diff --git a/manpages/shorewall-tcrules.xml b/manpages/shorewall-tcrules.xml
index 641f607cd..1540415e8 100644
--- a/manpages/shorewall-tcrules.xml
+++ b/manpages/shorewall-tcrules.xml
@@ -80,18 +80,19 @@
marks (see below).
May optionally be followed by :P, :F,:T or
+ :I where
+ :P indicates that marking should occur in the
+ PREROUTING chain, :F indicates
+ that marking should occur in the FORWARD chain, :I indicates that marking should occur in
+ the INPUT chain (added in Shorewall 4.4.13), and :T indicates that marking should occur in
+ the POSTROUTING chain. If neither :P, :F
- or :T where :P indicates that marking should occur
- in the PREROUTING chain, :F
- indicates that marking should occur in the FORWARD chain, :I
- indicates that marking should occur in the INPUT chain (added in
- Shorewall 4.4.13), and :T
- indicates that marking should occur in the POSTROUTING chain. If
- neither :P, :F nor :T follow the mark value then the chain
- is determined as follows:
+ nor :T follow the mark value
+ then the chain is determined as follows:
- If the SOURCE is $FW[shorewall.conf(5).
+ Please note that :I is
+ included for completeness and affects neither traffic shaping
+ nor policy routing.
+
If your kernel and iptables include CONNMARK support then
you can also mark the connection rather than the packet.
The mark value may be optionally followed by "/" and a
mask value (used to determine those bits of the connection mark
to actually be set). The mark and optional mask are then
- followed by one of:+
+ followed by one of:
@@ -147,6 +152,16 @@
Mark the connecdtion in the POSTROUTING chain
+
+
+ CI
+
+
+ Mark the connection in the INPUT chain. This option
+ is included for completeness and has no applicability to
+ traffic shaping or policy routing.
+
+
Special considerations for If
diff --git a/manpages6/shorewall6-tcrules.xml b/manpages6/shorewall6-tcrules.xml
index 879426d8c..3acc04778 100644
--- a/manpages6/shorewall6-tcrules.xml
+++ b/manpages6/shorewall6-tcrules.xml
@@ -103,6 +103,10 @@
MARK_IN_FORWARD_CHAIN in shorewall6.conf(5).
+ Please note that :I is
+ included for completeness and affects neither traffic shaping
+ nor policy routing.
+
If your kernel and ip6tables include CONNMARK support then
you can also mark the connection rather than the packet.
@@ -144,6 +148,16 @@
Mark the connection in the POSTROUTING chain
+
+
+ CI
+
+
+ Mark the connection in the INPUT chain. This option
+ is included for completeness and has no applicability to
+ traffic shaping or policy routing.
+
+
Special considerations for If