I have a Mikrotik CCR firewall connected to two ISPs on ether[7|8] with an internal network on ether1.
I have a default route via ether8. I mark packets from a specific source IP address with a pre-routing identifier and then have an alternate default route matching the identifier via ether7. The specific source IP address belongs to a web proxy.
If a client machine uses the web proxy their web traffic goes via the ISP on ether7. This works fine.
If I connect to the web proxy via SSH, my connection works.
If I ping (ICMP echo request) the firewall from the web proxy, I do not get a reply. This is because the echo reply is routed out of ether7 instead of ether1. If I add a route to the internal network with the pre-routing identifier, the echo reply is routed correctly.
My question is: why is the ICMP echo reply routed differently to the SSH connection?
It would be very helpful if someone could point me to a detailed explanation of pre-routing marks as I think I have not got a proper understanding.
Thanks in advance!