---
name: "shorewall6-blrules"
section: "5"
platform: "linux"
package: "shorewall6"
version: "5.2.8-6"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/shorewall-blrules"
---

# shorewall6-blrules(5)

shorewall Blacklist file

Part of [shorewall-blrules(5)](/shorewall-blrules/5.md).

## NAME

blrules - shorewall Blacklist file

## SYNOPSIS

**/etc/shorewall\[6\]/blrules**

## DESCRIPTION

This file is used to perform blacklisting and whitelisting.

Rules in this file are applied depending on the setting of BLACKLIST in **shorewall.conf**\[1\](5).

The format of rules in this file is the same as the format of rules in **shorewall-rules (5)**\[2\]. The difference in the two files lies in the ACTION (first) column.

**ACTION- {ACCEPT\|BLACKLIST\|blacklog\|CONTINUE\|DROP\|A\_DROP\|REJECT\|A\_REJECT\|WHITELIST\|LOG\|QUEUE\|NFQUEUE\[(***queuenumber***)\]\|\[?\]COMMENT\|***action***\|***macro***\[(***target***)\]}\[:{***log-level***\|none}\[!\]\[:***tag***\]\]**

Specifies the action to be taken if the packet matches the rule. Must be one of the following.

**BLACKLIST**

Added in Shorewall 4.5.3. This is actually a macro that expands as follows:

• If BLACKLIST\_LOGLEVEL is specified in **shorewall.conf**\[1\](5), then the macro expands to **blacklog**.

• Otherwise it expands to the action specified for BLACKLIST\_DISPOSITION in **shorewall.conf**\[1\](5).

**blacklog**

May only be used if BLACKLIST\_LOGLEVEL is specified in **shorewall.conf**\[1\](5). Logs, audits (if specified) and applies the BLACKLIST\_DISPOSITION specified in **shorewall.conf**\[1\] (5).

**ACCEPT\|CONTINUE\|WHITELIST**

Exempt the packet from the remaining rules in this file.

**DROP**

Ignore the packet.

A\_DROP

Audited version of DROP. Requires AUDIT\_TARGET support in the kernel and ip6tables.

**REJECT**

disallow the packet and return an icmp-unreachable or an RST packet.

A\_REJECT

Audited versions of REJECT. Require AUDIT\_TARGET support in the kernel and ip6tables.

**LOG**

Simply log the packet and continue with the next rule.

**QUEUE**

Queue the packet to a user-space application such as ftwall (http://p2pwall.sf.net). The application may reinsert the packet for further processing.

**NFLOG**\[(*nflog-parameters*)\]

queues matching packets to a back end logging daemon via a netlink socket then continues to the next rule. See **[shorewall-logging(5)](/shorewall-logging/5.md)**\[3\].

**NFQUEUE**

Queues the packet to a user-space application using the nfnetlink\_queue mechanism. If a *queuenumber* is not specified, queue zero (0) is assumed.

**?COMMENT**

The rest of the line will be attached as a comment to the Netfilter rule(s) generated by the following entries. The comment will appear delimited by "/\* ... \*/" in the output of "shorewall show \<chain\>". To stop the comment from being attached to further rules, simply include ?COMMENT on a line by itself.

*action*

The name of an *action* declared in **shorewall-actions**\[4\](5) or in /usr/share/shorewall/actions.std.

*macro*

The name of a macro defined in a file named macro.*macro*. If the macro accepts an action parameter (Look at the macro source to see if it has PARAM in the TARGET column) then the *macro* name is followed by the parenthesized *target* (**ACCEPT**, **DROP**, **REJECT**, ...) to be substituted for the parameter.

Example: FTP(ACCEPT).

The **ACTION** may optionally be followed by ":" and a syslog log level (e.g, REJECT:info or Web(ACCEPT):debug). This causes the packet to be logged at the specified level.

If the **ACTION** names an *action* declared in **shorewall-actions**\[4\](5) or in /usr/share/shorewall/actions.std then:

• If the log level is followed by "!' then all rules in the action are logged at the log level.

• If the log level is not followed by "!" then only those rules in the action that do not specify logging are logged at the specified level.

• The special log level **none!** suppresses logging by the action.

You may also specify **NFLOG** (must be in upper case) as a log level.This will log to the NFLOG target for routing to a separate log through use of ulogd (**shorewall-logging.htm**\[3\]).

Actions specifying logging may be followed by a log tag (a string of alphanumeric characters) which is appended to the string generated by the LOGPREFIX (in **shorewall.conf**\[1\](5)).

For the remaining columns, see **shorewall-rules (5)**\[2\].

## EXAMPLES

IPv4 Example 1:

Drop 6to4 packets from the net.

```
DROP          net:192.88.99.1            all
```

IPv4 Example 2:

Don't subject packets from 70.90.191.120/29 to the remaining rules in the file.

```
WHITELIST     net:70.90.191.120/29       all
```

IPv6 Example 1:

Drop Teredo packets from the net.

```
DROP          net:[2001::/32]            all
```

IPv6 Example 2:

Don't subject packets from 2001:DB8::/64 to the remaining rules in the file.

```
WHITELIST     net:[2001:DB8::/64]        all
```

## FILES

/etc/shorewall/blrules

/etc/shorewall6/blrules

## SEE ALSO

**https://shorewall.org/blacklisting\_support.htm**\[5\]

**https://shorewall.org/configuration\_file\_basics.htm#Pairs**\[6\]

[shorewall(8)](/shorewall/8.md)

## NOTES

- 1\.

  shorewall.conf

  https://shorewall.org/manpages/shorewall.conf.html

- 2\.

  shorewall-rules (5)

  https://shorewall.org/manpages/shorewall-rules.html

- 3\.

  [shorewall-logging(5)](/shorewall-logging/5.md)

  https://shorewall.org/manpages/shorewall-logging.html

- 4\.

  shorewall-actions

  https://shorewall.org/manpages/shorewall-actions.html

- 5\.

  https://shorewall.org/blacklisting\_support.htm

  https://shorewall.org/blacklisting\_support.htm

- 6\.

  https://shorewall.org/configuration\_file\_basics.htm#Pairs

  https://shorewall.org/configuration\_file\_basics.htm#Pairs