[LARTC] How to MARK NATtted packets coming from external interface to an internal host ?

["Claudio L. Salvadori" <cls@xxxxxxxxxxxx>]

Hi,

I would like to control download bandwidth from the Internet for
clients inside a network. The gateway is a Linux box using
'iptables nat'.
I would like to use 'iptables mangle' to mark the packets coming
from the Internet and going to specific clients and then use CBQ
to shape it:


                        +-----------+
Internal network        |   Linux   |        Internet
------0-----------------|  Gateway  |-------------
      |            eth0 |    NAT    | eth1
   [client]             +-----------+
  192.168.1.8


I tried to use the following command to mark the packets:

iptables -t mangle -A PREROUTING -i eth1 -d 192.168.1.8
          -j MARK --set-mark 1

But the packets are not being marked probably because they were
not NATtted yet and still have the destination ip of the external interface.

How can I classify this traffic so I can shape it ?


Best regards,
Claudio Leonel Salvadori
cls@xxxxxxxxxxxx