Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu 10.04 machine with two ethernet interfaces: eth0 (WAN) eth1 (LAN)

I've configured NAT using these commands:

sudo iptables -A FORWARD -o eth0 -i eth1 -s -m conntrack --ctstate NEW -j ACCEPT
sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A POSTROUTING -t nat -j MASQUERADE 

Now I'd like to add a packet mark to packets sourced from eth1 so that I can traffic-shape based on the mark. What iptables commands do I need to do this?

It seems like I need something along the lines of

   sudo iptables -A FORWARD -i eth1 -t mangle -j MARK --set-mark 3

But I'm not sure. I want to make sure this mark persists past the nat so that I can inspect packets going out on eth0 with tc to do traffic shaping.

share|improve this question
Shouldn't your MASQUERADE rule be a bit more... specific? Or are you really intending to MASQUERADE all packets coming into your LAN? – Steven Monday Jan 29 '11 at 19:06
up vote 0 down vote accepted
sudo iptables -A PREROUTING -i eth1 -t mangle -j MARK --set-mark 3

you want to have the packets marked before they go into the router so you can use PREROUTING. see as well

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.