Bent, try something like this:
|# this tells the system to use table 44 for packets marked with 1 ip rule add fwmark 1 table 44 # this tells the system to apply a connection mark of 1 to incoming connections on tunl0 that are NOT in the 44/8 address space |iptables -t mangle -A PREROUTING -i tunl0 ! -s 44.0.0.0/8 -j CONNMARK --set-mark 1
# this tells to copy the connection mark (if any) to the packet mark so it will follow the rule above iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
Marius, YO2LOJ