Few things to try: 1. to do nslookup to www.google.com from the client connect to the AP in vlan40 2. "put [resolve www.google.com]" from your workshop rb4011 terminal, to check whether your the mikrotik is able to resolve name 3. I saw your bridge have not enabled the vlan-filtering yet (...