Fix enhancement to packet marking capability

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1702 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

Shorewall2/firewall

@@ -2342,27 +2342,6 @@ process_tc_rule()
 	    esac
 	fi
 
-	case $testval in
-	    -)
-		;;
-	    !*:C)
-		marktest="connmark ! "
-		testval=${testval%:*}
-		testval=${testval#!}
-		;;
-	    *:C)
-		marktest="connmark "
-		testval=${testval%:*}
-		;;
-	    !*)
-		marktest="mark ! "
-		testval=${testval#!}
-		;;
-	    *)
-		[ -n "$testval" ] && marktest="mark "
-		;;
-	esac
-
 	[ -n "$marktest" ] && r="${r}-m ${marktest}--mark $testval "
 
 	[ "x$dest"   = "x-"  ] || r="${r}$(dest_ip_range $dest) "
@@ -2439,6 +2418,27 @@ process_tc_rule()
 	    ;;
     esac
 
+    case $testval in
+	-)
+	    ;;
+	!*:C)
+	    marktest="connmark ! "
+	    testval=${testval%:*}
+	    testval=${testval#!}
+	    ;;
+	*:C)
+	    marktest="connmark "
+	    testval=${testval%:*}
+	    ;;
+	!*)
+	    marktest="mark ! "
+	    testval=${testval#!}
+	    ;;
+	*)
+	    [ -n "$testval" ] && marktest="mark "
+	    ;;
+    esac
+
     for source in $(separate_list ${sources:=-}); do
 	for dest in $(separate_list ${dests:=-}); do
 	    for port in $(separate_list ${ports:=-}); do