Hello,
I’d like to know if anyone can help me with the following issue.
I have 2x CCR-1036 8G-2S+ in different locations. The link between them goes through some random equiments of some provider. I was wondering if there is a solution (i was thinking maybe connection-mark) to somehow mark the packet from one side and only allow incoming marked packets on the other side.
I’m not allowed to do tunelling or something similar.
Thank you.
If there is connection between those places there shouldn’t be any problem to run a tunnel in between. At least sstp or any better…
You can mark packets based on src/and destination address. But just remember, packet/connection marks are router local, you can not mark one packet on one router and use it on the other.
Tunneling may not be allowed and even if your provider does not allow using other protocols except plain TCP/IP, sstp (using the same port as https) will be undistinguishable from regular https traffic 
by marking packets with a DSCP(TOS) value you will be able to differentiate the packets from other routers it passes trough.