MikroTik RouterOS v2.9 Reference Manual page 448

upload to the Server and Workstation.
When using masquerading, you have to mark the outgoing connection with new-connection-mark
and take the mark-connection action. When it is done, you can mark all packets which belong to
this connection with the new-packet-mark and use the mark-packet action.
1. At first, mark the Server's download and upload traffic. With the first rule we will mark the
outgoing connection and with the second one, all packets, which belong to this connection:
[admin@MikroTik] ip firewall mangle> add src-address=192.168.0.1/32 \
\... action=mark-connection new-connection-mark=server-con chain=prerouting
[admin@MikroTik] ip firewall mangle> add connection-mark=server-con \
\... action=mark-packet new-packet-mark=server chain=prerouting
[admin@MikroTik] ip firewall mangle> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=prerouting src-address=192.168.0.1 action=mark-connection
new-connection-mark=server-con
1 chain=prerouting connection-mark=server-con action=mark-packet
new-packet-mark=server
[admin@MikroTik] ip firewall mangle>
2. The same for Laptop and Workstation:
[admin@MikroTik] ip firewall mangle> add src-address=192.168.0.2 \
Page 434 of 695
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.