Move set-mark after iptables jump

Fixes #15277.