---
- name: "CONNMARK PREROUTING {{ balancer.mac }} proto={{ proto }}"
  ansible.builtin.command:
    cmd: >
      firewall-cmd --permanent --direct --add-rule
      ipv4 mangle PREROUTING 0
      -i {{ policy_routing_interface }}
      -m mac --mac-source {{ balancer.mac }}
      -p {{ proto }} --dport {{ policy_routing_src_port }}
      -j CONNMARK --set-mark {{ balancer.fwmark }}
  register: result
  changed_when: "'ALREADY_ENABLED' not in result.stderr"
  notify: Reload firewalld
  loop: "{{ policy_routing_protocols }}"
  loop_control:
    loop_var: proto