CAPsMAN and several WLANs

Please, help!

I have 2011UiAS as CAPsMAN and it’s not LAN gateway.
I have configured two wireless networks, two bridges, one for private use and second say for “guests”.
“Private” bridge contains LAN interface and CAPs interfaces.
“Guests” bridge contains only CAPs interfaces added by slave configuration from provisioning.
Private WLAN goes fine.
For “guests” WLAN I’ve configured address pool, DHCP server and bind it to bridge, assigned IP-address from pool to the bridge.
Clients of Guest WLAN connecting and receiving addresses, but can’t access Internet or anything else.

What do I miss? Some routes, some firewall rules or some else?
When Mikrotik device acts as LAN gateway to Internet all goes fine without any additional configuration.
I’ve completely broke my brain! Please, help me…