diff --git a/Shorewall/manpages/shorewall.conf.xml b/Shorewall/manpages/shorewall.conf.xml
index cbcc91b82..0a1325b31 100644
--- a/Shorewall/manpages/shorewall.conf.xml
+++ b/Shorewall/manpages/shorewall.conf.xml
@@ -2470,7 +2470,7 @@ INLINE - - - ; -j REJECT
SAVE_IPSETS={Yes|No|setlist}
+ role="bold">No|ipv4|setlist}
Re-enabled in Shorewall 4.4.6. If SAVE_IPSETS=Yes, then the
@@ -2482,7 +2482,8 @@ INLINE - - - ; -j REJECT
Beginning with Shorewall 4.6.4, you can restrict the set of
ipsets saved by specifying a setlist (a comma-separated list of ipv4
- ipset names).
+ ipset names). You may also restrict the saved sets to just the ipv4
+ ones by specifying ipv4.
diff --git a/docs/ipsets.xml b/docs/ipsets.xml
index aef381c23..bc15bbd62 100644
--- a/docs/ipsets.xml
+++ b/docs/ipsets.xml
@@ -154,6 +154,11 @@ ACCEPT net:+sshok $FW tcp 22
firewall is first stopped.
+
+ Beginning with Shorewall 4.6.4, you can save selective ipsets by
+ setting SAVE_IPSETS to a comma-separated list of ipset names. You can also
+ restrict the group of sets saved to ipv4 sets by setting
+ SAVE_IPSETS=ipv4.
@@ -161,17 +166,21 @@ ACCEPT net:+sshok $FW tcp 22
Ipset support in Shorewall6 was added in Shorewall 4.4.21.
- Unlike iptables, which has separate configurations for IPv4 and
- IPv6, ipset has a single configuration that handles both. This means the
- SAVE_IPSETS=Yes in shorewall.conf or shorewall6.conf won't work correctly
- because . To work around this issue, Shorewall-init is now capable
- restoring ipset contents during 'start' and saving them during 'stop'. To
- direct Shorewall-init to save/restore ipset contents, set the SAVE_IPSETS
- option in /etc/sysconfig/shorewall-init (/etc/default/shorewall-init on
- Debian and derivatives). The value of the option is a file name where the
- contents of the ipsets will be save to and restored from. Shorewall-init
- will create any necessary directories during the first 'save' operation.
- If you configure Shorewall-init to save/restore ipsets, be sure to set
+ Beginning with Shorewall 4.6.4, SAVE_IPSETS is available in shorewall6-conf(5). When set
+ to Yes, the ipv6 ipsets will be set. You can also save selective ipsets by
+ setting SAVE_IPSETS to a comma-separated list of ipset names.
+
+ Prior to Shorewall 4.6.4, SAVE_IPSETS=Yes in shorewall.conf won't
+ work correctly because it saves both IPv4 and IPv6 ipsets. To work around
+ this issue, Shorewall-init is capable restoring ipset contents during
+ 'start' and saving them during 'stop'. To direct Shorewall-init to
+ save/restore ipset contents, set the SAVE_IPSETS option in
+ /etc/sysconfig/shorewall-init (/etc/default/shorewall-init on Debian and
+ derivatives). The value of the option is a file name where the contents of
+ the ipsets will be save to and restored from. Shorewall-init will create
+ any necessary directories during the first 'save' operation. If you
+ configure Shorewall-init to save/restore ipsets, be sure to set
SAVE_IPSETS=No in shorewall.conf and shorewall6.conf.