[root@nethserver ~]# ip ru
0: from all lookup local
999: from all lookup main
10000: from all fwmark 0x10000/0xf0000 lookup IC2
10001: from all fwmark 0x20000/0xf0000 lookup ITC1
20000: from 91.209.1.56 lookup IC2
20000: from 91.209.1.54 lookup ITC1
32765: from all lookup balance
32767: from all lookup default
So we markup all incoming traffic, thus no problem with misrouted traffic is observed.