The default action=mangle routing rule with the id *FFFFFFF9 is where the packets with the routing-mark set are handled. It's not where the firewall mangle rules are executed!
Mangling in the firewall has happened way before that, at box #4 and box #19 of this flowchart. While the routing rule *FFFFFFF9 is part of the routing decision at #11 and #21 (routing rules are also consulted at #16, but at this point the packet has no routing mark yet, so *FFFFFFF9 will not apply there).
-
If the packet has no routing mark, then routing rule
*FFFFFFF9is skipped. -
If it has routing mark (set previously by mangle
action=mark-routingin the firewallpreroutingoroutputchain), but no matching routing table, then it also proceeds to the next routing rule in the table. -
If the routing mark has matching routing table, then the routing table is consulted:
- If no route with matching the destination exists, it also proceeds to the next routing rule, because the
actionhere is onlylookupand notlookup-only-in-table. - If a matching route exists in the routing table matching the routing mark, then that route will be used, and the processing of the routing rules stops here.
- If no route with matching the destination exists, it also proceeds to the next routing rule, because the
You should understand that this is not a new decision. This is what always was happening in RouterOS 7. The implicit routing rules and their order is the reason why having mangle mark-routing rules in the firewall that match allows other routing table to be used, instead of the routes in the main table (because fallback routing rule *FFFFFFFD is below *FFFFFFF9). RouterOS 7.22 only makes those implicit default routing rules visible and allows you to reorder them / to place other rules in between them.
In previous versions without those default rules visible, Entries that you added in /routing rule are inserted between the default rule *FFFFFFFC and *FFFFFFFD.