<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>shorewall-exclusion</title><link rel="stylesheet" href="html.css" type="text/css" /><meta name="generator" content="DocBook XSL Stylesheets V1.73.2" /></head><body><div class="refentry" lang="en" xml:lang="en"><a id="id257171"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>exclusion — Exclude a set of hosts from a definition in a shorewall
configuration file.</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p> <code class="option">!</code><em class="replaceable"><code>address-or-range</code></em>[,<em class="replaceable"><code>address-or-range</code></em>]... </p></div></div><div class="refsect1" lang="en" xml:lang="en"><a id="id257217"></a><h2>Description</h2><p>Exclusion is used when you wish to exclude one or more addresses
from a definition. An exclaimation point is followed by a comma-separated
list of addresses. The addresses may be single host addresses (e.g.,
192.168.1.4) or they may be network addresses in CIDR format (e.g.,
192.168.1.0/24). If your kernel and iptables include iprange support, you
may also specify ranges of ip addresses of the form
<span class="emphasis"><em>lowaddress</em></span>-<span class="emphasis"><em>highaddress</em></span></p><p>No embedded whitespace is allowed.</p><p>Exclusion can appear after a list of addresses and/or address
ranges. In that case, the final list of address is formed by taking the
first list and then removing the addresses defined in the
exclusion.</p></div><div class="refsect1" lang="en" xml:lang="en"><a id="id257244"></a><h2>Examples</h2><div class="variablelist"><dl><dt><span class="term">Example 1 - All IPv4 addresses except 192.168.3.4</span></dt><dd><p>!192.168.3.4</p></dd><dt><span class="term">Example 2 - All IPv4 addresses except the network 192.168.1.0/24
and the host 10.2.3.4</span></dt><dd><p>!192.168.1.0/24,10.1.3.4</p></dd><dt><span class="term">Example 3 - All IPv4 addresses except the range
192.168.1.3-192.168.1.12 and the network 10.0.0.0/8</span></dt><dd><p>!192.168.1.3-192.168.1.12,10.0.0.0/8</p></dd><dt><span class="term">Example 4 - The network 192.168.1.0/24 except hosts 192.168.1.3
and 192.168.1.9</span></dt><dd><p>192.168.1.0/24!192.168.1.3,192.168.1.9</p></dd></dl></div></div><div class="refsect1" lang="en" xml:lang="en"><a id="id257307"></a><h2>FILES</h2><p>/etc/shorewall/hosts</p><p>/etc/shorewall/masq</p><p>/etc/shorewall/rules</p><p>/etc/shorewall/tcrules</p></div><div class="refsect1" lang="en" xml:lang="en"><a id="id257327"></a><h2>See ALSO</h2><p>shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)</p></div></div></body></html>
