I have an Ubuntu 10.04 machine with two ethernet interfaces: eth0 (WAN) eth1 (LAN)
I've configured NAT using these commands:
sudo iptables -A FORWARD -o eth0 -i eth1 -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT sudo iptables -A POSTROUTING -t nat -j MASQUERADE
Now I'd like to add a packet mark to packets sourced from eth1 so that I can traffic-shape based on the mark. What iptables commands do I need to do this?
It seems like I need something along the lines of
sudo iptables -A FORWARD -i eth1 -t mangle -j MARK --set-mark 3
But I'm not sure. I want to make sure this mark persists past the nat so that I can inspect packets going out on eth0 with tc to do traffic shaping.