See the file man5/shorewall-mangle.5.