See the file man5/shorewall-conntrack.5.