shorewall-secmarks 5 secmarks Shorewall file /etc/shorewall/secmarks The secmarks file is used to associate an SELinux context with packets. The columns in the file are as follows. SECMARK - {SAVE|RESTORE|context} SAVE If an SELinux context is associated with the packet, the context is saved in the connection. RESTORE If an SELinux context is not currently associated with the packet, then the saved context (if any) is associated with the packet. context An SELinux context. CHAIN - {P|I|F|O|T} P - PREROUTING I - INPUT F - FORWARD O - OUTPUT T - POSTROUTING SOURCE - {-interface|[interface:]address-or-range[,address-or-range]...}[exclusion] May be: An interface name - matches traffic entering the firewall on the specified interface. May not be used in classify rules or in rules using the T in the CHAIN column. A comma-separated list of host or network IP addresses or MAC addresses. An interface name followed by a colon (":") followed by a comma-separated list of host or network IP addresses or MAC addresses. MAC addresses must be prefixed with "~" and use "-" as a separator. Example: ~00-A0-C9-15-39-78 You may exclude certain hosts from the set already defined through use of an exclusion (see shorewall-exclusion(5)). DEST - {-|{interface|[interface:]address-or-range[,address-or-range]...}[exclusion] May be: An interface name. May not be used in the PREROUTING or INPUT chains. The interface name may be optionally followed by a colon (":") and an IP address list. A comma-separated list of host or network IP addresses. The list may include ip address ranges if your kernel and iptables include iprange support. You may exclude certain hosts from the set already defined through use of an exclusion (see shorewall-exclusion(5)). PROTO - {-|tcp:syn|ipp2p|ipp2p:udp|ipp2p:all|protocol-number|protocol-name|all} Protocol - ipp2p requires ipp2p match support in your kernel and iptables. PORT(S) (Optional) - [-|port-name-number-or-range[,port-name-number-or-range]...] Destination Ports. A comma-separated list of Port names (from services(5)), port numbers or port ranges; if the protocol is icmp, this column is interpreted as the destination icmp-type(s). ICMP types may be specified as a numeric type, a numberic type and code separated by a slash (e.g., 3/4), or a typename. See http://www.shorewall.net/configuration_file_basics.htm#ICMP. If the protocol is ipp2p, this column is interpreted as an ipp2p option without the leading "--" (example bit for bit-torrent). If no PORT is given, ipp2p is assumed. This column is ignored if PROTOCOL = all but must be entered if any of the following field is supplied. In that case, it is suggested that this field contain "-" SOURCE PORT(S) (Optional) - [-|port-name-number-or-range[,port-name-number-or-range]...] Source port(s). If omitted, any source port is acceptable. Specified as a comma-separated list of port names, port numbers or port ranges. MARK - [!]value[/mask][:C] Defines a test on the existing packet or connection mark. The rule will match only if the test returns true. If you don't want to define a test but need to specify anything in the following columns, place a "-" in this field. ! Inverts the test (not equal) value Value of the packet or connection mark. mask A mask to be applied to the mark before testing. :C Designates a connection mark. If omitted, the packet mark's value is tested. /etc/shorewall/secmarks shorewall(8), shorewall-accounting(5), shorewall-actions(5), shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5), shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)