The name or number of an interface defined in shorewall-tcdevices(5) followed by a class number defined for that interface in shorewall-tcclasses(5).

Source of the packet. May be a host or network address. DNS names are not allowed.

Destination of the packet. Comma separated list of IP addresses and/or subnets. If your kernel and iptables include iprange match support, IP address ranges are also allowed. List elements may also consist of an interface name followed by ":" and an address (e.g., eth1:192.168.1.0/24). If the MARK column specificies a classification of the form major:minor then this column may also contain an interface name.

You may exclude certain hosts from the set already defined through use of an exclusion (see shorewall-exclusion(5)).

Protocol.

Destination Ports. A Port name (from services(5)) or a port number; if the protocol is icmp, this column is interpreted as the destination icmp-type(s).

Source port.

Specifies the value of the TOS field. The tos value can be any of the following:

The hex-numbers must be exactly two digits (e.g., 0x04)x.

Must be a power of 2 between 32 and 8192 inclusive. Packets with a total length that is strictly less than the specified number will match the rule.

Place all ICMP echo traffic on interface 1 in class 10.

       #CLASS    SOURCE    DEST         PROTO   DEST 
       #                                        PORT
       1:10      0.0.0.0/0 0.0.0.0/0    icmp    echo-request
       1:10      0.0.0.0/0 0.0.0.0/0    icmp    echo-reply