<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN" "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd"> <refentry> <refmeta> <refentrytitle>shorewall-rtrules</refentrytitle> <manvolnum>5</manvolnum> <refmiscinfo>Configuration Files</refmiscinfo> </refmeta> <refnamediv> <refname>rtrules</refname> <refpurpose>Shorewall Routing Rules file</refpurpose> </refnamediv> <refsynopsisdiv> <cmdsynopsis> <command>/etc/shorewall/rtrules</command> </cmdsynopsis> </refsynopsisdiv> <refsect1> <title>Description</title> <para>Entries in this file cause traffic to be routed to one of the providers listed in <ulink url="/manpages/shorewall-providers.html">shorewall-providers</ulink>(5).</para> <para>The columns in the file are as follows.</para> <variablelist> <varlistentry> <term><emphasis role="bold">SOURCE</emphasis> (Optional) - {<emphasis role="bold">-</emphasis>|[&]<emphasis>interface</emphasis>|<emphasis>address</emphasis>|<emphasis>interface</emphasis><firstterm>:</firstterm><emphasis>address</emphasis>}</term> <listitem> <para>An ip <emphasis>address</emphasis> (network or host) that matches the source IP address in a packet. May also be specified as an <emphasis>interface</emphasis> name optionally followed by ":" and an address. If the device <emphasis role="bold">lo</emphasis> is specified, the packet must originate from the firewall itself.</para> <para>Beginning with Shorewall 4.5.0, you may specify &<replaceable>interface</replaceable> in this column to indicate that the source is the primary IP address of the named interface.</para> <para>Beginning with Shorewall 4.6.8, you may specify a comma-separated list of addresses in this column.</para> </listitem> </varlistentry> <varlistentry> <term><emphasis role="bold">DEST</emphasis> (Optional) - {<emphasis role="bold">-</emphasis>|<emphasis>address</emphasis>}</term> <listitem> <para>An ip address (network or host) that matches the destination IP address in a packet.</para> <para>If you choose to omit either <emphasis role="bold">SOURCE</emphasis> or <emphasis role="bold">DEST</emphasis>, place "-" in that column. Note that you may not omit both <emphasis role="bold">SOURCE</emphasis> and <emphasis role="bold">DEST</emphasis>.</para> <para>Beginning with Shorewall 4.6.8, you may specify a comma-separated list of addresses in this column.</para> </listitem> </varlistentry> <varlistentry> <term><emphasis role="bold">PROVIDER</emphasis> - {<emphasis>provider-name</emphasis>|<emphasis>provider-number</emphasis>|<emphasis role="bold">main</emphasis>}</term> <listitem> <para>The provider to route the traffic through. May be expressed either as the provider name or the provider number. May also be <emphasis role="bold">main</emphasis> or 254 for the main routing table. This can be used in combination with VPN tunnels, see example 2 below.</para> </listitem> </varlistentry> <varlistentry> <term><emphasis role="bold">PRIORITY</emphasis> - <emphasis>priority</emphasis></term> <listitem> <para>The rule's numeric <emphasis>priority</emphasis> which determines the order in which the rules are processed. Rules with equal priority are applied in the order in which they appear in the file.</para> <variablelist> <varlistentry> <term>1000-1999</term> <listitem> <para>Before Shorewall-generated 'MARK' rules</para> </listitem> </varlistentry> <varlistentry> <term>11000-11999</term> <listitem> <para>After 'MARK' rules but before Shorewall-generated rules for ISP interfaces.</para> </listitem> </varlistentry> <varlistentry> <term>26000-26999</term> <listitem> <para>After ISP interface rules but before 'default' rule.</para> </listitem> </varlistentry> </variablelist> </listitem> </varlistentry> <varlistentry> <term><emphasis role="bold">MARK - {-|<replaceable>mark</replaceable>[/<replaceable>mask</replaceable>]}</emphasis></term> <listitem> <para>Optional -- added in Shorewall 4.4.25. For this rule to be applied to a packet, the packet's mark value must match the <replaceable>mark</replaceable> when logically anded with the <replaceable>mask</replaceable>. If a <replaceable>mask</replaceable> is not supplied, Shorewall supplies a suitable provider mask.</para> </listitem> </varlistentry> </variablelist> </refsect1> <refsect1> <title>Examples</title> <variablelist> <varlistentry> <term>Example 1:</term> <listitem> <para>You want all traffic coming in on eth1 to be routed to the ISP1 provider.</para> <programlisting> #SOURCE DEST PROVIDER PRIORITY MASK eth1 - ISP1 1000 </programlisting> </listitem> </varlistentry> <varlistentry> <term>Example 2:</term> <listitem> <para>You use OpenVPN (routed setup /tunX) in combination with multiple providers. In this case you have to set up a rule to ensure that the OpenVPN traffic is routed back through the tunX interface(s) rather than through any of the providers. 10.8.0.0/24 is the subnet chosen in your OpenVPN configuration (server 10.8.0.0 255.255.255.0).</para> <programlisting> #SOURCE DEST PROVIDER PRIORITY MASK - 10.8.0.0/24 main 1000 </programlisting> </listitem> </varlistentry> </variablelist> </refsect1> <refsect1> <title>FILES</title> <para>/etc/shorewall/rtrules</para> </refsect1> <refsect1> <title>See ALSO</title> <para><ulink url="/MultiISP.html">http://www.shorewall.net/MultiISP.html</ulink></para> <para><ulink url="/configuration_file_basics.htm#Pairs">http://www.shorewall.net/configuration_file_basics.htm#Pairs</ulink></para> <para>shorewall(8), shorewall-accounting(5), shorewall-actions(5), shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5), shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-mangle(5), shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para> </refsect1> </refentry>