<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
                 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
<!-- For license information see sanewall-manual-info.xml.in -->
<refentry id="helpconf-mark">

<refmeta>
<refentrytitle>mark config helper: sanewall-mark</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>

<refnamediv>
<refdescriptor>sanewall-mark</refdescriptor>
<refname>sanewall-mark</refname>
<refpurpose>mark traffic for traffic shaping tools</refpurpose>
</refnamediv>

<refsynopsisdiv>
  <cmdsynopsis>
    <command>mark</command>
    <arg choice="plain"><replaceable>value</replaceable></arg>
    <arg choice="plain"><replaceable>chain</replaceable></arg>
    <arg choice="opt"><replaceable>rule-params</replaceable></arg>
  </cmdsynopsis>
</refsynopsisdiv>

<refsect1><title>Description</title>
  <para>
    The <command>mark</command> helper command sets a mark on packets
    that can be matched by traffic shaping tools for controlling the traffic.
  </para>
  <note><para>
    To set a mark on whole connections, see
    <xref linkend="helpconf-connmark"/>.
     There is also a <command>mark</command> parameter
     which allows matching marks within individual rules
     (see <xref linkend="rule-params"/>).
  </para></note>
  <para>
    The <replaceable>value</replaceable> is the mark value to set (a 32 bit
    integer).
  </para>
  <para>
    The <replaceable>chain</replaceable> will be used to find traffic to
    mark. It can be any of the <command>iptables</command> built in chains
    belonging to the <option>mangle</option> table. The chain names
    are: INPUT, FORWARD, OUTPUT, PREROUTING and POSTROUTING. The names are
    case-sensitive.
  </para>
  <para>
    The <option><replaceable>rule-params</replaceable></option> define
    a set of rule parameters to match the traffic that is to be marked
    within the chosen chain.
    See <xref linkend="rule-params"/> for more details.
  </para>
  <para>
    Any <command>mark</command> commands will affect all traffic
    matched. They must be declared before the first router or interface.
  </para>
  <note><para>
    If you want to do policy based routing based on iptables marks,
    you will need to disable the Root Path Filtering on the interfaces
    involved (rp_filter in sysctl).
  </para></note>
</refsect1>

<refsect1><title>Examples</title>
    <programlisting>
# mark with 1, packets sent by the local machine
mark 1 OUTPUT

# mark with 2, packets routed by the local machine
mark 2 FORWARD

# mark with 3, packets routed by the local machine, sent from
#              192.0.2.2 destined for port TCP/25 of 198.51.100.1
mark 3 FORWARD proto tcp dport 25 dst 198.51.100.1 src 192.0.2.2
    </programlisting>
</refsect1>

<refsect1><title>See Also</title>
  <simplelist type="vert">
    <member><xref linkend="sanewall"/></member>
    <member><xref linkend="sanewall.conf"/></member>
    <member><xref linkend="helpconf-connmark"/></member>
    <member>administration tool for IPv4 firewalls: iptables(8)</member>
    <member>show / manipulate routing, devices, policy routing and tunnels: ip(8)</member>
    <member><ulink url="http://www.lartc.org/lartc.html">Linux Advanced Routing &amp; Traffic Control HOWTO</ulink></member>
    <member><xref linkend="rule-params"/></member>
  </simplelist>
</refsect1>

</refentry>
