Problem seems to be solved, routeros behaves as should do.

The output interface can't be matched if the routing destination is not known in advance.

I am running 2.9.27 I set up a rule for block internal packets to go out to the internet. / ip firewall filter add chain=output out-interface=Public1 dst-address-list=INTERNAL_NETWORK action=reject reject-with=icmp-net-prohibited add chain=output out-interface=Public2 dst-address-list=INTERNAL_NETWO...

Any news about the Dude for mikrotik package?

Broadcast forwarding (on demand). NAT from/to broadcast addresses. It seems that this rule: /ip firewall nat add chain=dstnat in-interface=WAN dst-address=WAN_IP protocol=udp dst-port=7 action=dst-nat to-addresses=LAN_BROADCAST_IP to-ports=7 kiks in but the packet is not forwarded. Also the "fa...

Better change: add chain=srcnat src-address=0.0.0.0/0 dst-address=0.0.0.0/0 action=masquerade comment="" disabled=no to: add chain=srcnat out-interface=WAN-LAN1 action=masquerade comment="" disabled=no or better: add chain=srcnat out-interface=WAN-LAN1 action=src-nat to-addresses...

An even more elegant solution: change the TTL to a constant value.

A very useful feature would be something like an ARP manipulation util.
Thanks.

To daiceman: "You FOOL don't have a ADMIN password".
Set a password A.S.A.P. and LOOK into Your Mikrotik LOGS.
Marry Christmas.