# Fix: office → IP publik 117.102.73.x (hairpin gisportal) tidak boleh kena PCC
# DNS *.gisportal.id resolve ke 117.102.73.102 — tanpa bypass, PCC mark
# memaksa traffic ke gateway WAN, bukan dst-nat ke 10.100.1.24
# Import: /import file=hybrid-fix-hairpin.rsc

/ip firewall mangle remove [find comment="hybrid office hairpin bypass"]
/ip firewall mangle add chain=prerouting action=accept dst-address=117.102.73.96/29 in-interface=office comment="hybrid office hairpin bypass" place-before=[find comment="hybrid office PCC ISP1"]