Thanks for the pointer. The post you linked points towards this: http://forum.mikrotik.com/t/static-default-route-im-missing-something/119183/2
From that, I get that fasttrack-connection fast tracks the connection based on the incoming packet, which causes the outgoing packet to skip mangle processing and thus being marked for the routing mark, correct? Thus, for whatever logic I used to put a routing mark on the packet, I should switch to marking the connection (but only on the first/new packet). Then I should match on that connection mark to apply the routing mark. I can then re-enable the fasttrack-connection rule with the condition that it doesn’t apply to any packet with a connection mark. I get all that, but I have some questions about the example config given:
/ip firewall mangle
- add chain=prerouting connection-state=established,related connection-mark=no-mark action=accept # if a mid-connection packet has no connection mark, it needs the default handling
- add chain=prerouting connection-state=established,related in-interface=your-wan # download packets MUST NOT be routing-marked
- add chain=prerouting connection-mark=handling-A action=mark-routing new-routing-mark=handling-A # passthrough=no is a default behaviour but you can state it explicitly
- add chain=prerouting connection-mark=handling-B action=mark-routing new-routing-mark=handling-B # same like above
#only initial packets of connections (plus some garbage) get here past the rules above
5. add chain=prerouting …list of classifying match conditions for handling A… connection-state=new action=mark-connection new-connection-mark=handling-A passthrough=yes
6. add chain=prerouting …list of classifying match conditions for handling B… connection-mark=no-mark connection-state=new action=mark-connection new-connection-mark=handling-B passthrough=yes
#initial packets of connections which evaded both the rules above get here with no connection mark; we just repeat the mark-routing rules above
7. add chain=prerouting connection-mark=handling-A action=mark-routing new-routing-mark=handling-A
8. add chain=prerouting connection-mark=handling-B action=mark-routing new-routing-mark=handling-B
Aren’t lines #3-4 the same as lines #7-8? Do they need to be listed before and after the connection mark lines (#5-6)?
Line #2 doesn’t have an action, what’s it supposed to do? Was that supposed to have action=accept? Assuming that’s the case, this line’s purpose seems to be such that incoming packets from the WAN will have connections marks, but this prevents routing marks from being applied to those packets, so that they don’t get routed back out the tunnel?
Line #1 doesn’t really seem necessary, but more of a performance optimization, correct? And would be bad if I needed to mark connections/packets in other ways?