firehol-connmark(5)

💅 firehol-connmark — bestie edition ✨

okay so this is the firehol-connmark page from the FireHOL Reference manual, and it's literally about setting a stateful mark from the connmark group. yes queen, we're doing marks today 🎀

---

✨ NAME ✨

firehol-connmark — set a stateful mark from the connmark group. that's it, that's the whole vibe 🫶

---

🌸 SYNOPSIS 🌸

{ connmark | connmark46 } value chain rule-params

connmark4 value chain rule-params

connmark6 value chain rule-params

three flavors, same energy, pick your fighter 💅

---

🦋 DESCRIPTION 🦋

so like. marks on packets? they can be matched by traffic shaping, routing, and firewall rules for controlling traffic. yeah. the whole point is controlling traffic. iconic.

⚠️ Note — Behaviour changed significantly in FireHOL v3 compared to earlier versions. not a drill, bestie, don't copy-paste your old config and assume it still slaps.

FireHOL uses iptables masks to break the single 32-bit integer mark value into smaller groups and allows you to set and match them independently. The markdef group definitions to set this up are found in firehol-defaults.conf 🌈

The connmark helper command sets values within the connmark group. You can set value between 0 (no mark) and size-1. The default size for connmark is 64, so 63 is highest value possible. The default connmark types are stateful+permanent, meaning the initial match will only be done on NEW packets and the mark will be restored to all packets in the connection. she's persistent, we love that for her 💖

The chain will be used to find traffic to mark. It can be any of the iptables(8) built in chains belonging to the mangle table. The chain names are: INPUT, FORWARD, OUTPUT, PREROUTING and POSTROUTING. The names are case-sensitive — input is not INPUT, don't do that to yourself 😭

The rule-params define a set of rule parameters to match the traffic that is to be marked within the chosen chain. See firehol-params(5) for more details.

Any connmark commands must be declared before the first router or interface. no exceptions, she's strict 👑

⚠️ Note If you want to do policy based routing based on iptables(8) marks, you will need to disable the Root Path Filtering on the interfaces involved (rp_filter in sysctl). fr fr, don't skip this one. FireQOS will read the FireHOL mark definitions and set up suitable offsets and marks for the various groups. If you are using a different tool, you should look at the emitted firewall to determine the final masks and values to use. iykyk 🔥

---

🎀 EXAMPLES 🎀

the moment you've all been waiting for, actual examples, periodt ✨

# mark with 1, packets sent by the local machine
connmark 1 OUTPUT

# mark with 2, packets routed by the local machine
connmark 2 FORWARD

# mark with 3, packets routed by the local machine, sent from
#              192.0.2.2 destined for port TCP/25 of 198.51.100.1
connmark 3 FORWARD proto tcp dport 25 dst 198.51.100.1 src 192.0.2.2

look at her go 😭 so clean, so specific, so main character 🌟

---

👑 SEE ALSO 👑

go read these too, bestie, they're all bangers:

• firehol(1) — FireHOL program
• firehol.conf(5) — FireHOL configuration
• firehol-params(5) — optional rule parameters
• [firehol-mark(5)][keyword-firehol-mark] — set a stateful mark from the usermark group
• iptables(8) — administration tool for IPv4 firewalls
• ip6tables(8) — administration tool for IPv6 firewalls
• ip(8) — show / manipulate routing, devices, policy routing and tunnels
• FireHOL Website
• Working With Marks Wiki Page
• FireHOL Online PDF Manual
• FireHOL Online Documentation
• Linux Advanced Routing & Traffic Control HOWTO

---

💜 AUTHORS 💜

FireHOL Team. (the collective, the icon, the moment 🫶)

---

alright bestie that's the whole page — this was built 13 Apr 2025 as part of the FireHOL Reference, version 3.1.8, and honestly? it ate. go mark some packets, you've got this 💅✨