iptables not correctly marking packets based on source address

iptables not correctly marking packets based on source address

[Hugh Buchanan]

Greetings,

I am using iptables, currently as a NAT firewall but it will become a 
bridge firewall when I have it working correctly.

I have two simple rules for marking right now:

iptables -A PREROUTING -i eth1 -s $LAN -t mangle -j MARK --set-mark 1
iptables -A PREROUTING -i eth1 -t mangle -j MARK --set-mark 2

$LAN is defined to be "192.168.0.0/24"

Now.. I found a bit in the list archives about mangling with NAT.. so I 
am wondering if the source address is wrong.  But shouldn't PREROUTING 
happen before the NAT takes place?


My end goal is to have a mangle line for each of the half a dozen source 
addresses.  For example:
192.168.0.5 - mark as '2'
192.168.0.6 - mark as '3'
192.168.0.7 - mark as '4'
192.168.0.8 - mark as '5'
192.168.0.9 - mark as '6'
192.168.0.10 - mark as '7'
And all other source addresses should be marked as '1'.

I was thinking that I could do something like:
iptables -A PREROUTING -s 192.168.0.5 -t mangle -j MARK --set-mark 2

But that isn't working for me.

Hugh Buchanan