Unless this router is behind some other firewall you really need more input firewalling!
It is also advisable to use your gateway decision criteria to apply a connection mark to the connection (only once) and
then select on this connection mark to apply the route mark on each packet. That way it is guaranteed that
the route mark cannot change halfway an open connection (which would kill it).
See the examples of load balancing.