See the file man5/shorewall-exclusion.5.