##################################################################################### #ACTION CHAIN SOURCE DESTINATION PROTO DEST SOURCE USER/ # PORT(S) PORT(S) GROUP input:COUNT - +accounting[src] - output:COUNT - 0.0.0.0/0 +accounting[dst] DONE input DONE output #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE root@OpenWrt:/etc/shorewall# ipset -L -n Name: accounting Type: nethash References: 4 Default binding: Header: hashsize: 1024 probes: 4 resize: 50 Members: 192.168.0.0/24 Bindings: root@OpenWrt:/etc/shorewall# iptables -L input -v -n -x Chain input (1 references) pkts bytes target prot opt in out source destination 227 24084 all -- * * 0.0.0.0/0 0.0.0.0/0 set accounting src 227 24084 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 If I have a specific IP in the /etc/shorewall/accounting file: ##################################################################################### #ACTION CHAIN SOURCE DESTINATION PROTO DEST SOURCE USER/ # PORT(S) PORT(S) GROUP input:COUNT - 192.168.0.99 - output:COUNT - 0.0.0.0/0 192.168.0.99 DONE input DONE output #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE root@OpenWrt:/etc/shorewall# iptables -L input -v -n -x Chain input (2 references) pkts bytes target prot opt in out source destination 81 8324 all -- * * 0.0.0.0/0 0.0.0.0/0 set accounting src 234 15380 all -- * * 192.168.0.99 0.0.0.0/0 315 23704 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0