forked from extern/shorewall_code
585 lines
21 KiB
XML
585 lines
21 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
<refentry>
|
|
<refmeta>
|
|
<refentrytitle>shorewall6-accounting</refentrytitle>
|
|
|
|
<manvolnum>5</manvolnum>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>accounting</refname>
|
|
|
|
<refpurpose>Shorewall6 Accounting file</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<cmdsynopsis>
|
|
<command>/etc/shorewall6/accounting</command>
|
|
</cmdsynopsis>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para>Accounting rules exist simply to count packets and bytes in
|
|
categories that you define in this file. You may display these rules and
|
|
their packet and byte counters using the <command>shorewall6 show
|
|
accounting</command> command.</para>
|
|
|
|
<para>The columns in the file are as follows.</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis role="bold">ACTION</emphasis> - {<emphasis
|
|
role="bold">COUNT</emphasis>|<emphasis
|
|
role="bold">DONE</emphasis>|<emphasis>chain</emphasis>[:<emphasis
|
|
role="bold">{COUNT|JUMP}</emphasis>]|COMMENT
|
|
<replaceable>comment</replaceable>}</term>
|
|
|
|
<listitem>
|
|
<para>What to do when a matching packet is found.</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis role="bold">COUNT</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Simply count the match and continue with the next
|
|
rule</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">DONE</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Count the match and don't attempt to match any other
|
|
accounting rules in the chain specified in the <emphasis
|
|
role="bold">CHAIN</emphasis> column.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis>chain</emphasis>[<emphasis
|
|
role="bold">:</emphasis><emphasis
|
|
role="bold">COUNT</emphasis>]</term>
|
|
|
|
<listitem>
|
|
<para>Where <emphasis>chain</emphasis> is the name of a chain;
|
|
shorewall6 will create the chain automatically if it doesn't
|
|
already exist. Causes a jump to that chain to be added to the
|
|
chain specified in the CHAIN column. If <emphasis
|
|
role="bold">:COUNT</emphasis> is included, a counting rule
|
|
matching this entry will be added to
|
|
<emphasis>chain</emphasis></para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis>chain</emphasis>:JUMP</term>
|
|
|
|
<listitem>
|
|
<para>Like the previous option without the <emphasis
|
|
role="bold">:COUNT</emphasis> part.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>COMMENT</term>
|
|
|
|
<listitem>
|
|
<para>The remainder of the line is treated as a comment which
|
|
is attached to subsequent rules until another COMMENT line is
|
|
found or until the end of the file is reached. To stop adding
|
|
comments to rules, use a line with only the word
|
|
COMMENT.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">CHAIN</emphasis> - {<emphasis
|
|
role="bold">-</emphasis>|<emphasis>chain</emphasis>}</term>
|
|
|
|
<listitem>
|
|
<para>The name of a <emphasis>chain</emphasis>. If specified as
|
|
<emphasis role="bold">-</emphasis> the <emphasis
|
|
role="bold">accounting</emphasis> chain is assumed. This is the
|
|
chain where the accounting rule is added. The
|
|
<emphasis>chain</emphasis> will be created if it doesn't already
|
|
exist.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">SOURCE</emphasis> - {<emphasis
|
|
role="bold">-</emphasis>|<emphasis
|
|
role="bold">any</emphasis>|<emphasis
|
|
role="bold">all</emphasis>|<emphasis>interface</emphasis>|<emphasis>interface</emphasis><emphasis
|
|
role="bold">:<option>[</option></emphasis><emphasis>address</emphasis><option>]</option>|<emphasis>address</emphasis>}</term>
|
|
|
|
<listitem>
|
|
<para>Packet Source.</para>
|
|
|
|
<para>The name of an <replaceable>interface</replaceable>, an
|
|
<replaceable>address</replaceable> (host or net) or an
|
|
<replaceable>interface</replaceable> name followed by ":" and a host
|
|
or net <replaceable>address</replaceable>.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">DESTINATION</emphasis> - {<emphasis
|
|
role="bold">-</emphasis>|<emphasis
|
|
role="bold">any</emphasis>|<emphasis
|
|
role="bold">all</emphasis>|<emphasis>interface</emphasis>|<emphasis>interface</emphasis><option>:[</option><emphasis>address</emphasis><option>]</option>|<emphasis>address</emphasis>}</term>
|
|
|
|
<listitem>
|
|
<para>Packet Destination.</para>
|
|
|
|
<para>Format same as <emphasis role="bold">SOURCE</emphasis>
|
|
column.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">PROTOCOL</emphasis> - {<emphasis
|
|
role="bold">-</emphasis>|<emphasis
|
|
role="bold">any</emphasis>|<emphasis
|
|
role="bold">all</emphasis>|<emphasis>protocol-name</emphasis>|<emphasis>protocol-number</emphasis>|<emphasis
|
|
role="bold">ipp2p</emphasis>[<emphasis
|
|
role="bold">:</emphasis>{<emphasis
|
|
role="bold">udp</emphasis>|<emphasis
|
|
role="bold">all</emphasis>}]}</term>
|
|
|
|
<listitem>
|
|
<para>A <emphasis>protocol-name</emphasis> (from protocols(5)), a
|
|
<emphasis>protocol-number</emphasis>, <emphasis
|
|
role="bold">ipp2p</emphasis>, <emphasis
|
|
role="bold">ipp2p:udp</emphasis> or <emphasis
|
|
role="bold">ipp2p:all</emphasis></para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">DEST PORT(S)</emphasis> - {<emphasis
|
|
role="bold">-</emphasis>|<emphasis
|
|
role="bold">any</emphasis>|<emphasis
|
|
role="bold">all</emphasis>|<emphasis>ipp2p-option</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
|
|
|
|
<listitem>
|
|
<para>Destination Port number. Service name from services(5) or
|
|
<emphasis>port number</emphasis>. May only be specified if the
|
|
protocol is TCP (6), UDP (17), DCCP (33), SCTP (132) or UDPLITE
|
|
(136).</para>
|
|
|
|
<para>You may place a comma-separated list of port names or numbers
|
|
in this column if your kernel and ip6tables include multiport match
|
|
support.</para>
|
|
|
|
<para>If the PROTOCOL is <emphasis role="bold">ipp2p</emphasis> then
|
|
this column must contain an <emphasis>ipp2p-option</emphasis>
|
|
("ip6tables -m ipp2p --help") without the leading "--". If no option
|
|
is given in this column, <emphasis role="bold">ipp2p</emphasis> is
|
|
assumed.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">SOURCE PORT(S)</emphasis> - {<emphasis
|
|
role="bold">-</emphasis>|<emphasis
|
|
role="bold">any</emphasis>|<emphasis
|
|
role="bold">all</emphasis>|<emphasis>port-name-or-number</emphasis>[,<emphasis>port-name-or-number</emphasis>]...}</term>
|
|
|
|
<listitem>
|
|
<para>Service name from services(5) or <emphasis>port
|
|
number</emphasis>. May only be specified if the protocol is TCP (6),
|
|
UDP (17), DCCP (33), SCTP (132) or UDPLITE (136).</para>
|
|
|
|
<para>You may place a comma-separated list of port numbers in this
|
|
column if your kernel and ip6tables include multiport match
|
|
support.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">USER/GROUP</emphasis> - [<emphasis
|
|
role="bold">!</emphasis>][<emphasis>user-name-or-number</emphasis>][<emphasis
|
|
role="bold">:</emphasis><emphasis>group-name-or-number</emphasis>][<emphasis
|
|
role="bold">+</emphasis><emphasis>program-name</emphasis>]</term>
|
|
|
|
<listitem>
|
|
<para>This column may only be non-empty if the <emphasis
|
|
role="bold">CHAIN</emphasis> is <emphasis
|
|
role="bold">OUTPUT</emphasis>.</para>
|
|
|
|
<para>When this column is non-empty, the rule applies only if the
|
|
program generating the output is running under the effective
|
|
<emphasis>user</emphasis> and/or <emphasis>group</emphasis>
|
|
specified (or is NOT running under that id if "!" is given).</para>
|
|
|
|
<para>Examples:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>joe</term>
|
|
|
|
<listitem>
|
|
<para>program must be run by joe</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>:kids</term>
|
|
|
|
<listitem>
|
|
<para>program must be run by a member of the 'kids'
|
|
group</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>!:kids</term>
|
|
|
|
<listitem>
|
|
<para>program must not be run by a member of the 'kids'
|
|
group</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>+upnpd</term>
|
|
|
|
<listitem>
|
|
<para>#program named upnpd</para>
|
|
|
|
<important>
|
|
<para>The ability to specify a program name was removed from
|
|
Netfilter in kernel version 2.6.14.</para>
|
|
</important>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">MARK</emphasis> - [<emphasis
|
|
role="bold">!</emphasis>]<emphasis>value</emphasis>[/<emphasis>mask</emphasis>][<emphasis
|
|
role="bold">:C</emphasis>]</term>
|
|
|
|
<listitem>
|
|
<para>Defines a test on the existing packet or connection mark. The
|
|
rule will match only if the test returns true.</para>
|
|
|
|
<para>If you don't want to define a test but need to specify
|
|
anything in the following columns, place a "-" in this field.</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>!</term>
|
|
|
|
<listitem>
|
|
<para>Inverts the test (not equal)</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis>value</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Value of the packet or connection mark.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis>mask</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>A mask to be applied to the mark before testing.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">:C</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Designates a connection mark. If omitted, the packet
|
|
mark's value is tested.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">IPSEC - <emphasis>option-list</emphasis>
|
|
(Optional - Added in Shorewall 4.4.13 )</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>The option-list consists of a comma-separated list of options
|
|
from the following list. Only packets that will be encrypted or have
|
|
been de-crypted via an SA that matches these options will have their
|
|
source address changed.</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">reqid=</emphasis><emphasis>number</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>where <emphasis>number</emphasis> is specified using
|
|
setkey(8) using the 'unique:<emphasis>number</emphasis> option
|
|
for the SPD level.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">spi=</emphasis><number></term>
|
|
|
|
<listitem>
|
|
<para>where <emphasis>number</emphasis> is the SPI of the SA
|
|
used to encrypt/decrypt packets.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">proto=</emphasis><emphasis
|
|
role="bold">ah</emphasis>|<emphasis
|
|
role="bold">esp</emphasis>|<emphasis
|
|
role="bold">ipcomp</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>IPSEC Encapsulation Protocol</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">mss=</emphasis><emphasis>number</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>sets the MSS field in TCP packets</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">mode=</emphasis><emphasis
|
|
role="bold">transport</emphasis>|<emphasis
|
|
role="bold">tunnel</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>IPSEC mode</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">tunnel-src=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
|
|
|
|
<listitem>
|
|
<para>only available with mode=tunnel</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis
|
|
role="bold">tunnel-dst=</emphasis><emphasis>address</emphasis>[/<emphasis>mask</emphasis>]</term>
|
|
|
|
<listitem>
|
|
<para>only available with mode=tunnel</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">strict</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Means that packets must match all rules.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">next</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Separates rules; can only be used with strict</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">yes</emphasis> or <emphasis
|
|
role="bold">ipsec</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>When used by itself, causes all traffic that will be
|
|
encrypted/encapsulated or has been decrypted/un-encapsulted to
|
|
match the rule.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">no</emphasis> or <emphasis
|
|
role="bold">none</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>When used by itself, causes all traffic that will not be
|
|
encrypted/encapsulated or has been decrypted/un-encapsulted to
|
|
match the rule.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
|
|
<para>If this column is non-empty, then:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>A chain NAME may appearing in the ACTION column must be a
|
|
chain branched either directly or indirectly from the <emphasis
|
|
role="bold">accountin</emphasis> or <emphasis
|
|
role="bold">accountout</emphasis> chain.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>The CHAIN column must contain either <emphasis
|
|
role="bold">accountin</emphasis> or <emphasis
|
|
role="bold">accountout</emphasis> or a chain branched either
|
|
directly or indirectly from those chains.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>These rules will NOT appear in the <emphasis
|
|
role="bold">accounting</emphasis> chain.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">HEADERS -
|
|
[!][any:|exactly:]</emphasis><replaceable>header-list
|
|
</replaceable>(Optional - Added in Shorewall 4.4.15)</term>
|
|
|
|
<listitem>
|
|
<para>The <replaceable>header-list</replaceable> consists of a
|
|
comma-separated list of headers from the following list.</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis role="bold">auth</emphasis>, <emphasis
|
|
role="bold">ah</emphasis>, or <emphasis
|
|
role="bold">51</emphasis></term>
|
|
|
|
<listitem>
|
|
<para><firstterm>Authentication Headers</firstterm> extension
|
|
header.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">esp</emphasis>, or <emphasis
|
|
role="bold">50</emphasis></term>
|
|
|
|
<listitem>
|
|
<para><firstterm>Encrypted Security Payload</firstterm>
|
|
extension header.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">hop</emphasis>, <emphasis
|
|
role="bold">hop-by-hop</emphasis> or <emphasis
|
|
role="bold">0</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Hop-by-hop options extension header.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">route</emphasis>, <emphasis
|
|
role="bold">ipv6-route</emphasis> or <emphasis
|
|
role="bold">41</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>IPv6 Route extension header.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">frag</emphasis>, <emphasis
|
|
role="bold">ipv6-frag</emphasis> or <emphasis
|
|
role="bold">44</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>IPv6 fragmentation extension header.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">none</emphasis>, <emphasis
|
|
role="bold">ipv6-nonxt</emphasis> or <emphasis
|
|
role="bold">59</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>No next header</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">proto</emphasis>, <emphasis
|
|
role="bold">protocol</emphasis> or <emphasis
|
|
role="bold">255</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Any protocol header.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
|
|
<para>If <emphasis role="bold">any:</emphasis> is specified, the
|
|
rule will match if any of the listed headers are present. If
|
|
<emphasis role="bold">exactly:</emphasis> is specified, the will
|
|
match packets that exactly include all specified headers. If neither
|
|
is given, <emphasis role="bold">any:</emphasis> is assumed.</para>
|
|
|
|
<para>If <emphasis role="bold">!</emphasis> is entered, the rule
|
|
will match those packets which would not be matched when <emphasis
|
|
role="bold">!</emphasis> is omitted.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
|
|
<para>In all of the above columns except <emphasis
|
|
role="bold">ACTION</emphasis> and <emphasis role="bold">CHAIN</emphasis>,
|
|
the values <emphasis role="bold">-</emphasis>, <emphasis
|
|
role="bold">any</emphasis> and <emphasis role="bold">all</emphasis> may be
|
|
used as wildcards. Omitted trailing columns are also treated as
|
|
wildcards.</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>FILES</title>
|
|
|
|
<para>/etc/shorewall6/accounting</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>See ALSO</title>
|
|
|
|
<para><ulink
|
|
url="http://shorewall.net/Accounting.html">http://shorewall.net/Accounting.html
|
|
</ulink></para>
|
|
|
|
<para>shorewall6(8), shorewall6-actions(5), shorewall6-blacklist(5),
|
|
shorewall6-hosts(5), shorewall6-interfaces(5), shorewall6-maclist(5),
|
|
shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5),
|
|
shorewall6-route_rules(5), shorewall6-routestopped(5),
|
|
shorewall6-rules(5), shorewall6.conf(5), shorewall6-secmarks(5),
|
|
shorewall6-tcclasses(5), shorewall6-tcdevices(5), shorewall6-tcrules(5),
|
|
shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)</para>
|
|
</refsect1>
|
|
</refentry>
|