forked from extern/shorewall_code
b8f1af1881
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@4891 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
244 lines
8.1 KiB
XML
244 lines
8.1 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<refentry>
|
|
<refmeta>
|
|
<refentrytitle>shorewall-accounting</refentrytitle>
|
|
|
|
<manvolnum>5</manvolnum>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>accounting</refname>
|
|
|
|
<refpurpose>Shorewall Accounting file</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<cmdsynopsis>
|
|
<command>/etc/shorewall/accounting</command>
|
|
</cmdsynopsis>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para>Accounting rules exist simply to count packets and bytes in
|
|
categories that you define in this file. You may display these rules and
|
|
their packet and byte counters using the <command>shorewall show
|
|
accounting</command> command. </para>
|
|
|
|
<para>The columns in the file are as follows.</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis role="bold">ACTION</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>What to do when a matching packet is found.</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis role="bold">COUNT</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Simply count the match and continue with the next
|
|
rule</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">DONE</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Count the match and don't attempt to match any other
|
|
accounting rules in the chain specified in the <emphasis
|
|
role="bold">CHAIN</emphasis> column.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis>chain</emphasis>:<emphasis
|
|
role="bold">COUNT</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Where <emphasis>chain</emphasis> is the name of a chain.
|
|
Shorewall will create the chain automatically if it doesn't
|
|
already exist. Causes a jump to that chain. If <emphasis
|
|
role="bold">:COUNT</emphasis> is included, a counting rule
|
|
matching this record will be added to
|
|
<emphasis>chain</emphasis></para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">CHAIN</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>The name of a chain. If specified as <emphasis
|
|
role="bold">-</emphasis> the <emphasis
|
|
role="bold">accounting</emphasis> chain is assumed. This is the
|
|
chain where the accounting rule is added. The chain will be created
|
|
if it doesn't already exist.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">SOURCE</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Packet Source.</para>
|
|
|
|
<para>The name of an interface, an address (host or net) or an
|
|
interface name followed by ":" and a host or net address.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">DESTINATION</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Packet Destination.</para>
|
|
|
|
<para>Format same as <emphasis role="bold">SOURCE</emphasis>
|
|
column.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">PROTOCOL</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>A protocol name (from protocols(5)), a protocol number,
|
|
<emphasis role="bold">ipp2p</emphasis>, <emphasis
|
|
role="bold">ipp2p:udp</emphasis> or <emphasis
|
|
role="bold">ipp2p:all</emphasis></para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">DEST PORT(S)</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Destination Port number. If the PROTOCOL is <emphasis
|
|
role="bold">ipp2p</emphasis> then this column must contain an ipp2p
|
|
option ("iptables -m ipp2p --help") without the leading "--". If no
|
|
option is given in this column, "ipp2p" is assumed.</para>
|
|
|
|
<para>Service name from services(5) or <emphasis>port
|
|
number</emphasis>. May only be specified if the protocol is
|
|
<emphasis role="bold">tcp</emphasis> or <emphasis
|
|
role="bold">udp</emphasis> (6 or 17).</para>
|
|
|
|
<para>You may place a comma-separated list of port numbers in this
|
|
column if your kernel and iptables include multiport match
|
|
support.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">SOURCE PORT(S)</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>Source Port Service name from services(5) or <emphasis>port
|
|
number</emphasis>. May only be specified if the protocol is TCP or
|
|
UDP (6 or 17).</para>
|
|
|
|
<para>You may place a comma-separated list of port numbers in this
|
|
column if your kernel and iptables include multiport match
|
|
support.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">USER/GROUP</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>This column may only be non-empty if the <emphasis
|
|
role="bold">SOURCE</emphasis> is the firewall itself.</para>
|
|
|
|
<para>The column may contain:</para>
|
|
|
|
<para>[!][<emphasis>user name or number</emphasis>][:<emphasis>group
|
|
name or number</emphasis>][+<emphasis>program
|
|
name</emphasis>]</para>
|
|
|
|
<para>When this column is non-empty, the rule applies only if the
|
|
program generating the output is running under the effective
|
|
<emphasis>user</emphasis> and/or <emphasis>group</emphasis>
|
|
specified (or is NOT running under that id if "!" is given).</para>
|
|
|
|
<para>Examples:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>joe</term>
|
|
|
|
<listitem>
|
|
<para>program must be run by joe</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>:kids</term>
|
|
|
|
<listitem>
|
|
<para>program must be run by a member of the 'kids'
|
|
group</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>!:kids</term>
|
|
|
|
<listitem>
|
|
<para>program must not be run by a member of the 'kids'
|
|
group</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>+upnpd</term>
|
|
|
|
<listitem>
|
|
<para>#program named upnpd</para>
|
|
|
|
<important>
|
|
<para>The ability to specify a program name was removed from
|
|
Netfilter in kernel version 2.6.14.</para>
|
|
</important>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
|
|
<para>In all of the above columns except <emphasis
|
|
role="bold">ACTION</emphasis> and <emphasis role="bold">CHAIN</emphasis>,
|
|
the values <emphasis role="bold">-</emphasis>, <emphasis
|
|
role="bold">any</emphasis> and <emphasis role="bold">all</emphasis> may be
|
|
used as wildcards. Omitted trailing columns are also treated as
|
|
wildcards.</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>FILES</title>
|
|
|
|
<para>/etc/shorewall/accounting</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>See ALSO</title>
|
|
|
|
<para>shorewall(8), shorewall-actions(5), shorewall-blacklist(5),
|
|
shorewall-hosts(5), shorewall-interfaces(5), shorewall-ipsec(5),
|
|
shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5),
|
|
shorewall-netmap(5), shorewall-params(5), shorewall-policy(5),
|
|
shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_routes(5),
|
|
shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5),
|
|
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
|
|
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)</para>
|
|
</refsect1>
|
|
</refentry> |