<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>It should be visible in "ip xfrm pol".</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">The VTI devices handle the marking for you. If not using those, you need</div><div id="AppleMailSignature">to use your own iptables rules to mark the traffic appropriately. Any traffic that matched all IPsec traffic selectors but not the mark, will not be encrypted and leaves the machine in the clear.<br><br>Sent from my iPhone</div><div><br>On Feb 9, 2017, at 15:42, Xinwei Hong <<a href="mailto:xhong@skytap.com">xhong@skytap.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">Thanks. One follow-up question: after I setup a route-based VPN, I don't see any rule with that mark when I do "iptables-save". Am I supposed to find any entry in the iptables?<div><br></div><div>Thanks,</div><div>Xinwei</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 9, 2017 at 12:26 PM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@nohats.ca" target="_blank">paul@nohats.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Thu, 9 Feb 2017, Xinwei Hong wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
mark=<br>
The mark number to use for this connection's IPsec SA policy. It will be used for all instances as well.<br>
<br>
in the example, we have:<br>
<br>
mark=5/0xffffffff<br>
How are those numbers used? What do 5 and 0xffffffff mean here? What is the guidance to select a number for it? e.g.<br>
when there are multiple VTIs configured. Does this mark have anything to do with mark in iptables?<br>
</blockquote>
<br></span>
Its the mark number and mask. Yes these are the same as the mark with<br>
iptables where you can use it.<span class="HOEnZb"><font color="#888888"><br>
<br>
Paul<br>
</font></span></blockquote></div><br></div>
</div></blockquote></body></html>