SHOREWALL-RTRULES(5)

💅 rtrules — the Shorewall Routing Rules file 💅

okay bestie, welcome to rtrules, aka section 5 of the manual, aka Configuration Files. this is the glow-up guide to telling Shorewall where your traffic should, like, actually go. 🦋

---

✨ SYNOPSIS ✨

/etc/shorewall[6]/rtrules

---

🌸 DESCRIPTION 🌸

so here's the tea: entries in this file make your traffic get routed to one of the providers listed in shorewall-providers[1](5). that's it. that's the whole job. 💖

the columns in the file are as follows, bestie — one at a time, no skipping:

🎀 SOURCE (Optional) — {-|[&]interface|address|interface:address}

an ip address (network or host) that matches the source IP address in a packet. you can also write it as an interface name, optionally followed by ":" and an address. and if you specify the device lo, then the packet has to originate from the firewall itself. very main character of it.

beginning with Shorewall 4.5.0, you may specify &interface in this column to say that the source is the primary IP address of the named interface.

beginning with Shorewall 4.6.8, you may specify a comma-separated list of addresses in this column. 💅

🌈 DEST (Optional) — {-|address}

an ip address (network or host) that matches the destination IP address in a packet.

if you choose to omit either SOURCE or DEST, place - in that column. note that you may not omit both SOURCE and DEST. nope. not allowed. periodt.

beginning with Shorewall 4.6.8, you may specify a comma-separated list of addresses in this column too. ✨

👑 PROVIDER — {provider-name|provider-number|main}

the provider to route the traffic through. may be expressed either as the provider name or the provider number. may also be main or 254 for the main routing table. this can be used in combination with VPN tunnels, see example 2 below. iykyk.

🔥 PRIORITY — priority[!]

the rule's numeric priority which determines the order in which the rules are processed. rules with equal priority are applied in the order in which they appear in the file.

• 1000-1999 — before Shorewall-generated 'MARK' rules
• 11000-11999 — after 'MARK' rules but before Shorewall-generated rules for ISP interfaces.
• 26000-26999 — after ISP interface rules but before 'default' rule.

beginning with Shorewall 5.0.2, the priority may be followed optionally by an exclamation mark ("!"). this causes the rule to remain in place if the interface is disabled. 🫶

Caution 😭 be careful when using rules of the same PRIORITY as some unexpected behavior can occur when multiple rules have the same SOURCE. for example, in the following rules, the second rule overwrites the first unless the priority in the second is changed to 19001 or higher:

10.10.0.0/24    192.168.5.6 provider1 19000
10.10.0.0/24    -           provider2 19000

🧚 MARK — {-|mark[/mask]}

optional — added in Shorewall 4.4.25. for this rule to be applied to a packet, the packet's mark value must match the mark when logically anded with the mask. if a mask is not supplied, Shorewall supplies a suitable provider mask. slay.

---

⭐ EXAMPLES ⭐

Example 1: 🍓

you want all traffic coming in on eth1 to be routed to the ISP1 provider.

            #SOURCE                 DEST            PROVIDER        PRIORITY      MASK
            eth1                    -               ISP1            1000

IPv4 Example 2: 💜

you use OpenVPN (routed setup /tunX) in combination with multiple providers. in this case you have to set up a rule to ensure that the OpenVPN traffic is routed back through the tunX interface(s) rather than through any of the providers. 10.8.0.0/24 is the subnet chosen in your OpenVPN configuration (server 10.8.0.0 255.255.255.0).

             #SOURCE                 DEST            PROVIDER        PRIORITY     MASK
             -                       10.8.0.0/24     main            1000

---

🎀 FILES 🎀

• /etc/shorewall/rtrules
• /etc/shorewall6/rtrules

---

💖 SEE ALSO 💖

• https://shorewall.org/MultiISP.html[2]
• https://shorewall.org/configuration_file_basics.htm#Pairs[3]
• shorewall(8)

---

🦋 NOTES 🦋

1. shorewall-providers https://shorewall.org/manpages/shorewall-providers.html
2. https://shorewall.org/MultiISP.html https://shorewall.org/MultiISP.html
3. https://shorewall.org/configuration_file_basics.htm#Pairs https://shorewall.org/configuration_file_basics.htm#Pairs

---

and that's the whole page, bestie!! Configuration Files, dated 09/24/2020, from the SHOREWALL-RTRULES(5) era — go route something iconic 💅✨👑