Hmm, something is wrong.
It says i cannot choose ether2 because it is a slave port.
I think i will hire an ITguy to do this for me! 
I think i should have bought a firewall like a FortiGate or something. Because having two routers will always be a madness.
The only reason there are issues we cannot resolve, is because you are a stubborn goat that refuses
to post your config. 
/export hide-sensitive file=anynameyouwish
With that info, it should be clear what needs modifying.
Ahahah, stubborn goat. I liked that.
Can i change my username to that?
No, i am really lost. I am new in this world.
I will run that command and post that here.
In winbox just go to the CLI interface and type it in.
Then go to the files menu and located it and upload/save it to your desktop.
I typically open them using notepad++ and then copy and paste it here and use the code tags to shorten it (black square with white square brackets (parenthesis)
I am using the webapps WebFig and Terminal.
I removed the out-interface from the rule before exporting this.
And i connected my desktop directly to the MikroTik to access it through 192.168.88.1. Because it has been very unreliable in my network, i cannot connect to it through the LANIP (192.168.1.112), i don’t know why.
Here it is:
/interface bridge
add admin-mac=XXXXXXXXXXX auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=\
192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=192.168.1.111 list=deny_internet
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward src-address-list=deny_internet
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/system clock
set time-zone-name=XXXXXXXXXXXXXXXXXXX
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
I want to use the MikroTik with PoE from my Switch.
So, my ISP modem will be connected in ether2.
Should i change the WAN interface, in interface list, to ether2? It is in ether1 ATM.
I want my LAN like this:
ISP router ether2 ⟷ MikroTik ether2
MikroTik ether1 ⟷ Switch vlan1
Switch vlan1 with desktops, laptops, tvs, etc
Switch vlan2 with CCTV, completely isolated from everything. The only access in or out to vlan2 must be through a VPN. I prefer OpenVPN, if possible.
These two vlans are already created in my switch.
Now i need to create them in the MikroTik.
In that file i denied internet to 192.168.1.111 just to test. But i want to deny it to the entire vlan2 (192.168.2.0-192.168.2.999).
Had my BD party tonight turning 60, so not in any shape to answer coherently LOL.
Tomorrow will be a new day!!
Thanks in advance.
And Happy Birthday 
Thanks, went rowing this morning, 9.6km, at 6am, slightly hung over and it was only 4 degrees!!!
First error noted.
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=
192.168.88.0
Should be…
Think about it.
Dont look at the next line..
okay
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
Yes you can block a vlan with a forward rule a few ways
(1) in-interface=vlan2
(2) source-address=subnet of vlan
(3) source-address-list=(Define the subnet in the ip firewall address list).
However, I am not educated enough to know how this will affect your attempt to funnel vlan2 to a VPN connection.
I am assuming you want to be able to VPN in from the outside to view your cameras??
For vlans use this guide as the best reference.
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
What I would do is create a VLAN for your home network vlan10
VLAN2
and any other vlan you want to create ie wifi for guests.
That way the bridge doesnt go any dhcp crap etc, it is just a bridge!
Ok, done it through WebFig in /ip addresses panel. What will this do?
Also there the LANIP of the MikroTik (192.168.1.112/24) is in ether1 interface, but i still cant access the MikroTik through its LANIP, only connected directly through default IP.
Also, should i remove ether2 from bridge and add ether1? My WAN port will be ether2.
You had the bridge giving out dhcp to all the LAN interfaces but then you assigned the IP address of the LAN network to ether 2, when it should be the dhcp authority which is the bridge.
That is the reason for the change.
Yes, if ether 2 is the wan port then remove it from the bridge and add ether1 to the bridge.
Next step will be to create vlans.
Just to be clear,
the WANIP of the mikrotik is 192.168.88.112 ???
the lanip of the mikrotik on the LAN network of the ISP Modem/Router is 192.168.88.112 ???
The problem here is it seems you have the same network on both routers.
Suggest if the modem router is using 192.168.88.x, you should change this, or change the Mikrotik to another subnet.
Since you will be using vlans, it may easiest not to adjust the modem/router IP structure.
vlan-10 = 192.168.10.x home lan
vlan-2 = 192.168.2.x cctv
vlan-20 = 192.168.20.x guest wifi
No, at this moment is like this:
Modem/router: 192.168.1.xxx
MikroTik: 192.168.88.xxx
MikroTik own IP: 192.168.88.1
MikroTik WANIP: 192.168.1.112
Gateway: 192.168.1.254
But i cant access the MikroTik through 192.168.1.112 Don’t know why.
Your config does not reflect ANY 192.168.1.X subnet on your mikrotik router?
All the subnet lanips on the router should be 192.168.88.x
Furthermore it is insanity to try and have the same subnet structure on ones LAN that is the same as the WAN structure.
They are different. It was a typo in my post, sorry.
MikroTik is 88, Modem is 1.
I did another reset to the MikroTik.
Now, it says it is in Bridge Mode managed by CAPsMAN. No rules in the Firewall and the WANIP 192.168.1.112 WORKS!