So far, the closest I've been able to come is to insert my rules into mangle/OUTPUT above the QOSO jump, but this means that the filter I'm using (owner, in this case) is evaluated for _every outbound packet_ even if the socket itself has already been identified and marked.
Ideally I'd like my iptables rule to appear in position 3 of the QOSO chain, but the only place I know to do it (that will survive further GUI interaction) is in the firewall script, and it appears this script gets fired _before_ the QOSO jump is (re)created.
This is a concern for me because matches against OWNER are _far_ more expensive than CONNMARK matches, so I'm seeing a huge amount of time spent in SYS during moderate-to-heavy packet loads.
Any suggestions?
Rodney
My Tomato utilities site: http://multics.minidns.net/blog/articles/tomato_utilities