#
# Shorewall version 2.4 - Routes File
#
# /etc/shorewall/routes
#
#	Entries in this file cause packets to be routed in non-standard
#	ways.
#
#			       I M P O R T A N T ! ! ! !
#
#	In order to use entries in this file, your kernel and iptables must
#	have ROUTE target support (see the output of "shorewall show
#	capabilities").
#
#	This facility is *EXPERIMENTAL* -- the Netfilter team have no intention
#	of ever submitting the ROUTE target patch to kernel.org.
#
#	To omit any column, enter "-" in that column.
#
# Columns are:
#
#
#	SOURCE		Source of the packet. May be any of the following:
#
#			- A host or network address
#			- A network interface name.
#			- The name of an ipset prefaced with "+"
#			- $FW (for packets originating on the firewall)
#			- A MAC address in Shorewall format
#			- A range of IP addresses (assuming that your
#			  kernel and iptables support range match)
#			- A network interface name followed by ":"
#			  and an address or address range.
#
#	DEST		Destination of the packet. May be any of the
#			following:
#
#			- A host or network address
#			- A network interface name (determined from
#			  routing table(s))
#			- The name of an ipset prefaced with "+"
#			- A network interface name followed by ":"
#			  and an address or address range.
#
#	PROTO		Protocol - Must be "tcp", "udp", "icmp", "ipp2p",
#			a number, or "all". "ipp2p" requires ipp2p match
#			support in your kernel and iptables.
#
#	PORT(S)		Destination Ports. A comma-separated list of Port
#			names (from /etc/services), port numbers or port
#			ranges; if the protocol is "icmp", this column is
#			interpreted as the destination icmp-type(s).
#
#			Port ranges are allowed in a list only if your
#			kernel and iptables support Extended Multi-port
#			match (see the output of
#			"shorewall show capabilities").
#
#			If the protocol is ipp2p, this column is interpreted
#			as an ipp2p option without the leading "--"
#			(example "bit" for bit-torrent). If no PORT is given,
#			 "ipp2p" is assumed.
#
#	SOURCE PORT(S)	Source port(s). If omitted, any source port is
#			acceptable.
#
#			Specified as a comma-separated list of port names, port
#			numbers or port ranges.
#
#			Port ranges are allowed in a list only if your
#			kernel and iptables support Extended Multi-port
#			match (see the output of
#			"shorewall show capabilities").
#
#	TEST		Defines a test on the existing packet or connection
#			mark.
#			The rule will match only if the test returns true.
#			Tests have the format [!]<value>[/<mask>][:C]
#
#			Where:
#
#				!	Inverts the test (not equal)
#				<value> Value of the packet or connection mark.
#				<mask>	A mask to be applied to the mark before
#					testing
#				:C	Designates a connection mark. If
#					omitted, the packet mark's value is
#					tested.
#
#	INTERFACE	The interface that the packet is to be routed out of.
#			If you specify "-" here, then you must enter the IP
#			address of a gateway in the GATEWAY column.
#
#	GATEWAY		The gateway that the packet is to be forewarded
#			through.
#
# See http://shorewall.net/Shorewall_and_Routing.html for additional
# information.
#
#######################################################################################
#SOURCE		DEST		PROTO	PORT(S)	SOURCE	TEST	INTERFACE	GATEWAY
#						PORT(S)
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
