Hmmm - that's quite an option to check if the traffic is not going to www.some.paymentsystem.com in prohibitive rules...
Thanks alot for advise!
That's exactly what I've meant!@Feklar, @pe1chl
The question is not about the "arp" setting of interfaces. It's about the "published" setting in "/ip arp" items, introduces somewhat silently in recent RouterOS versions, and which isn't yet documented in the manual.
OMG, it worked!!11!11!1 It was that simple? I've been messing around for couple of hours and the answer was so close...you can try unset 0 out-interface