Connmark help, picking the correct interface

Hi, need some help validating that the correct interface is being referenced in these rules that attempt to boost the priority of my gaming traffic above the best effort tin in Cake

the router is an MT76 (7621/7603) ZBT-WE3525

ifconfig reports:

br-lan    Link encap:Ethernet  HWaddr xx:xx:xx:xx:BD:DE  
          inet addr:192.168.7.1  Bcast:192.168.7.255  Mask:255.255.255.0
          inet6 addr: fe80::fa5e:3cff:fe04:bdde/64 Scope:Link
          inet6 addr: fd13:409:6107::1/60 Scope:Global
          inet6 addr: fd13:409:6107:4::1/62 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2062166 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3792068 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1909672190 (1.7 GiB)  TX bytes:3327330706 (3.0 GiB)

eth0      Link encap:Ethernet  HWaddr xx:xx:xx:xx:BD:DE  
          inet6 addr: fe80::fa5e:3cff:fe04:bdde/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4976832 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3694116 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3688711884 (3.4 GiB)  TX bytes:2424719268 (2.2 GiB)
          Interrupt:22 

eth0.1    Link encap:Ethernet  HWaddr xx:xx:xx:xx:BD:DE  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:78303 errors:0 dropped:0 overruns:0 frame:0
          TX packets:726500 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:10112723 (9.6 MiB)  TX bytes:408569386 (389.6 MiB)

eth0.2    Link encap:Ethernet  HWaddr xx:xx:xx:xx:BD:DE  
          inet addr:192.168.0.225  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fd13:409:6107:0:fa5e:3cff:fe04:bdde/64 Scope:Global
          inet6 addr: fe80::fa5e:3cff:fe04:bdde/64 Scope:Link
          inet6 addr: fd13:409:6107::510/128 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3466249 errors:0 dropped:369 overruns:0 frame:0
          TX packets:2967285 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3515217139 (3.2 GiB)  TX bytes:1986251758 (1.8 GiB)

ifb4eth0.2 Link encap:Ethernet  HWaddr F6:1D:22:A1:13:5C  
          inet6 addr: fe80::f41d:22ff:fea1:135c/64 Scope:Link
          UP BROADCAST RUNNING NOARP  MTU:1500  Metric:1
          RX packets:40676 errors:0 dropped:12 overruns:0 frame:0
          TX packets:40664 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32 
          RX bytes:15134309 (14.4 MiB)  TX bytes:15131795 (14.4 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:842 errors:0 dropped:0 overruns:0 frame:0
          TX packets:842 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:94622 (92.4 KiB)  TX bytes:94622 (92.4 KiB)

eth0.2 is the WAN and the ifb4eth0.2 is the one created by Cake.

eth0.1 is LAN

Prior examples of this recipe seem to target the underlying hardware interface (eth0) for the connmarks. But I’m not quite sure if that is correct, so asking for input.

Here is the custom rule set:

# This rule assumes 4-tier traffic management - diffserv4 in layer_cake
# All Xbox UDP traffic winds up in the Video tier, below VoIP, but above best-effort
# remember to change the MAC address below to match your unit

# Identify outbound UDP traffic from the Xbox and mark the connection with the value "30" (DSCP AF33)
iptables -t mangle -A FORWARD -o eth0 -p udp -m mac AA:BB:CC:11:22:33 -j CONNMARK --set-mark 30

# Identify inbound or outbound packets on connections with a connmark of "30", and tag the packets with DSCP 30
iptables -t mangle -A FORWARD -i eth0 -m connmark --mark 30 -j DSCP --set-dscp 30
iptables -t mangle -A FORWARD -o eth0 -m connmark --mark 30 -j DSCP --set-dscp 30