CAPsMAN with capsman forwarding + Bridge with VLAN filtering = Capsman Access List (VLAN Mode + VLAN ID) don't work.
aug/12/2020 19:07:48 by RouterOS 6.47.1
software id = DMJ8-492H
model = CCR1036-8G-2S+
serial number = 8A6207540538
/caps-man channel
add band=2ghz-onlyn control-channel-width=20mhz extension-channel=disabled
frequency=2412,2432,2452 name=2.4G_channel reselect-interval=12h
save-selected=no secondary-frequency=disabled skip-dfs-channels=no
tx-power=16
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=Ceee
frequency=5180,5260,5500,5580,5745 name=5G_channel reselect-interval=12h
save-selected=no secondary-frequency=disabled skip-dfs-channels=no
tx-power=20
/interface bridge
add dhcp-snooping=yes frame-types=admit-only-vlan-tagged name=bridge
vlan-filtering=yes
/interface vlan
add interface=bridge name=vlan11-vip vlan-id=11
add interface=bridge name=vlan12-staff vlan-id=12
add interface=bridge name=vlan80-public vlan-id=80
add interface=bridge name=vlan99-manager vlan-id=99
/caps-man security
add authentication-types=wpa2-psk disable-pmkid=yes encryption=aes-ccm
group-encryption=aes-ccm group-key-update=1h name=security-public
passphrase=******
/caps-man datapath
add bridge=bridge client-to-client-forwarding=no interface-list=wifi-public
local-forwarding=no name=datapath-public vlan-id=80 vlan-mode=use-tag
/caps-man configuration
add channel=2.4G_channel country="south africa" datapath=datapath-public
distance=indoors guard-interval=any hw-protection-mode=none installation=
any keepalive-frames=enabled mode=ap multicast-helper=disabled name=
2.4G-public security=security-public ssid=Public
add channel=5G_channel country="south africa" datapath=datapath-public
distance=indoors guard-interval=any hw-protection-mode=none installation=
any keepalive-frames=enabled mode=ap multicast-helper=disabled name=
5G-public security=security-public ssid=Public
/ip pool
add name=dhcp_pool-manager ranges=192.168.99.50-192.168.99.250
add name=dhcp_pool-vip ranges=192.168.11.100-192.168.11.250
add name=dhcp_pool-public ranges=192.168.80.50-192.168.83.250
add name=dhcp_pool-staff ranges=192.168.12.70-192.168.12.250
/ip dhcp-server
add add-arp=yes address-pool=dhcp_pool-manager disabled=no interface=
vlan99-manager lease-time=6h name=dhcp-manager
add add-arp=yes address-pool=dhcp_pool-vip disabled=no interface=vlan11-vip
lease-time=6h name=dhcp-vip
add add-arp=yes address-pool=dhcp_pool-public disabled=no interface=
vlan80-public lease-time=1h name=dhcp-public
add add-arp=yes address-pool=dhcp_pool-staff disabled=no interface=
vlan12-staff lease-time=6h name=dhcp-staff
/caps-man access-list
add action=accept allow-signal-out-of-range=10s comment=My_iPhone_SE
mac-address=90:8C:43:XX:XX:XX ssid-regexp="" vlan-id=11
vlan-mode=use-tag
add action=accept allow-signal-out-of-range=10s comment=My_iPhone_SE
mac-address=90:8C:43:YY:YY:YY ssid-regexp="" vlan-id=12
vlan-mode=use-tag
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=
2.4G-public name-format=identity
add action=create-dynamic-enabled hw-supported-modes=ac master-configuration=
5G-public name-format=identity
/interface bridge port
add bridge=bridge frame-types=admit-only-vlan-tagged interface=sfp+1
add bridge=bridge frame-types=admit-only-vlan-tagged interface=sfp+2
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether1
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether2
add bridge=bridge interface=ether3 pvid=11
add bridge=bridge interface=ether4 pvid=11
add bridge=bridge interface=ether5 pvid=11
add bridge=bridge interface=ether6 pvid=11
add bridge=bridge interface=ether7 pvid=11
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether8
/interface bridge vlan
add bridge=bridge tagged=bridge,sfp+1,sfp+2,ether1,ether2,ether8 vlan-ids=99
add bridge=bridge tagged=bridge,sfp+1,sfp+2,ether1,ether2 vlan-ids=11
add bridge=bridge tagged=bridge,sfp+1,sfp+2 vlan-ids=80
add bridge=bridge tagged=bridge,sfp+1,sfp+2,ether8 vlan-ids=12
/ip address
add address=192.168.99.1/24 interface=vlan99-manager network=192.168.99.0
add address=192.168.11.1/24 interface=vlan11-vip network=192.168.11.0
add address=192.168.80.1/22 interface=vlan80-public network=192.168.80.0
add address=192.168.12.1/24 interface=vlan12-staff network=192.168.12.0
/ip dhcp-server network
add address=192.168.11.0/24 dns-server=192.168.11.1 gateway=192.168.11.1
add address=192.168.12.0/24 dns-server=192.168.12.1 gateway=192.168.12.1
add address=192.168.80.0/22 dns-server=192.168.80.1 gateway=192.168.80.1
add address=192.168.99.0/24 dns-server=192.168.99.1 gateway=192.168.99.1
/ip firewall filter
add action=accept chain=forward connection-state=established,related
add action=accept chain=input connection-state=established,related
add action=drop chain=input in-interface-list=WAN
add action=drop chain=forward in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN