Okay one thing you do is mix bridge and vlans. Once I implement vlans, I dont use the bridge for anything but bridging, all DHCP etc is consistently done via vlans.
SO replacing bridge traffic with vlanEATON LOL.
Why are you using capsman its like half your config and not required. Why make life so complex ??
Its not clear what the heck you are doing with vlans in the RB4011, as has been noted none are assigned…
NO /interface bridge vlan settings AND vlan filtering not even turned on as part of the bridge configuration.
SO personally I dont see how your config is working at all.
It looks like most ports are connected to smart devices (switches and AP) so all trunk ports!
The only ports not being used looks like ether2,3??
You can get rid of this default dns setting that hides well.
/ip dns static
add address=192.168.60.1 comment=defconf name=router.lan
Firewall rules are not organized as chains are split apart and the order of rules is WHACK.
I also dont understand why you want the IOT network to have full ACCESS to the eaton/home/trusted subnet??
The IOT devices security wise should not be able to initiate connections to trusted users ???
I can see wanting the home users having access to IOT device but not the reverse…
If you still do, then ask yourself the question, why have two separate subnets then??
Then you have a bunch of rules equally confusing, that are disabled.
Followed by two more rules that have the same ridonkulous patter, have one set of addresses have full access to another set of addresses followed by the reverse
In other words, there is no point in having separate addresses they should be all one subnet LOL.
Also have a bunch of firewall address lists defined and not used???
Below find that I have made an assumption.
That the trusted network should have access to all other networks
That all networks need WAN access.
DONE.
If you have other requirements you should articulate them, prior to config time, vice the spaghetti mess you were concocting. 
Think of firewalls as a one way street. If users on subnet A, require access to subnet B, then all you need is one direction rule.
(return traffic will be allowed as its return traffic not traffic originated by users on subnet B)
So get rid of all your firewall address lists for now, much tidier…
In general use interface lists for whole subnets, and firewall address for groups of user, less than a subnet or from various subnets or any combination that includes those PLUS a whole subnet.
As for as masquerade rules, not sure about hotspot so left that there as is, plus the default rule, what you were doing with vlanEaton (old bridge) partial subnet , I dont know>?
KEY POINT: all smart devices ( other end of trunk port ) gets an IP from the trusted vlan vlanEaton, 192.168.60.0/0 subnet!
(noise left out just major changes indicated)
# model = RB4011iGS+
/interface bridge
add admin-mac=B8:69:F4:88:0E:03 arp=proxy-arp auto-mac=no comment=defconf
name=bridge vlan-filtering=yes ( as your last step ))
/interface ethernet
set [ find default-name=ether1 ] comment=“Connection to AT&T”
set [ find default-name=ether2 ] comment=‘to machine’
set [ find default-name=ether3 ] comment=spare
set [ find default-name=ether4 ] comment=“Master Bedroom Switch”
set [ find default-name=ether5 ] comment=“Basement Switch”
set [ find default-name=ether6 ] comment=NAS
set [ find default-name=ether7 ] comment=“Dave Office Switch”
set [ find default-name=ether8 ] comment=“Dining Room AP (POE)”
set [ find default-name=ether9 ] comment=
“hAP Switch w/ VLAN to Home Assistant”
set [ find default-name=ether10 ] comment=“Family Room Switch (POE)”
set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no comment=
“T-Mobile HotSpot” speed=1Gbps
/interface vlan
add interface=bridge name=“VLAN Guest” vlan-id=10
add interface=bridge name=“VLAN HotSpot” vlan-id=20
add interface=bridge name=“VLAN IOT” vlan-id=30
add interface=bridge name=“vlanEaton” vlan-id=60
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=MANAGE
/ip dhcp-server
add address-pool=“dhcp Eaton” interface=vlanEaton lease-time=3d name=
“DHCP Eaton”
add address-pool=“pool Guest” interface=“VLAN Guest” lease-time=1d10m name=
“DHCP Guest”
add address-pool=“pool HotSpot” interface=“VLAN HotSpot” lease-time=1h10m
name=“DHCP Hotspot”
add address-pool=“pool IOT” interface=“VLAN IOT” lease-time=3d name=
“DHCP IOT”
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=yes frame-types=admit-priority-and-untagged interface=ether2 pvid=30 { to machine })
add bridge=bridge comment=defconf ingress-filtering=yes frame-types=admit-priority-and-untagged interface=ether3 pvid=60 {spare home port}
add bridge=bridge comment=defconf ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether4 {trunk}
add bridge=bridge comment=defconf ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether5 {trunk}
add bridge=bridge comment=defconf ingress-filtering=yes frame-types=admit-priority-and-untagged interface=ether6 pvid=60 { NAS }
add bridge=bridge comment=defconf ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether7 {trunk}
add bridge=bridge comment=defconf ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether8 {trunk}
add bridge=bridge comment=defconf ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether9 {trunk}
add bridge=bridge comment=defconf ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether10 {trunk}
add bridge=bridge comment=defconf ingress-filtering=yes frame-types=admit-priority-and-untagged interface=sfp-sfpplus1 pvid=20
/interface bridge vlans
add bridge=bridge tagged=bridge,ether4,ether5,ether7,ether8,ether9,ether10 untagged=ether3,ether6 vlan-id=60
add bridge=bridge tagged=bridge untagged=ether2 vlan-id=30
add bridge=bridge tagged=bridge,ether4,ether5,ether7,ether8,ether9,ether10 untagged=sfp-sfpplus1 vlan-id=20
add bridge=bridge tagged=bridge,ether4,ether5,ether7,ether8,ether9,ether10 vlan-id=10
/interface list members
add comment=defconf interface=ether1 list=WAN
add comment=defconf interface=vlanEaton list=LAN
add interface=“VLAN Guest” list=LAN
add interface=“VLAN IOT” list=LAN
add interface=“VLAN HotSpot” list=LAN
add interface=vlanEATON list=MANAGE
add interface=wireguard1 list=MANAGE
/ip neighbor discovery-settings
set discover-interface-list=MANAGE
/ip address
add address=192.168.60.1/24 comment=defconf interface=vlanEaton network=
192.168.60.0
add address=172.16.0.1/24 interface=“VLAN Guest” network=172.16.0.0
add address=10.10.1.1/24 interface=“VLAN IOT” network=10.10.1.0
add address=10.10.0.1/24 interface=“VLAN HotSpot” network=10.10.0.0
add address=172.22.0.1/24 comment=WireGuard interface=wireguard1 network=
172.22.0.0
/ip firewall address
add ip-address=192.168.60.XX list=AdminAccess { admin desktop }
add ip-address=192.168.60.RT list=AdminAccess { admin laptop }
add ip-address=192.168.60.XX list=AdminAccess { admin iphone/ipad}
add ip-address=172.22.0.3 list=AdminAccess { admin laptop remote }
add ip-address=172.22.0.Y list=AdminAccess { admin iphone/ipad remote }
/ip firewall
{INPUT Chain}
(default rules)
add action=accept chain=input comment=“defconf: accept established,related”
connection-state=established,related
add action=drop chain=input comment=“defconf: drop invalid”
connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
(admin rules)
add action=accept chain=input comment=WireGuard dst-port=13231 protocol=udp
add action=acept chain=input in-interface-list=MANAGE src-address-list=AdminAccess
add action=accept chain=input in-interface-list=LAN dst-port=53,123 protocol=udp {dns and ntp services rule}
add action=accept chain=input in-interface-list=LAN dst-port=53 protocol=tcp {dns services rule}
add action=drop chain=input comment=“drop all else”
{FORWARD Chain}
(default rules)
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment=“defconf: accept established,related,untracked”
connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
(admin rules)
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“Trusted to all subnets” in-interface=vlanEaton
out-interface-list=LAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat {disable or remove if not required}
add action=drop chain=forward comment=“drop all else”
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
out-interface-list=WAN
add action=masquerade chain=srcnat comment=“masquerade hotspot network”
src-address=10.10.0.0/24
/system ntp client servers
add address=0.north-america.pool.ntp.org
add address=1.north-america.pool.ntp.org
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=MANAGE