmp echo\u2212reply<\/font><\/p>\n

IPV6<\/font><\/p>\n

1:10 ::\/0 ::\/0 icmp6 echo\u2212request
1:10 ::\/0 ::\/0 icmp6 echo\u2212reply<\/font><\/p>\n

IPv4 Example 2:<\/font><\/p>\n

Add two filters with priority 10 (Shorewall 4.5.8 or later).<\/font><\/p>\n

#CLASS SOURCE DEST PROTO DPORT PRIORITY<\/font><\/p>\n

IPV4<\/font><\/p>\n

1:10 0.0.0.0\/0 0.0.0.0\/0 icmp echo\u2212request 10
1:10 0.0.0.0\/0 0.0.0.0\/0 icmp echo\u2212reply 10<\/font><\/p>\n

IPv6 Example 1:<\/font><\/p>\n

Add two filters with priority 10 (Shorewall 4.5.8 or later).<\/font><\/p>\n

#CLASS SOURCE DEST PROTO DPORT PRIORITY<\/font><\/p>\n

IPV6<\/font><\/p>\n

1:10 ::\/0 ::\/0 icmp echo\u2212request 10
1:10 ::\/0 ::\/0 icmp echo\u2212reply 10<\/font><\/p>\n

FILES <\/a> <\/h2>\n

\/etc\/shorewall\/tcfilters<\/font><\/p>\n

\/etc\/shorewall6\/tcfilters<\/font><\/p>\n

SEE ALSO <\/a> <\/h2>\n

https:\/\/shorewall.org\/traffic_shaping.htm<\/font><\/b> [6]<\/font><\/small><\/p>\n

https:\/\/shorewall.org\/MultiISP.html<\/font><\/b> [7]<\/font><\/small><\/p>\n

https:\/\/shorewall.org\/PacketMarking.html<\/font><\/b> [8]<\/font><\/small><\/p>\n

https:\/\/shorewall.org\/configuration_file_basics.htm#Pairs<\/font><\/b> [9]<\/font><\/small><\/p>\n

shorewall(8)<\/font><\/p>\n

NOTES <\/a> <\/h2>\n\n\n
<\/td>\n\n

1.<\/font><\/p>\n<\/td>\n

<\/td>\n\n

shorewall-tcdevices<\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/manpages\/shorewall-tcdevices.html<\/font><\/p>\n\n\n
<\/td>\n\n

2.<\/font><\/p>\n<\/td>\n

<\/td>\n\n

shorewall-tcclasses<\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/manpages\/shorewall-tcclasses.html<\/font><\/p>\n\n\n
<\/td>\n\n

3.<\/font><\/p>\n<\/td>\n

<\/td>\n\n

shorewall.conf (5)<\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/manpages\/shorewall.conf.html<\/font><\/p>\n\n\n
<\/td>\n\n

4.<\/font><\/p>\n<\/td>\n

<\/td>\n\n

shorewall-ipsets(5)<\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/manpages\/shorewall-ipsets.html<\/font><\/p>\n\n\n
<\/td>\n\n

5.<\/font><\/p>\n<\/td>\n

<\/td>\n\n

shorewall-exclusion<\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/manpages\/shorewall-exclusion.html<\/font><\/p>\n\n\n
<\/td>\n\n

6.<\/font><\/p>\n<\/td>\n

<\/td>\n\n

https:\/\/shorewall.org\/traffic_shaping.htm<\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/traffic_shaping.htm<\/font><\/p>\n\n\n
<\/td>\n\n

7.<\/font><\/p>\n<\/td>\n

<\/td>\n\n

https:\/\/shorewall.org\/MultiISP.html<\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/MultiISP.html<\/font><\/p>\n\n\n
<\/td>\n\n

8.<\/font><\/p>\n<\/td>\n

<\/td>\n\n

https:\/\/shorewall.org\/PacketMarking.html<\/font><\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/PacketMarking.html<\/font><\/p>\n\n\n
<\/td>\n\n

9.<\/font><\/p>\n<\/td>\n

<\/td>\n\n

https:\/\/shorewall.org\/configuration_file_basics.htm#Pairs<\/font><\/p>\n<\/td>\n<\/tr>\n<\/table>\n

https:\/\/shorewall.org\/configuration_file_basics.htm#Pairs<\/font><\/p>\n

\n","protected":false},"excerpt":{"rendered":"

tcfilters \u2212 Shorewall u32\/basic classifier rules file <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[959],"tags":[961,1291,1431],"class_list":["post-4446","post","type-post","status-publish","format-standard","hentry","category-5-formatos-de-ficheros","tag-961","tag-man5","tag-shorewall-tcfilters"],"gutentor_comment":0,"_links":{"self":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/4446","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/comments?post=4446"}],"version-history":[{"count":0,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/4446\/revisions"}],"wp:attachment":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/media?parent=4446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/categories?post=4446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/tags?post=4446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}