Q:

How to mark outbound FTP traffic with iptables?

i have a user called "testuser" in my debian system and i want to mark the FTP traffic going from testuser's account
how can i do that?
i use following commands to mark all the outgoing traffic for "testuser"
iptables -t mangle -N HTB_OUT
iptables -t mangle -I POSTROUTING -j HTB_OUT
iptables -t mangle -A HTB_OUT -m owner --uid-owner testuser -j MARK --set-mark 10

how to set two marks for "testuser"? one for FTP traffic only and one for all other traffic? 

A:

Add a --dport (--destination-port) option. You'll need at least two of them - 20:21 for FTP traffic and !20:21 for non-FTP.

