Set conntrack mark before it is in hashes. Signed-off-by: Pablo Neira Ayuso Index: netfilter-2.6.14.git/net/ipv4/netfilter/ip_conntrack_netlink.c =================================================================== --- netfilter-2.6.14.git.orig/net/ipv4/netfilter/ip_conntrack_netlink.c 2005-12-05 11:44:55.000000000 +0100 +++ netfilter-2.6.14.git/net/ipv4/netfilter/ip_conntrack_netlink.c 2005-12-05 11:45:12.000000000 +0100 @@ -1032,6 +1032,11 @@ ctnetlink_create_conntrack(struct nfattr return err; } +#if defined(CONFIG_IP_NF_CONNTRACK_MARK) + if (cda[CTA_MARK-1]) + ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1])); +#endif + ct->helper = ip_conntrack_helper_find_get(rtuple); add_timer(&ct->timeout); @@ -1040,11 +1045,6 @@ ctnetlink_create_conntrack(struct nfattr if (ct->helper) ip_conntrack_helper_put(ct->helper); -#if defined(CONFIG_IP_NF_CONNTRACK_MARK) - if (cda[CTA_MARK-1]) - ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1])); -#endif - DEBUGP("conntrack with id %u inserted\n", ct->id); return 0;