puppetlabs/puppetlabs-firewall — pull request #427 by stesie (2014-10-27 21:19:19+00:00)
Title: Don't arbitrarily limit set_mark to certain chains

set_mark is currently limited to PREROUTING or OUTPUT chain, i.e. something like the following isn't accepted:

```puppet
firewallchain { 'from_mesh:mangle:IPv4':
ensure => present,
}

firewall { '900 mark mesh to vpn traffic':
table => 'mangle',
chain => 'from_mesh',
proto => 'all',
jump => 'MARK',
set_mark => '0x2342/0xffffffff',
}
```

... however it's perfectly valid wrt. iptables.