diff --git a/Android.mk b/Android.mk
index 89392ff..8e13130 100644
--- a/Android.mk
+++ b/Android.mk
@@ -8,6 +8,7 @@
                   CommandListener.cpp                  \
                   DnsProxyListener.cpp                 \
                   FirewallController.cpp               \
+                  FwmarkServer.cpp                     \
                   IdletimerController.cpp              \
                   InterfaceController.cpp              \
                   MDnsSdListener.cpp                   \
diff --git a/FwmarkServer.cpp b/FwmarkServer.cpp
new file mode 100644
index 0000000..0166226
--- /dev/null
+++ b/FwmarkServer.cpp
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "FwmarkServer.h"
+
+#include "Fwmark.h"
+#include "NetworkController.h"
+#include "PermissionsController.h"
+
+#include "netd_client/FwmarkCommands.h"
+
+#include <sys/socket.h>
+#include <unistd.h>
+
+namespace {
+
+const int MAX_COMMAND_LENGTH = 16;
+
+}  // namespace
+
+FwmarkServer::FwmarkServer(NetworkController* networkController,
+                           PermissionsController* permissionsController)
+        : SocketListener("fwmarkd", true),
+          mNetworkController(networkController),
+          mPermissionsController(permissionsController) {
+}
+
+bool FwmarkServer::onDataAvailable(SocketClient* client) {
+    int fd = -1;
+    processClient(client, &fd);
+    int error = errno;
+    if (fd >= 0) {
+        close(fd);
+    }
+
+    // Always send a response even if there were connection errors or read errors, so that we don't
+    // inadvertently cause the client to hang (which always waits for a response).
+    client->sendData(&error, sizeof(error));
+
+    // Always close the client connection (by returning false). This prevents a DoS attack where
+    // the client issues multiple commands on the same connection, never reading the responses,
+    // causing its receive buffer to fill up, and thus causing our client->sendData() to block.
+    return false;
+}
+
+void FwmarkServer::processClient(SocketClient* client, int* fd) {
+    char command[MAX_COMMAND_LENGTH] = {};
+    iovec iov;
+    iov.iov_base = command;
+    iov.iov_len = sizeof(command);
+
+    msghdr message;
+    memset(&message, 0, sizeof(message));
+    message.msg_iov = &iov;
+    message.msg_iovlen = 1;
+
+    union {
+        cmsghdr cmh;
+        char cmsg[CMSG_SPACE(sizeof(*fd))];
+    } cmsgu;
+
+    memset(cmsgu.cmsg, 0, sizeof(cmsgu.cmsg));
+    message.msg_control = cmsgu.cmsg;
+    message.msg_controllen = sizeof(cmsgu.cmsg);
+
+    int messageLength = TEMP_FAILURE_RETRY(recvmsg(client->getSocket(), &message, 0));
+    if (messageLength <= 0) {
+        return;
+    }
+
+    cmsghdr* const cmsgh = CMSG_FIRSTHDR(&message);
+    if (cmsgh && cmsgh->cmsg_level == SOL_SOCKET && cmsgh->cmsg_type == SCM_RIGHTS &&
+        cmsgh->cmsg_len == CMSG_LEN(sizeof(*fd))) {
+        memcpy(fd, CMSG_DATA(cmsgh), sizeof(*fd));
+    }
+
+    if (*fd < 0) {
+        errno = ENOENT;
+        return;
+    }
+
+    Fwmark fwmark;
+    int fwmarkLen = sizeof(fwmark.intValue);
+    if (getsockopt(*fd, SOL_SOCKET, SO_MARK, &fwmark.intValue, &fwmarkLen) == -1) {
+        return;
+    }
+
+    switch (command[0]) {
+        case FWMARK_COMMAND_ON_CREATE: {
+            // on socket creation
+            // TODO
+            break;
+        }
+
+        case FWMARK_COMMAND_ON_CONNECT: {
+            // Set the netId (of the default network) into the fwmark, if it has not already been
+            // set explicitly. Called before a socket connect() happens.
+            if (!fwmark.explicitlySelected) {
+                fwmark.netId = mNetworkController->getDefaultNetwork();
+            }
+            break;
+        }
+
+        case FWMARK_COMMAND_ON_ACCEPT: {
+            // on socket accept
+            // TODO
+            break;
+        }
+
+        case FWMARK_COMMAND_SELECT_NETWORK: {
+            // set socket mark
+            // TODO
+            break;
+        }
+
+        case FWMARK_COMMAND_PROTECT_FROM_VPN: {
+            // set vpn protect
+            // TODO
+            break;
+        }
+
+        default: {
+            // unknown command
+            errno = EINVAL;
+            return;
+        }
+    }
+
+    fwmark.permission = mPermissionsController->getPermissionForUser(client->getUid());
+
+    if (setsockopt(*fd, SOL_SOCKET, SO_MARK, &fwmark.intValue, sizeof(fwmark.intValue)) == -1) {
+        return;
+    }
+
+    errno = 0;
+}
diff --git a/FwmarkServer.h b/FwmarkServer.h
new file mode 100644
index 0000000..4d58fd5
--- /dev/null
+++ b/FwmarkServer.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SYSTEM_NETD_FWMARK_SERVER_H
+#define SYSTEM_NETD_FWMARK_SERVER_H
+
+#include <sysutils/SocketListener.h>
+
+class NetworkController;
+class PermissionsController;
+
+class FwmarkServer : public SocketListener {
+public:
+    FwmarkServer(NetworkController* networkController,
+                 PermissionsController* permissionsController);
+
+private:
+    // Overridden from SocketListener:
+    bool onDataAvailable(SocketClient* client);
+
+    // Returns success / failure implicitly via errno.
+    void processClient(SocketClient* client, int* fd);
+
+    NetworkController* const mNetworkController;
+    PermissionsController* const mPermissionsController;
+};
+
+#endif  // SYSTEM_NETD_FWMARK_SERVER_H
diff --git a/main.cpp b/main.cpp
index 90f1e6f..e09019d 100644
--- a/main.cpp
+++ b/main.cpp
@@ -34,6 +34,7 @@
 #include "NetlinkManager.h"
 #include "DnsProxyListener.h"
 #include "MDnsSdListener.h"
+#include "FwmarkServer.h"
 
 static void coldboot(const char *path);
 static void sigchld_handler(int sig);
@@ -45,6 +46,7 @@
     NetlinkManager *nm;
     DnsProxyListener *dpl;
     MDnsSdListener *mdnsl;
+    FwmarkServer* fwmarkServer;
 
     ALOGI("Netd 1.0 starting");
 
@@ -78,6 +80,14 @@
         ALOGE("Unable to start MDnsSdListener (%s)", strerror(errno));
         exit(1);
     }
+
+    fwmarkServer = new FwmarkServer(CommandListener::sNetCtrl,
+                                    CommandListener::sPermissionsController);
+    if (fwmarkServer->startListener()) {
+        ALOGE("Unable to start FwmarkServer (%s)", strerror(errno));
+        exit(1);
+    }
+
     /*
      * Now that we're up, we can respond to commands
      */