Hi,
Just a quick arb question I think... In all the examples I've seen... There is a connection-mark as well as a packet-mark. Why?
Surely, if you match on packets only it should include the initial connection regardless? I'm just wondering whether two rules are actually needed or not...