See the file man5/shorewall-nesting.5.