mark config helper: sanewall-mark

5
sanewall-mark

sanewall-mark

mark traffic for traffic shaping tools

        mark
        value
        chain
        rule-params

## Description

The `mark` helper command sets a mark on packets that can be matched by traffic shaping tools for controlling the traffic.

To set a mark on whole connections, see helpconf-connmark. There is also a `mark` parameter which allows matching marks within individual rules (see rule-params).

The `value` is the mark value to set (a 32 bit integer).

The `chain` will be used to find traffic to mark. It can be any of the `iptables` built in chains belonging to the `mangle` table. The chain names are: INPUT, FORWARD, OUTPUT, PREROUTING and POSTROUTING. The names are case-sensitive.

The ``rule-params`` define a set of rule parameters to match the traffic that is to be marked within the chosen chain. See rule-params for more details.

Any `mark` commands will affect all traffic matched. They must be declared before the first router or interface.

If you want to do policy based routing based on iptables marks, you will need to disable the Root Path Filtering on the interfaces involved (rp_filter in sysctl).

## Examples

    # mark with 1, packets sent by the local machine
    mark 1 OUTPUT

    # mark with 2, packets routed by the local machine
    mark 2 FORWARD

    # mark with 3, packets routed by the local machine, sent from
    #              192.0.2.2 destined for port TCP/25 of 198.51.100.1
    mark 3 FORWARD proto tcp dport 25 dst 198.51.100.1 src 192.0.2.2

## See Also

- sanewall
- sanewall.conf
- helpconf-connmark
- administration tool for IPv4 firewalls: iptables(8)
- show / manipulate routing, devices, policy routing and tunnels: ip(8)
- Linux Advanced Routing & Traffic Control HOWTO
- rule-params