diff --git a/manpages/shorewall-tcrules.xml b/manpages/shorewall-tcrules.xml index 641f607cd..1540415e8 100644 --- a/manpages/shorewall-tcrules.xml +++ b/manpages/shorewall-tcrules.xml @@ -80,18 +80,19 @@ marks (see below). May optionally be followed by :P, :F,:T or + :I where + :P indicates that marking should occur in the + PREROUTING chain, :F indicates + that marking should occur in the FORWARD chain, :I indicates that marking should occur in + the INPUT chain (added in Shorewall 4.4.13), and :T indicates that marking should occur in + the POSTROUTING chain. If neither :P, :F - or :T where :P indicates that marking should occur - in the PREROUTING chain, :F - indicates that marking should occur in the FORWARD chain, :I - indicates that marking should occur in the INPUT chain (added in - Shorewall 4.4.13), and :T - indicates that marking should occur in the POSTROUTING chain. If - neither :P, :F nor :T follow the mark value then the chain - is determined as follows: + nor :T follow the mark value + then the chain is determined as follows: - If the SOURCE is $FW[shorewall.conf(5). + Please note that :I is + included for completeness and affects neither traffic shaping + nor policy routing. + If your kernel and iptables include CONNMARK support then you can also mark the connection rather than the packet. The mark value may be optionally followed by "/" and a mask value (used to determine those bits of the connection mark to actually be set). The mark and optional mask are then - followed by one of:+ + followed by one of: @@ -147,6 +152,16 @@ Mark the connecdtion in the POSTROUTING chain + + + CI + + + Mark the connection in the INPUT chain. This option + is included for completeness and has no applicability to + traffic shaping or policy routing. + + Special considerations for If diff --git a/manpages6/shorewall6-tcrules.xml b/manpages6/shorewall6-tcrules.xml index 879426d8c..3acc04778 100644 --- a/manpages6/shorewall6-tcrules.xml +++ b/manpages6/shorewall6-tcrules.xml @@ -103,6 +103,10 @@ MARK_IN_FORWARD_CHAIN in shorewall6.conf(5). + Please note that :I is + included for completeness and affects neither traffic shaping + nor policy routing. + If your kernel and ip6tables include CONNMARK support then you can also mark the connection rather than the packet. @@ -144,6 +148,16 @@ Mark the connection in the POSTROUTING chain + + + CI + + + Mark the connection in the INPUT chain. This option + is included for completeness and has no applicability to + traffic shaping or policy routing. + + Special considerations for If