MARK all traffic inbound from the internet

We use this MARK to skip the entire SNAT chain.  We never EVER want to
NAT or MASQ anything entering eth1.