Re: MARK not working

[John Lister <john.lister@kickstone.com>]

Dennison Williams wrote:
> iptables -t mangle -A PREROUTING -i eth1 -p udp --dport 4500 -j MARK
> --set-mark 1
> iptables -t filter -A INPUT -m mark --mark 1 -j LOG --log-prefix ipsec_nat_t
> iptables -t filter -A INPUT -m mark --mark 1 -j ACCEPT
> iptables -t filter -A INPUT -j LOG
> iptables -t filter -A INPUT -j REJECT
>   
In general make sure that you are saving the marks to the conntrack 
tables  and restoring them with
-j CONNTRACK --save-mark
and
-j CONNTRACK --restore-mark

although in your sample this doesn't matter as you tag every incoming 
packet and as the other post notes, you seem to accept the connections 
before your logging.

I usually only set the mark when the state is NEW

John