Does openswan support this with PFKEY? So that packets can match on fwmark and not source/dest subnets. Strongswan appears to have this with it's mark_in/out params. Thanks. -Bryan