Subject: Re: xfrm by MARK: tcp problems when mark for in and out differ

From: jamal <[email-masked]>
Date: Thu, 14 Oct 2010 08:02:21 -0400

On Wed, 2010-10-13 at 15:57 +0200, Gerd v. Egidy wrote:
> Hi,

> 
> -> incoming packets are without mark, outgoing packets are marked with 5
> 

You could use tc ingress path to mark incoming packets. Example:

----
tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol ip pref 9 u32 \
match ip src 192.168.1.0/32 flowid 1:5 action skbedit mark 5
---

just remember that src on outgoing is dst on incoming..

cheers,
jamal