Another option:
Make backup and full export (so you know what you had and can easily return to it if you don't like what the generator creates).
Use the tool from this thread (that I just saw) and generate your config.
Clear the config, then paste in the generated config.
I just tried it out. Couldn't add another reply, so appending it here.
Just testing out the config generator.
These were inputs
And the generated config:
Generated RB4011 Office with Vlan config
# MikroTik RouterOS v7 configuration
# Device: RB4011iGS+RM (RB4011iGS+RM)
# Role: Office router with VLANs
# Created: 2026-08-24 01:46 UTC with the eXtreme Hosting MikroTik Configurator
# https://extremehosting.nl/configurator/en/mikrotik/
# Syntax: https://manual.mikrotik.com/docs/introduction
#
# Apply on a device WITHOUT configuration (/system reset-configuration no-defaults=yes skip-backup=yes),
# with Safe Mode active (Ctrl+X in the terminal). Review every line before pasting.
/interface bridge
add name=bridge protocol-mode=rstp comment="genconf"
/interface vlan
add name=vlan42 vlan-id=42 interface=bridge comment="management"
add name=vlan70_seedplant vlan-id=70 interface=bridge
add name=vlan80_office vlan-id=80 interface=bridge
add name=vlan90_residence vlan-id=90 interface=bridge
/interface list
add name=WAN comment="genconf"
add name=LAN comment="genconf"
/interface list member
add list=WAN interface=ether1 comment="genconf"
add list=LAN interface=bridge comment="genconf"
add list=LAN interface=vlan42 comment="genconf"
add list=LAN interface=vlan70_seedplant comment="genconf"
add list=LAN interface=vlan80_office comment="genconf"
add list=LAN interface=vlan90_residence comment="genconf"
/interface bridge port
add bridge=bridge interface=ether2 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether3 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether4 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether5 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether6 comment="genconf" frame-types=admit-only-vlan-tagged ingress-filtering=yes
add bridge=bridge interface=ether7 comment="genconf" pvid=80 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether8 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether9 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=ether10 comment="genconf" pvid=42 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes
add bridge=bridge interface=sfp-sfpplus1 comment="genconf" frame-types=admit-only-vlan-tagged ingress-filtering=yes
/interface bridge vlan
add bridge=bridge vlan-ids=42 tagged=bridge untagged=ether2,ether3,ether4,ether5,ether6,ether8,ether9,ether10,sfp-sfpplus1 comment="vlan42"
add bridge=bridge vlan-ids=70 tagged=bridge comment="vlan70_seedplant"
add bridge=bridge vlan-ids=80 tagged=bridge untagged=ether7 comment="vlan80_office"
add bridge=bridge vlan-ids=90 tagged=bridge comment="vlan90_residence"
/interface bridge
set bridge vlan-filtering=yes
/ip pool
add name=pool-vlan70_seedplant ranges=192.168.70.10-192.168.70.254
add name=pool-vlan80_office ranges=192.168.80.10-192.168.80.254
add name=pool-vlan90_residence ranges=192.168.90.10-192.168.90.254
/ip dhcp-server
add name=dhcp-vlan70_seedplant interface=vlan70_seedplant address-pool=pool-vlan70_seedplant lease-time=1d
add name=dhcp-vlan80_office interface=vlan80_office address-pool=pool-vlan80_office lease-time=1d
add name=dhcp-vlan90_residence interface=vlan90_residence address-pool=pool-vlan90_residence lease-time=1d
/ip dhcp-server network
add address=192.168.70.0/24 gateway=192.168.70.1 dns-server=192.168.70.1 comment="vlan70_seedplant"
add address=192.168.80.0/24 gateway=192.168.80.1 dns-server=192.168.80.1 comment="vlan80_office"
add address=192.168.90.0/24 gateway=192.168.90.1 dns-server=192.168.90.1 comment="vlan90_residence"
/ip dhcp-client
add interface=ether1 add-default-route=yes default-route-distance=1 use-peer-dns=yes use-peer-ntp=no comment="WAN1"
/ip address
add address=192.168.42.1/24 interface=vlan42 comment="vlan42"
add address=192.168.70.1/24 interface=vlan70_seedplant comment="vlan70_seedplant"
add address=192.168.80.1/24 interface=vlan80_office comment="vlan80_office"
add address=192.168.90.1/24 interface=vlan90_residence comment="vlan90_residence"
/ipv6 settings
set disable-ipv6=no accept-router-advertisements=no
/ipv6 dhcp-client
add interface=ether1 request=prefix pool-name=ipv6-pool pool-prefix-length=64 prefix-hint=::/56 add-default-route=yes use-peer-dns=no comment="IPv6 prefix delegation"
/ipv6 address
add address=::1/64 from-pool=ipv6-pool interface=bridge advertise=yes comment="bridge"
add address=::1/64 from-pool=ipv6-pool interface=vlan42 advertise=yes comment="vlan42"
add address=::1/64 from-pool=ipv6-pool interface=vlan70_seedplant advertise=yes comment="vlan70_seedplant"
add address=::1/64 from-pool=ipv6-pool interface=vlan80_office advertise=yes comment="vlan80_office"
add address=::1/64 from-pool=ipv6-pool interface=vlan90_residence advertise=yes comment="vlan90_residence"
/ipv6 nd
set [ find default=yes ] interface=all advertise-dns=self managed-address-configuration=no other-configuration=no
/ip dns
set allow-remote-requests=yes cache-size=4096 servers=9.9.9.9,149.112.112.112
/ip firewall address-list
add list=bad_ipv4 address=127.0.0.0/8 comment="genconf: RFC6890"
add list=bad_ipv4 address=192.0.0.0/24 comment="genconf: RFC6890"
add list=bad_ipv4 address=192.0.2.0/24 comment="genconf: RFC6890 documentation"
add list=bad_ipv4 address=198.51.100.0/24 comment="genconf: RFC6890 documentation"
add list=bad_ipv4 address=203.0.113.0/24 comment="genconf: RFC6890 documentation"
add list=bad_ipv4 address=240.0.0.0/4 comment="genconf: RFC6890 reserved"
add list=not_global_ipv4 address=0.0.0.0/8 comment="genconf: RFC6890"
add list=not_global_ipv4 address=10.0.0.0/8 comment="genconf: RFC6890"
add list=not_global_ipv4 address=100.64.0.0/10 comment="genconf: RFC6890"
add list=not_global_ipv4 address=169.254.0.0/16 comment="genconf: RFC6890"
add list=not_global_ipv4 address=172.16.0.0/12 comment="genconf: RFC6890"
add list=not_global_ipv4 address=192.0.0.0/29 comment="genconf: RFC6890"
add list=not_global_ipv4 address=192.168.0.0/16 comment="genconf: RFC6890"
add list=not_global_ipv4 address=198.18.0.0/15 comment="genconf: RFC6890 benchmark"
add list=not_global_ipv4 address=255.255.255.255/32 comment="genconf: RFC6890"
add list=bad_src_ipv4 address=224.0.0.0/4 comment="genconf: multicast"
add list=bad_src_ipv4 address=255.255.255.255/32 comment="genconf: RFC6890"
add list=bad_dst_ipv4 address=0.0.0.0/8 comment="genconf: RFC6890"
add list=bad_dst_ipv4 address=224.0.0.0/4 comment="genconf: RFC6890"
/ip firewall raw
add action=accept chain=prerouting comment="genconf: accept DHCP discover" dst-address=255.255.255.255 dst-port=67 in-interface-list=LAN protocol=udp src-address=0.0.0.0 src-port=68
add action=drop chain=prerouting comment="genconf: drop bogon IP's" src-address-list=bad_ipv4
add action=drop chain=prerouting comment="genconf: drop bogon IP's" dst-address-list=bad_ipv4
add action=drop chain=prerouting comment="genconf: drop bogon IP's" src-address-list=bad_src_ipv4
add action=drop chain=prerouting comment="genconf: drop bogon IP's" dst-address-list=bad_dst_ipv4
add action=drop chain=prerouting comment="genconf: drop non global from WAN" src-address-list=not_global_ipv4 in-interface-list=WAN
add action=drop chain=prerouting comment="genconf: drop bad UDP" port=0 protocol=udp
/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="genconf: accept established,related,untracked"
add chain=input action=drop connection-state=invalid comment="genconf: drop invalid"
add action=drop chain=input comment="Bruteforce: drop blacklisted" protocol=tcp dst-port=22,8291 src-address-list=bruteforce_blacklist
add action=add-src-to-address-list address-list=bruteforce_blacklist address-list-timeout=1d chain=input comment="Blacklist" connection-state=new dst-port=22,8291 protocol=tcp src-address-list=connection3
add action=add-src-to-address-list address-list=connection3 address-list-timeout=1h chain=input comment="Third attempt" connection-state=new dst-port=22,8291 protocol=tcp src-address-list=connection2
add action=add-src-to-address-list address-list=connection2 address-list-timeout=15m chain=input comment="Second attempt" connection-state=new dst-port=22,8291 protocol=tcp src-address-list=connection1
add action=add-src-to-address-list address-list=connection1 address-list-timeout=5m chain=input comment="First attempt" connection-state=new dst-port=22,8291 protocol=tcp
add chain=input action=accept protocol=icmp comment="genconf: accept ICMP"
add chain=input action=accept dst-address=127.0.0.1 comment="genconf: accept to local loopback (for CAPsMAN)"
add chain=input action=drop protocol=udp dst-port=53 in-interface-list=WAN comment="drop DNS from WAN (no open resolver)"
add chain=input action=drop protocol=tcp dst-port=53 in-interface-list=WAN comment="drop DNS from WAN (no open resolver)"
add chain=input action=drop in-interface-list=!LAN comment="genconf: drop all not coming from LAN"
add chain=forward action=accept ipsec-policy=in,ipsec comment="genconf: accept in ipsec policy"
add chain=forward action=accept ipsec-policy=out,ipsec comment="genconf: accept out ipsec policy"
add chain=forward action=fasttrack-connection connection-state=established,related hw-offload=yes comment="genconf: fasttrack"
add chain=forward action=accept connection-state=established,related,untracked comment="genconf: accept established,related, untracked"
add chain=forward action=drop connection-state=invalid comment="genconf: drop invalid"
add chain=forward action=drop in-interface=vlan42 out-interface-list=WAN comment="vlan42: no internet"
add chain=forward action=drop in-interface=vlan70_seedplant out-interface-list=!WAN connection-state=new comment="isolate vlan70_seedplant: internet only"
add chain=forward action=drop in-interface=vlan80_office out-interface-list=!WAN connection-state=new comment="isolate vlan80_office: internet only"
add chain=forward action=drop in-interface=vlan90_residence out-interface-list=!WAN connection-state=new comment="isolate vlan90_residence: internet only"
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="genconf: drop all from WAN not DSTNATed"
/ip firewall nat
add chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none comment="genconf: masquerade"
/ipv6 firewall address-list
add list=bad_ipv6 address=::/128 comment="genconf: unspecified address"
add list=bad_ipv6 address=::1/128 comment="genconf: lo"
add list=bad_ipv6 address=fec0::/10 comment="genconf: site-local"
add list=bad_ipv6 address=::ffff:0.0.0.0/96 comment="genconf: ipv4-mapped"
add list=bad_ipv6 address=::/96 comment="genconf: ipv4 compat"
add list=bad_ipv6 address=100::/64 comment="genconf: discard only"
add list=bad_ipv6 address=2001:db8::/32 comment="genconf: documentation"
add list=bad_ipv6 address=2001:10::/28 comment="genconf: ORCHID"
add list=bad_ipv6 address=3ffe::/16 comment="genconf: 6bone"
/ipv6 firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="genconf: accept established,related,untracked"
add chain=input action=drop connection-state=invalid comment="genconf: drop invalid"
add chain=input action=accept protocol=icmpv6 comment="genconf: accept ICMPv6"
add chain=input action=accept protocol=udp port=33434-33534 comment="genconf: accept UDP traceroute"
add chain=input action=accept protocol=udp dst-port=546 src-address=fe80::/10 comment="genconf: accept DHCPv6-Client prefix delegation."
add chain=input action=accept protocol=udp dst-port=500,4500 comment="genconf: accept IKE"
add chain=input action=accept protocol=ipsec-ah comment="genconf: accept ipsec AH"
add chain=input action=accept protocol=ipsec-esp comment="genconf: accept ipsec ESP"
add chain=input action=accept ipsec-policy=in,ipsec comment="genconf: accept all that matches ipsec policy"
add chain=input action=drop in-interface-list=!LAN comment="genconf: drop everything else not coming from LAN"
add chain=forward action=accept connection-state=established,related,untracked comment="genconf: accept established,related,untracked"
add chain=forward action=drop connection-state=invalid comment="genconf: drop invalid"
add chain=forward action=drop src-address-list=bad_ipv6 comment="genconf: drop packets with bad src ipv6"
add chain=forward action=drop dst-address-list=bad_ipv6 comment="genconf: drop packets with bad dst ipv6"
add chain=forward action=drop protocol=icmpv6 hop-limit=equal:1 comment="genconf: rfc4890 drop hop-limit=1"
add chain=forward action=accept protocol=icmpv6 comment="genconf: accept ICMPv6"
add chain=forward action=accept protocol=139 comment="genconf: accept HIP"
add chain=forward action=accept protocol=udp dst-port=500,4500 comment="genconf: accept IKE"
add chain=forward action=accept protocol=ipsec-ah comment="genconf: accept ipsec AH"
add chain=forward action=accept protocol=ipsec-esp comment="genconf: accept ipsec ESP"
add chain=forward action=accept ipsec-policy=in,ipsec comment="genconf: accept all that matches ipsec policy"
add chain=forward action=drop in-interface=vlan70_seedplant out-interface-list=!WAN comment="isolate vlan70_seedplant (IPv6)"
add chain=forward action=drop in-interface=vlan80_office out-interface-list=!WAN comment="isolate vlan80_office (IPv6)"
add chain=forward action=drop in-interface=vlan90_residence out-interface-list=!WAN comment="isolate vlan90_residence (IPv6)"
add chain=forward action=drop in-interface-list=!LAN comment="genconf: drop everything else not coming from LAN"
/system clock
set time-zone-name=Europe/Amsterdam time-zone-autodetect=no
/system ntp client
set enabled=yes mode=unicast servers=nl.pool.ntp.org,time.cloudflare.com
/system package update
set channel=stable
/system routerboard settings
set auto-upgrade=yes
/ip service
set winbox disabled=no address=192.168.42.0/24
set ssh disabled=no address=192.168.42.0/24
set www disabled=yes
set www-ssl disabled=yes
set api disabled=yes
set api-ssl disabled=yes
set ftp disabled=yes
set telnet disabled=yes
/ip ssh
set strong-crypto=yes
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool mac-server ping
set enabled=no
/ip neighbor discovery-settings
set discover-interface-list=LAN
/tool bandwidth-server
set enabled=no
/system identity
set name=RB4011iGS-RM
/user
set admin