I would like how to mark ftp passive connections with connmark. Currently I have resolved this problem in the following manner: # mark ftp active conn (no problem) --protocol tcp --dports 20,21 -j MARK --set-mark 1 # mark ftp passive data conn with helper's help -m helper --helper ftp -j MARK --set-mark 1 TIA