This module sets the netfilter mark value associated with a connection

--set-mark mark[/mask]
    Set connection mark. If a mask is specified then only those bits set in the mask is modified.

--save-mark [--mask mask]
    Copy the netfilter packet mark value to the connection mark. If a mask is specified then only those bits are copied.

--restore-mark [--mask mask]
    Copy the connection mark value to the packet. If a mask is specified then only those bits are copied. This is only valid in the mangle table.