See the file man5/shorewall-secmarks.5.