In most places where a network address may be entered, an ipset may be substituted. Set names must be prefixed by the character "+", must start with a letter and may be composed of alphanumeric characters, "-" and "_".
Whether the set is matched against the packet source or destination is determined by which column the set name appears (SOURCE or DEST). For those set types that specify a tuple, two alternative syntaxes are available:
In a SOURCE or SPORT column, the following pairs are equivalent:
In a DEST or DPORT column, the following pairs are equivalent:
Beginning with Shorewall 4.4.14, multiple source or destination matches may be specified by enclosing the set names within +[...]. The set names need not be prefixed with '+'. When such a list of sets is specified, matching packets must match all of the listed sets.
For information about set lists and exclusion, see m[blue]shorewall-exclusionm (5).
Beginning with Shorewall 4.5.16, you can increment one or more nfacct objects each time a packet matches an ipset. You do that by listing the objects separated by commas within parentheses.
In that example, when the source address of a packet matches the myset ipset, the myobject nfacct counter will be incremented.
Beginning with Shorewall 4.6.0, an ipset name (and src/dst list, if any) can be immediately be followed by a list of match options.
These additional match options are not available in m[blue]shorewall-tcfilters(5)m.
Available options are:
In the examples that follow, myset, myset1 and myset2 are ipsets and myObject is an NFacct object name.
/etc/shorewall/hosts -- Note: Multiple matches enclosed in +[...] may not be used in this file.
/etc/shorewall6/hosts -- Note: Multiple matches enclosed in +[...] may not be used in this file.
/etc/shorewall/maclist -- Note: Multiple matches enclosed in +[...] may not be used in this file.
/etc/shorewall6/maclist -- Note: Multiple matches enclosed in +[...] may not be used in this file.