Let's say I have a policy file, such as
fw net ACCEPT
net fw DROP
trusted fw ACCEPT
trusted net ACCEPT
untrusted fw DROP*
untrusted net ACCEPT
all all REJECT
What I'd like to do is send all the traffic from the untrusted network that is destined to the firewall (marked with a *) to a packet capture utility like tcpdump or tshark for analysis.
It seems like the QUEUE or NFQUEUE actions might do the trick, or I could use actions... But I've not played with either of those components of shorewall, so I'm not sure the way forward with them.