Packet Tagging and Marking

In this lesson, you will learn how to use firewall packet marks to influence how the Linux kernel routes traffic and prioritizes packets for transmission.

The Logic of Packet Marking

When the standard routing table isn't enough, we use packet marking. By leveraging the mangle table in nftables or iptables, we can assign a "mark"—a numeric value—to specific packets as they traverse the kernel’s Netfilter hooks. This mark acts as an internal metadata tag that follows the packet through the network stack.

While routing usually relies on destination IP addresses, a mark allows you to make routing decisions based on other criteria, such as the source application, protocol headers, or even the state of the connection.

Putting Marks to Work

Once a packet is marked, it ceases to be just another stream of data; it becomes a candidate for special handling. You can use these marks in two primary ways:

1. Policy Routing: You can configure the Linux policy routing rules (ip rule) to look for specific marks. If a packet carries a mark, the kernel forces it to use a specific routing table, bypassing the default gateway.
2. Traffic Control (QoS): The tc (Traffic Control) subsystem can filter based on these marks. You can assign marked packets to higher-priority queues (like fq_codel or HTB) to ensure that, for example, your VoIP traffic gets bandwidth preference over background downloads.

Example: Marking Traffic

To tag traffic from a specific service so that it uses a dedicated ISP uplink, you would run:

# Tag packets from port 8080 with mark '1'
nft add rule inet filter output tcp dport 8080 meta mark set 1

# Tell the kernel to route mark '1' via table 100
ip rule add fwmark 1 table 100

By decoupling the identification of the traffic (the mark) from the action taken on it (routing or queuing), you gain granular control over how your Linux host behaves in complex network environments. The mark acts as a bridge between the firewall logic and the kernel's routing and queuing engines.

Key Takeaway: Packet marks serve as a metadata bridge, allowing the kernel to perform advanced policy routing and traffic shaping based on criteria that exceed simple destination-based lookups.