From mboxrd@z Thu Jan  1 00:00:00 1970
From: Andrew Beverley <andy@andybev.com>
Date: Sat, 29 Jun 2013 09:02:15 +0000
Subject: Re: routing e dmz in multiple gw
Message-Id: <1372496535.3924.78.camel@andrew-desktop>
List-Id: <lartc.vger.kernel.org>
References: <13f75a91e3e.ninnig1@tin.it>
In-Reply-To: <13f75a91e3e.ninnig1@tin.it>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: lartc@vger.kernel.org

On Sat, 2013-06-29 at 09:55 +0100, Andrew Beverley wrote:
> You're marking the packets in POSTROUTING, but which time the routing
> decision has already taken place. You'll need to mark them much earlier,
> somewhere in PREROUTING.

See this diagram for more information:

http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg

You need to be marking packets before either of the "routing decision"
boxes.