Mangle rules

http://forum.mikrotik.com/t/mark-connection-vs-mark-packet/44577/1