SHOREWALL-TCFILTERS(5)

💖 SHOREWALL-TCFILTERS 💖 — the tcfilters situation

okay bestie, sit down, hydrate, because we're talking about shorewall-tcfilters — that's the Shorewall u32/basic classifier rules file, straight out of the Configuration Files manual. this is where you tell Shorewall which packets get sorted into which traffic-shaping buckets. it's giving traffic cop energy. 👮♀️✨

---

🌈 SYNOPSIS 🌈

/etc/shorewall[6]/tcfilters

---

🦋 DESCRIPTION 🦋

so like. entries in this file make packets get classified for traffic shaping. that's the whole gig. 🎀

starting with Shorewall 4.4.15, this file can hold entries for both IPv4 and IPv6 at the same time. by default every rule applies to IPv4 only, but you can change that by dropping in a line like one of these:

• IPV4 — the entries after this apply to IPv4.
• IPV6 — the entries after this apply to IPv6
• ALL — the entries after this apply to both IPv4 and IPv6. each entry gets processed twice: once for IPv4, once for IPv6.

---

the columns, bestie, in order (and if a column name has a different name in parentheses, that other name is what you use in the alternate specification syntax — iykyk):

• CLASS - interface:class — the name or number of an interface that's defined in shorewall-tcdevices[1](5), followed by a class number defined for that interface in shorewall-tcclasses[2](5).
• SOURCE - {-|address|+ipset} — where the packet came from. can be a host or network address. DNS names are not allowed, sorry babe. starting with Shorewall 4.6.0, you can use an ipset name (prefixed with +) if your kernel and ip6tables have the Basic Ematch capability and you set BASIC_FILTERS=Yes in shorewall.conf (5)[3]. the ipset name can optionally be followed by a number, or a comma separated list of src and/or dst enclosed in square brackets ([...]). see shorewall-ipsets(5)[4] for the deets.
• DEST - {-|address|+ipset} — where the packet is going. can be a host or network address. DNS names are not allowed here either. starting with Shorewall 4.6.0, an ipset name (prefixed with +) works if your kernel and ip6tables have the Basic Ematch capability and you set BASIC_FILTERS=Yes in shorewall.conf (5)[3]. the ipset name may optionally be followed by a number or a comma separated list of src and/or dst in square brackets ([...]). see shorewall-ipsets(5)[4] for details.

you can also exclude certain hosts from a set that's already defined using an exclusion — peep shorewall-exclusion[5](5).

• PROTO - {-|{protocol-number|protocol-name|all}[,...]} — the protocol. starting with Shorewall 4.5.12, this column accepts a comma-separated list of protocols. slay.
• DPORT - [-|port-name-or-number] — optional destination ports. a port name (from services(5)) or a port number. if the protocol is icmp, this column is interpreted as the destination icmp-type(s) instead. 👀

this column used to be labelled DEST PORT(S).

• SPORT - [-|port-name-or-number] — optional source port.

this column used to be labelled SOURCE PORT(S).

• TOS (Optional) - [-|tos] — specifies the value of the TOS field. the tos value can be any of these:
  • tos-minimize-delay
  • tos-maximize-throughput
  • tos-maximize-reliability
  • tos-minimize-cost
  • tos-normal-service
  • hex-number
  • hex-number/hex-number

the hex-numbers must be exactly two digits (e.g., 0x04)x.

• LENGTH - [-|number] — optional. must be a power of 2 between 32 and 8192 inclusive. packets whose total length is strictly less than the number you give will match the rule.
• PRIORITY - [-|priority] — added in Shorewall 4.5.8. specifies the rule priority. the priority value must be > 0 and <= 65535.

when a priority isn't given:

• for Shorewall versions prior to 4.5.8 — all filters have priority 10.
• for Shorewall 4.5.8 and later — for each device, the compiler keeps a high-water priority with an initial value of 0. when a filter has no priority, the high-water priority gets incremented by 1 and assigned to that filter. when a priority greater than the high-water priority is entered in this column, the high-water priority gets set to that specified priority. and an attempt to assign a priority value greater than 65535 (explicitly or implicitly) raises an error. 🚨

the default priority values used by other Shorewall-generated filters are:

• Classify by packet mark — ( class priority << 8 ) | 20.
• Ingress policing — 10
• Simple TC ACK packets — 1
• Complex TC ACK packets — ( class priority << 8 ) | 10.
• Classify by TOS — ( class priority << 8 ) | 15.
• Class with 'occurs' — 65535

---

🌸 EXAMPLE 🌸

IPv4 Example 1: put all 'ping' traffic on interface 1 into class 10. note that ALL cannot be used here because IPv4 ICMP and IPv6 ICMP are two different protocols.

#CLASS    SOURCE    DEST         PROTO   DPORT

IPV4

1:10      0.0.0.0/0 0.0.0.0/0    icmp    echo-request
1:10      0.0.0.0/0 0.0.0.0/0    icmp    echo-reply

IPV6

1:10      ::/0      ::/0         icmp6   echo-request
1:10      ::/0      ::/0         icmp6   echo-reply

IPv4 Example 2: add two filters with priority 10 (Shorewall 4.5.8 or later).

#CLASS    SOURCE    DEST         PROTO   DPORT           PRIORITY

IPV4

1:10      0.0.0.0/0 0.0.0.0/0    icmp    echo-request    10
1:10      0.0.0.0/0 0.0.0.0/0    icmp    echo-reply      10

IPv6 Example 1: add two filters with priority 10 (Shorewall 4.5.8 or later).

#CLASS    SOURCE    DEST         PROTO   DPORT           PRIORITY

IPV6

1:10      ::/0      ::/0         icmp    echo-request    10
1:10      ::/0      ::/0         icmp    echo-reply      10

---

🎀 FILES 🎀

• /etc/shorewall/tcfilters
• /etc/shorewall6/tcfilters

---

👑 SEE ALSO 👑

• https://shorewall.org/traffic_shaping.htm[6]
• https://shorewall.org/MultiISP.html[7]
• https://shorewall.org/PacketMarking.html[8]
• https://shorewall.org/configuration_file_basics.htm#Pairs[9]
• shorewall(8)

---

✨ NOTES ✨

1. shorewall-tcdevices https://shorewall.org/manpages/shorewall-tcdevices.html
2. shorewall-tcclasses https://shorewall.org/manpages/shorewall-tcclasses.html
3. shorewall.conf (5) https://shorewall.org/manpages/shorewall.conf.html
4. shorewall-ipsets(5) https://shorewall.org/manpages/shorewall-ipsets.html
5. shorewall-exclusion https://shorewall.org/manpages/shorewall-exclusion.html
6. https://shorewall.org/traffic_shaping.htm https://shorewall.org/traffic_shaping.htm
7. https://shorewall.org/MultiISP.html https://shorewall.org/MultiISP.html
8. https://shorewall.org/PacketMarking.html https://shorewall.org/PacketMarking.html
9. https://shorewall.org/configuration_file_basics.htm#Pairs https://shorewall.org/configuration_file_basics.htm#Pairs

---

and that's the whole page, bestie 💅 this came out of the Configuration Files manual, dated 09/24/2020, and it's filed under SHOREWALL-TCFILTERS(5). go forth and classify. periodt. 🦋