PBR - Ensure traffic leaves the same interface it arrives on

[jayd2k]

@dog

Well, take a look again at what I said:

Create a second rule that applies a new routing mark to packets marked with the connection mark > and coming from the DMZ.

Right now you are switching inbound traffic to a routing table that no longer has the destination it is supposed to reach.

Got you, it's working perfectly fine now, thanks!
[admin@R2-PBR-LAB] > ip firewall mangle export

mar/11/2014 09:19:55 by RouterOS 6.10

software id = RNN2-JRDD

/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=vpn-ext new-connection-mark=from-vpn
add action=mark-routing chain=prerouting connection-mark=from-vpn new-routing-mark=route-vpn src-address=10.12.0.0/24
/ip route
add distance=1 gateway=vpn-ext routing-mark=route-vpn
/ip settings
set rp-filter=noIt just took me a while to wrap my head around this