See the file man5/shorewall-tcfilters.5.