It has been added since 7.22, not 7.23
.
To know what those new actions under /routing rule are, you can first read the current documentation on routing table lookup:
policy-rules: mangle vrf-lookup vrf-unreach local user main
- process policy routing rules (lookup routing-marks set by ip/firewall/mangle, If lookup fails move to the next rule).
- check that the packet has to be resolved in a VRF other than "main", and try to resolve it, return "network unreachable" if cannot be resolved here
- check that the packet has to be locally delivered, the destination address is the address of the router from the "main" VRF
- process implicit policy routing rules (any user defined rules by default is added in "user" chain)
- process implicit catch-all rule that looks up the destination in the ''main'' routing table
- the returned result is "network unreachable"
The default order for routing lookup described there is not new, and has been like that since early 7.x versions. For example, when you had mangle mark-routing rules, then those normally overrides the rules you added under /routing rule. Or when you have a packet modified by mangle mark-routing, then if that packet has one of the router's IP addresses as destination, then the router will not be able to receive that packet on the input chain anymore (because local lookup by default is placed lower than mangle).
That was the default behavior, and until 7.22 you could not change that, for example you could not give firewall mangle rules lower priority than the rules under /routing rule.
With 7.22 MikroTik wanted to change that and allow the user to modify the lookup order. This was however their first implementation (I am linking at an older version of the documentation):
IP Routing - RouterOS - MikroTik Documentation
In those beta versions of 7.22, the way the router exposes the lookup order, as well as allowing you to move the order around, was implemented by having built-in rules under /routing rule:
[admin@CCR2004_2S+_107] /routing/rule> print Flags: X - DISABLED, I - INACTIVE; * - DEFAULT 0 * action=mangle 1 * action=lookup vrf 2 * action=unreachable vrf 3 * action=lookup table=local 4 * action=lookup table=main
- process policy routing rules (lookup routing-marks set by ip/firewall/mangle, If lookup fails move to the next rule).
- check that the packet has to be resolved in a VRF other than "main", and try to resolve it, return "network unreachable" if cannot be resloved here (rules 1,2)
- check that the packet has to be locally delivered, the destination address is the address of the router from the "main" VRF (rule 3)
- process implicit policy routing rules (any user defined rules typically should be added between rule 3 and rule 4 )
- process implicit catch-all rule that looks up the destination in the ''main'' routing table (rule 4)
- the returned result is "network unreachable"
Thus, new action was defined. As you can see the rule with action=mangle is the one responsible for checking the routing mark on the packet, and if present and valid, the routing lookup will be performed on the referenced routing table, and the other routing rules below are skipped.
Similarly, the vrf flag was added, so that the 2nd and 3rd default step of the routing lookup can be represented. The new local table is also added, that contains only routes with the router's IP addresses as destination.
It was then intended, that any custom routing rules that the user previously wanted to add to /routing rule, should be inserted between the rule #3 and #4 to keep the same behavior of previous version <= 7.21.
But soon it could be seen that the approach was causing quite a few problems, with export & import, as well as with the normal workflow of adding new routing rules (the user must be aware that their rules have to be inserted at specific location between built-in rules). That's why in the later RC version (rc3) the approach was abandoned, and the new property /routing rule policy-rules is introduced, that specifies a list of "chains", and the item under /routing rule can now also specify the chain they belong to.
The built-in routing rules from the beta are now hidden. But you can imagine that there is now an invisible rule with action=mangle chain=mangle, an invisible rule with action=lookup vrf chain=vrf-lookup, one with action=unreachable vrf chain=vrf-unreach, one with action=lookup table=local chain=local, and finally one with action=lookup table=main chain=main.
Combined with the fact that routing rules added by user without specifying the chain are automatically put in the user chain, the default routing lookup behavior that has been there all the time in RouterOS 7 is maintained, with policy-rules=mangle,vrf-lookup,vrf-unreach,local,user,main by default.
But now, since 7.22 the user has the ability to move that default order around (by moving the chain in policy-rules), as well as to add new custom named chains, and insert routing rules at any location between the built-in rules, or even disable those built-in rules (by removing the chain from policy-rules).
And of course, because the new action and flag and local table are still there, you can also duplicate the built-in rule actions if you want, while giving them more matching conditions (like dst-address, src-address, interface).