Hoi! (longtime lurker here) Since we now already do the conntrack-lookup for the nat keyword, would it be expensive to implement a kind of internal conntrack-mark-and-restore by cake-tin? E.g. when traffic leaves throu canke tin#x, the conntrack entry will get a fwmark and return traffic is put in the corresponding tin/bin on the ingress cake. cheers felix