I have an outgoing IPsec packet, first it goes thru FORWARD chain, and gets a packet mark, so my global Queue can process this packet, then it goes thru nat, to match IPsec policy, and then packet leaves via IPsec connection (port 4500).
The problem is, in RoS 6 packet mark got stripped on encapsulation, and packet leaves IPsec connection without any mark, same goes for wireguard.
But in RoS 7 I have to manually remove packet mark with OUTPUT chain, to prevent IPsec packets double queuing.
What am I doing wrong? Is it Intended >.>