Assumptions:
(1) You want two subnets. I will use vlans but you get the idea for a clean config/.
(2) I will assume the AP serves both smart devices and homeusers (on different SSIDs etc, with smartdevices using 2.4ghz and homeusers using 5ghz)
(3) eth4 goes to AP
(4) eth1 goes to WAN
(5) Ether 2,3 go to PCs on home network
(6) Ether 5 goes to a smart device.
Changes and mods to setup below.
Router Setup.
/interface ethernet
set [ find default-name=ether1 ] comment=Port1 name=ISP_eth1 speed=
100Mbps
/interface bridge
add bridge=home-bridge vlan-filtering=yes (the vlan-filtering=yes is last step in config)
/interface vlan
add interface=home-bridge name=Devices-LAN_22 vlan-id=22
add interface=home-bridge name=Home-LAN_11 vlan-id=11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface list member
add interface=Devices-LAN_22 list=LAN
add interface=Home-LAN_11 list=LAN
add interface=ISP_ether1 list=WAN
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip pool
add name=pool-dhcp_devices ranges=192.168.88.100-192.168.88.200
add name=pool-dhcp ranges=192.168.10.100-192.168.10.200
/ip dhcp-server
add address-pool=dhcp_devices disabled=no interface=Devices-LAN_22
add address-pool=dhcp disabled=no interface=Home-LAN_11
/ip address
add address=192.168.88.1/24 comment=“Devices” interface=Devices-LAN_22 network=
192.168.88.0
add address=192.168.88.1/24 comment=“Home users” interface=Home-LAN_11 network=
192.168.88.0
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dhcp-server network
add address=192.168.10.0/24 comment=defconf gateway=192.168.10.1
/interface bridge port
add bridge=home-bridge LAN interface=ether2 pvid=11 frame-types=admit-only-untagged-and-priority-tagged {access port}
add bridge=home-bridge LAN interface=ether3 pvid=11 frame-types=admit-only-untagged-and-priority-tagged {access port}
add bridge=home-bridge LAN interface=ether4 ingress-filtering=yes {trunk port carrying vlans 11,22}
add bridge=home-bridge LAN interface=ether5 pvid=22 frame-types=admit-only-untagged-and-priority-tagged {access port}
/interface bridge vlan
add bridge=home-bridge tagged=homebridge,ether4 untagged=ether2,ether3 vlan-ids=11
add bridge=home-bridge tagged=homebridge,ether4 untagged=ether5 vlan-ids=22
/ip dns
set allow-remote-requests=yes servers=9.9.9.9,1.1.1.1,8.8.8.8
/ip dhcp-client
add add-default-route=yes comment=defconf disabled=no interface=ISP_eth1
use-peer-dns=no use-peer-ntp=no
/ip firewall filter
{input chain}
add action=accept chain=input comment=“defconf: accept established,related”
connection-state=established,related disabled=yes
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” disabled=yes
protocol=icmp
add action=drop chain=input comment=“Default Firewall - drop all not coming from LAN” in-interface-list=!LAN (this replaces the botched rule that blocked all from WAN)
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
out-interface-list=WAN
/ip route
keep default setting established by the default rules when first hooking up to the internet
/tool mac-server
set allowed-interface-list=NONE
You can do this as well by assigning two different subnets one on a bridge and one off a bridge etc…
I prefer vlans for firewall rules and clear separation at layer 2 between subnets regardless of where vlans are located.
They are also much easier to deal with when porting subnets to different devices such as switches and access points.
