hi list, I'm MARKing packets in PREROUTING of mangle with the below rule to route them from other route then the default route .(iproute2 + iptables) $iptables -A PREROUTING -i eth0 -t mangle -s 202.xxx.xxx.0/24 -d 0/0 -p tcp --dport 80 -j MARK --set-mark 4 What I want is to exclude a single IP from the above to be MARKed, i-e the particular IP packets goes through default route of the firewall machine not through iproute2 route. Is this possible with iptables or I have to apply pom (extentions) to accomplished this? regards Askar (after bouncing head on desk for days trying to get mine working, I'll make your life a little easier)