SHOREWALL-IPSETS(5)

✨ SHOREWALL-IPSETS ✨

okay bestie, welcome to the SHOREWALL-IPSETS(5) page — it lives in the Configuration Files section of the manual, and it's all about how you name an ipset inside Shorewall's config files. pull up a chair, this one's actually fun 💅

---

🌸 NAME 🌸

ipsets — how you spell out the name of an ipset in Shorewall configuration files. literally that's it, that's the job 🫶

---

🎀 SYNOPSIS 🎀

+ipsetname

+ipsetname[flag,...]

+[ipsetname,...]

---

💖 DESCRIPTION 💖

heads up, bestie: in all those syntax lines up there, the square brackets ([]) are meant literally, not as meta-characters. yes really. they're part of the vibe, not a placeholder. 😭

so, in most places where you could type a network address, you can slide an ipset in instead. the rules for set names are:

• they must be prefixed with the character +
• they must start with a letter
• they may be made up of alphanumeric characters, - and _

Whether the set gets matched against the packet source or the destination is decided by which column the set name shows up in — SOURCE or DEST. (the column decides, not you. the column is the main character here 👑)

For those set types that specify a tuple, you've got two alternative syntaxes to pick from:

• [number] — this says that src or dst should be repeated number times. Example: myset[2].
• [flag,...] — where flag is src or dst. Example: myset[src,dst].

In a SOURCE or SPORT column, these two are the same thing:

• +myset[2] and +myset[src,src]

In a DEST or DPORT column, these two are the same thing:

• +myset[2] and +myset[dst,dst]

---

🦋 multiple matches (Shorewall 4.4.14+) 🦋

Starting with Shorewall 4.4.14, you can specify multiple source or destination matches by wrapping the set names inside +[...]. cute, right? and plot twist: the set names in there don't need the + prefix. when you give a list of sets like that, a matching packet has to match all of the listed sets. all of them. no skipping. 💀

want the tea on set lists and exclusion? go see shorewall-exclusion[1] (5).

---

🍓 nfacct counters (Shorewall 4.5.16+) 🍓

Starting with Shorewall 4.5.16, you can increment one or more nfacct objects every single time a packet matches an ipset. how? list the objects separated by commas, inside parentheses. obsessed.

Example:

+myset[src](myobject)

In that example, when the source address of a packet matches the myset ipset, the myobject nfacct counter gets incremented. slay ✨

---

🌈 match options (Shorewall 4.6.0+) 🌈

Starting with Shorewall 4.6.0, an ipset name (and the src/dst list, if there is one) can be immediately followed by a list of match options.

Important: these extra match options are not available in shorewall-tcfilters(5)[2]. nope. not there. don't try it 🙈

Available options are:

• nomatch — if the set type supports the nomatch flag, then the matching gets reversed: a match with an element flagged with nomatch returns true, while a match with a plain element returns false. this one requires the 'Ipset Match nomatch' capability in your kernel and ip[6]tables.
• no-update-counters — the packet and byte counters of the matching element in the set won't be updated. by default, the packet and byte counters are updated. this option and the ones that follow require the 'Ipset Match counters' capability in your kernel and ip[6]tables.
• no-update-subcounters — the packet and byte counters of the matching element in the member set of a list type of set won't be updated. default: the packet and byte counters are updated.
• packets=value — if the packet matches an element in the set, match only if the packet counter of the element matches the given value too.
• packets<value — if the packet matches an element in the set, match only if the packet counter of the element is less than the given value as well.
• packets>value — if the packet matches an element in the set, match only if the packet counter of the element is greater than the given value as well.
• packets!=value — if the packet matches an element in the set, match only if the packet counter of the element does not match the given value too.
• bytes=value — if the packet matches an element in the set, match only if the byte counter of the element matches the given value too.
• bytes<value — if the packet matches an element in the set, match only if the byte counter of the element is less than the given value as well.
• bytes>value — if the packet matches an element in the set, match only if the byte counter of the element is greater than the given value as well.
• bytes<>value — if the packet matches an element in the set, match only if the byte counter of the element does not match the given value too.

---

🔥 EXAMPLES 🔥

in all the examples below, myset, myset1 and myset2 are ipsets, and myObject is an NFacct object name. iykyk 💜

+myset

+myset[src]

+myset[2]

+[myset1,myset2[dst]]

+myset[src](myObject)

+myset[src,nomatch,packets>100]

+myset[nomatch,no-update-counters](myObject)

---

👑 FILES 👑

• /etc/shorewall/accounting
• /etc/shorewall6/accounting
• /etc/shorewall/blrules
• /etc/shorewall6/blrules
• /etc/shorewall/hosts — Note: multiple matches enclosed in +[...] may not be used in this file.
• /etc/shorewall6/hosts — Note: multiple matches enclosed in +[...] may not be used in this file.
• /etc/shorewall/maclist — Note: multiple matches enclosed in +[...] may not be used in this file.
• /etc/shorewall6/maclist — Note: multiple matches enclosed in +[...] may not be used in this file.
• /etc/shorewall/rules
• /etc/shorewall6/rules
• /etc/shorewall/secmarks
• /etc/shorewall6/secmarks
• /etc/shorewall/mangle
• /etc/shorewall6/mangle
• /etc/shorewall/snat
• /etc/shorewall6/snat

---

🌟 SEE ALSO 🌟

• shorewall(8)

---

📌 NOTES 📌

1. shorewall-exclusion https://shorewall.org/manpages/shorewall-exclusion.html
2. shorewall-tcfilters(5) https://shorewall.org/manpages/shorewall-tcfilters.html

---

okay that's the whole page, bestie, you ate it 🫶 this one came out of the Configuration Files section of the manual, dated 09/24/2020, and it goes by SHOREWALL-IPSETS(5). go configure something iconic 💖✨