From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 3/6] firewall: Always restore all connection marks
Date: Mon, 04 Oct 2021 18:52:19 +0100
Message-ID: <20211004175222.9208-3-michael.tremer@ipfire.org>
In-Reply-To: <20211004175222.9208-1-michael.tremer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2662137276959470196=="
List-Id: <development.lists.ipfire.org>

--===============2662137276959470196==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

This was done by tc only when QoS was enabled

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 config/qos/makeqosscripts.pl    | 1 -
 src/initscripts/system/firewall | 3 +++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl
index 3af046ac3..5bdd5b811 100644
--- a/config/qos/makeqosscripts.pl
+++ b/config/qos/makeqosscripts.pl
@@ -370,7 +370,6 @@ print <<END
 	ip link set $qossettings{'IMQ_DEV'} up
=20
 	tc filter add dev $qossettings{'RED_DEV'} parent ffff: protocol all u32 mat=
ch u32 0 0 \\
-		action connmark \\
 		action mirred egress redirect dev $qossettings{'IMQ_DEV'}
=20
 	### ADD HTB QDISC FOR $qossettings{'IMQ_DEV'}
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 9d023a349..7a7d52d57 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -100,6 +100,9 @@ iptables_init() {
 	iptables -t raw -N CONNTRACK
 	iptables -t raw -A PREROUTING -j CONNTRACK
=20
+	# Restore any connection marks
+	iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
+
 	# Fix for braindead ISPs
 	iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to=
-pmtu
=20
--=20
2.31.0


--===============2662137276959470196==--