blackhole/unreachable with IPSec policies

Hi All,

I am new to Mikrotik and I’ve enjoyed playing with my new hAP! I’ve got my VPN all running, and following various threads I’ve fixed what appears to be a pretty common performance problem, solved by the fasttrack issue.

Anyway, I have been trying to solve my goal of VPN-only routing via blackholing but at the moment, if I drop my VPN peer, traffic is allowed out.

I have added the blackhole bridge interface and set the route as detailed by eworm but I am a little confused by this comment:

Of course you need to add routing-mark (for route above) and connection-mark (for dynamic src-nat from mode-config) in firewall mangle.

Would anyone be so kind as to share sample configuration to solve this particular part please? I am running RouterOS 6.47.4

Thanks!