---
name: "shorewall6-blacklist"
section: "5"
platform: "linux"
package: "shorewall6"
version: "4.6.4.3-1"
release: "Debian 8 (Jessie)"
platforms: ["linux"]
url: "https://new.carta.tech/shorewall6-blacklist"
---

# shorewall6-blacklist(5)

shorewall6 Blacklist file

## NAME

blacklist - shorewall6 Blacklist file

## SYNOPSIS

**/etc/shorewall6/blacklist**

## DESCRIPTION

The blacklist file is used to perform static blacklisting by source address (IP or MAC), or by application. The use of this file is deprecated in favor of **shorewall6-blrules**\[1\](5), and beginning with Shorewall 4.5.7, the blacklist file is no longer installed. Existing blacklist files can be converted to a corresponding blrules file using the **shorewall6 update -b** command.

The columns in the file are as follows (where the column name is followed by a different name in parentheses, the different name is used in the alternate specification syntax).

**ADDRESS/SUBNET** - {**-**\|**~***mac-address*\|*ip-address*\|*address-range*\|**+***ipset*}

Host address, network address, MAC address, IP address range (if your kernel and ip6tables contain iprange match support) or ipset name prefaced by "+" (if your kernel supports ipset match). Exclusion (**shorewall6-exclusion**\[2\](5)) is supported.

MAC addresses must be prefixed with "~" and use "-" as a separator.

Example: ~00-A0-C9-15-39-78

A dash ("-") in this column means that any source address will match. This is useful if you want to blacklist a particular application using entries in the PROTOCOL and PORTS columns.

**PROTOCOL** (proto) - {**-**\|*protocol-number*\|*protocol-name*}

Optional - if specified, must be a protocol number or a protocol name from [protocols(5)](/protocols/5.md).

**PORTS** (port) - {**-**\|*port-name-or-number*\[,*port-name-or-number*\]...}

May only be specified if the protocol is TCP (6), UDP (17), DCCP (33), SCTP (132) or UDPLITE (136). A comma-separated list of destination port numbers or service names from [services(5)](/services/5.md).

OPTIONS - {-\|{dst\|src\|whitelist\|audit}\[,...\]}

Optional - added in 4.4.12. If specified, indicates whether traffic *from* ADDRESS/SUBNET (**src**) or traffic *to* ADDRESS/SUBNET (**dst**) should be blacklisted. The default is **src**. If the ADDRESS/SUBNET column is empty, then this column has no effect on the generated rule.

**Note**\
 In Shorewall 4.4.12, the keywords from and to were used in place of src and dst respectively. Blacklisting was still restricted to traffic *arriving* on an interface that has the 'blacklist' option set. So to block traffic from your local network to an internet host, you had to specify **blacklist** on your internal interface in **shorewall6-interfaces**\[3\] (5).

**Note**\
 Beginning with Shorewall 4.4.13, entries are applied based on the **blacklist** setting in **shorewall6-zones**\[4\](5):

 1\. 'blacklist' in the OPTIONS or IN\_OPTIONS column. Traffic from this zone is passed against the entries in this file that have the **src** option (specified or defaulted).

 2\. 'blacklist' in the OPTIONS or OUT\_OPTIONS column. Traffic to this zone is passed against the entries in this file that have the **dst** option.

In Shorewall 4.4.20, the **whitelist** option was added. When **whitelist** is specified, packets/connections that match the entry are not matched against the remaining entries in the file.

The **audit** option was also added in 4.4.20 and causes packets matching the entry to be audited. The **audit** option may not be specified in whitelist entries and require AUDIT\_TARGET support in the kernel and ip6tables.

When a packet arrives on an interface that has the **blacklist** option specified in **shorewall6-interfaces**\[3\](5), its source IP address and MAC address is checked against this file and disposed of according to the **BLACKLIST\_DISPOSITION** and **BLACKLIST\_LOGLEVEL** variables in **shorewall6.conf**\[5\](5). If **PROTOCOL** or **PROTOCOL** and **PORTS** are supplied, only packets matching the protocol (and one of the ports if **PORTS** supplied) are blocked.

## EXAMPLE

Example 1:

To block DNS queries from address fe80::2a0:ccff:fedb:31c4:

```
        #ADDRESS/SUBNET            PROTOCOL        PORT
        fe80::2a0:ccff:fedb:31c4/  udp             53
```

Example 2:

To block some of the nuisance applications:

```
        #ADDRESS/SUBNET         PROTOCOL        PORT
        -                       udp             1024:1033,1434
        -                       tcp             57,1433,1434,2401,2745,3127,3306,3410,4899,5554,6101,8081,9898
```

## FILES

/etc/shorewall6/blacklist

## SEE ALSO

**http://www.shorewall.net/blacklisting\_support.htm**\[6\]

**http://www.shorewall.net/configuration\_file\_basics.htm#Pairs**\[7\]

[shorewall6(8)](/shorewall6/8.md), [shorewall6-accounting(5)](/shorewall6-accounting/5.md), [shorewall6-actions(5)](/shorewall6-actions/5.md), [shorewall6-hosts(5)](/shorewall6-hosts/5.md), [shorewall6-interfaces(5)](/shorewall6-interfaces/5.md), [shorewall6-maclist(5)](/shorewall6-maclist/5.md), [shorewall6-netmap(5)](/shorewall6-netmap/5.md),[shorewall6-params(5)](/shorewall6-params/5.md), [shorewall6-policy(5)](/shorewall6-policy/5.md), [shorewall6-providers(5)](/shorewall6-providers/5.md), [shorewall6-rtrules(5)](/shorewall6-rtrules/5.md), [shorewall6-routestopped(5)](/shorewall6-routestopped/5.md), [shorewall6-rules(5)](/shorewall6-rules/5.md), [shorewall6.conf(5)](/shorewall6.conf/5.md), [shorewall6-secmarks(5)](/shorewall6-secmarks/5.md), [shorewall6-tcclasses(5)](/shorewall6-tcclasses/5.md), [shorewall6-tcdevices(5)](/shorewall6-tcdevices/5.md), [shorewall6-mangle(5)](/shorewall6-mangle/5.md), [shorewall6-tos(5)](/shorewall6-tos/5.md), [shorewall6-tunnels(5)](/shorewall6-tunnels/5.md), [shorewall6-zones(5)](/shorewall6-zones/5.md)

## NOTES

- 1\.

  shorewall6-blrules

  http://www.shorewall.net/manpages6/shorewall6-blrules.html

- 2\.

  shorewall6-exclusion

  http://www.shorewall.net/manpages6/shorewall6-exclusion.html

- 3\.

  shorewall6-interfaces

  http://www.shorewall.net/manpages6/shorewall6-interfaces.html

- 4\.

  shorewall6-zones

  http://www.shorewall.net/manpages6/shorewall6-zones.html

- 5\.

  shorewall6.conf

  http://www.shorewall.net/manpages6/shorewall6.conf.html

- 6\.

  http://www.shorewall.net/blacklisting\_support.htm

  http://www.shorewall.net/blacklisting\_support.htm

- 7\.

  http://www.shorewall.net/configuration\_file\_basics.htm#Pairs

  http://www.shorewall.net/configuration\_file\_basics.htm#Pairs