Redirect SSH traffic through GRE tunnel

mangle's PREROUTING is for altering incoming packets before routing and OUTPUT for altering locally-generated packets before routing. Hence PREROUTING is needless (for local connections). But OUTPUT should have worked, though. You don't need to specify source address in firewall rules usually, since it would be "locally-generated packets" anyway.

And another thing to remember is no-one gonna change source IP just due to you've marked the packet and it would be routed with another route table — you'd need to use NAT explicitly for that. In terms of Linux' iptables it has to be SNAT. And "This target is only valid in the nat table, in the POSTROUTING chain", as the man says. Although I personally prefer its subspecies MASQUERADE which is more handy for that, cause you don't have to bother with IP-addresses hard coding.