/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address-list=BlackList new-connection-mark=conn_isp_openvpn