Countless Hours and $500+ on Consultants; Still Can't Get It

helpmytik · June 16, 2026, 5:33pm

I just really don't know what to do at this point. My topology is:

RB5009 edge router

ether1 - WAN
ether2 - down link to CRS312 ether1
ether3 - down link to CRS328 ether1
ether4 - pi-hole
ether5 - home assistant
ether8 - laptop dock

CRS312

ether1 - uplink to rb5009 ether2
ether4 - printer
ether5- nvr
ether7 - nas

CRS328

ether1 - uplink to RB5009 ether3
ether4 - poe cap AX ether1
ether6 - poe cap AX ether1
ether8 - poe cap AX ether1

First consultant got me up and running, but did it the old school way. Vlans on separate interfaces with separate bridges. It works, but now that I added two additional cap AXs to the house, I'm running into problems with the vlan2000 SSIDs losing internet, and I have to restart the ap for it to work.

Config for RB5009 below.

# 2026-06-16 12:25:50 by RouterOS 7.21.4
# software id = C86P-TNCF
#
# model = RB5009UG+S+
# serial number = HJ30A275Y8W
/interface bridge
add name=IOT.BRIDGE
add name=LAB.BRIDGE
add admin-mac=F4:1E:57:C1:68:E7 auto-mac=no name=LOCAL.BRIDGE
add name=MANAGEMENT.BRIDGE
/interface ethernet
set [ find default-name=ether1 ] comment="WAN[ATT]" l2mtu=1514
set [ find default-name=ether2 ] comment=CRS312.NON-POE.SW l2mtu=1514
set [ find default-name=ether3 ] comment=CRS328.POE.SW l2mtu=1514
set [ find default-name=ether4 ] comment=PI-HOLE.RASPI l2mtu=1514
set [ find default-name=ether5 ] comment=HOME.ASSISTANT l2mtu=1514
set [ find default-name=ether6 ] l2mtu=1514
set [ find default-name=ether7 ] l2mtu=1514
set [ find default-name=ether8 ] l2mtu=1514
set [ find default-name=sfp-sfpplus1 ] disabled=yes l2mtu=1514
/interface wireguard
add comment=BTH-VPN listen-port=31135 mtu=1420 name=back-to-home-vpn
/interface vlan
add comment=IOT.VLAN interface=ether2 name=ether2-VLAN2000 vlan-id=2000
add comment=LAB.VLAN interface=ether2 name=ether2-VLAN3000 vlan-id=3000
add comment=MANAGEMENT.VLAN interface=ether2 name=ether2-VLAN4000 vlan-id=4000
add comment=IOT.VLAN interface=ether3 name=ether3-VLAN2000 vlan-id=2000
add comment=LAB.VLAN interface=ether3 name=ether3-VLAN3000 vlan-id=3000
add comment=MANAGEMENT.VLAN interface=ether3 name=ether3-VLAN4000 vlan-id=4000
/interface list
add name=WAN
/interface wifi channel
add band=2ghz-ax disabled=no name=2.4ghz width=20mhz
add band=5ghz-ax disabled=no name=5ghz width=20/40/80mhz
/interface wifi datapath
add bridge=LOCAL.BRIDGE disabled=no name=2.4ghz vlan-id=2000
add bridge=LOCAL.BRIDGE disabled=no name=5ghz vlan-id=2000
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=2.4ghz
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=5ghz
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=ADMIN-SSID
/interface wifi configuration
add channel=2.4ghz disabled=no mode=ap name=2.4ghz security=2.4ghz ssid=2.4ghz
add channel=5ghz disabled=no mode=ap name=5ghz security=5ghz ssid=5ghz
add disabled=no mode=ap name=2.4ghz-ADMIN security=ADMIN-SSID ssid=REDACTED
add disabled=no mode=ap name=5ghz-ADMIN security=ADMIN-SSID ssid=REDACTED
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_pool1 ranges=192.168.100.2-192.168.100.254
add name=dhcp_pool2 ranges=192.168.101.2-192.168.101.254
add name=dhcp_pool3 ranges=192.168.102.2-192.168.102.254
add name=dhcp_pool4 ranges=192.168.103.2-192.168.103.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=LOCAL.BRIDGE name=dhcp1
add address-pool=dhcp_pool2 interface=IOT.BRIDGE name=dhcp2
add address-pool=dhcp_pool3 interface=LAB.BRIDGE name=dhcp3
add address-pool=dhcp_pool4 interface=MANAGEMENT.BRIDGE name=dhcp4
/disk settings
set auto-media-interface=LOCAL.BRIDGE auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=LOCAL.BRIDGE interface=ether2
add bridge=LOCAL.BRIDGE interface=ether3
add bridge=LOCAL.BRIDGE interface=ether4
add bridge=LOCAL.BRIDGE interface=ether5
add bridge=LOCAL.BRIDGE interface=ether6
add bridge=LOCAL.BRIDGE interface=ether7
add bridge=LOCAL.BRIDGE interface=ether8
add bridge=LOCAL.BRIDGE interface=sfp-sfpplus1
add bridge=MANAGEMENT.BRIDGE interface=ether2-VLAN4000
add bridge=IOT.BRIDGE interface=ether3-VLAN2000
add bridge=LAB.BRIDGE interface=ether3-VLAN3000
add bridge=MANAGEMENT.BRIDGE interface=ether3-VLAN4000
add bridge=IOT.BRIDGE interface=ether2-VLAN2000
/ip neighbor discovery-settings
set discover-interface-list=all
/interface list member
add interface=ether1 list=WAN
/interface wifi capsman
set enabled=yes interfaces=MANAGEMENT.BRIDGE
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=2.4ghz-ADMIN slave-configurations=2.4ghz supported-bands=\
    2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=5ghz-ADMIN slave-configurations=5ghz supported-bands=5ghz-ax
/ip address
add address=192.168.100.1/24 comment=LAN.ADMIN interface=LOCAL.BRIDGE network=192.168.100.0
add address=192.168.101.1/24 comment=IOT.GATEWAY interface=IOT.BRIDGE network=192.168.101.0
add address=192.168.102.1/24 comment=LAB.GATEWAY interface=LAB.BRIDGE network=192.168.102.0
add address=192.168.103.1/24 comment=MANAGEMENT.GATEWAY interface=MANAGEMENT.BRIDGE network=192.168.103.0
/ip cloud
set back-to-home-vpn=enabled ddns-enabled=yes ddns-update-interval=10m
/ip cloud back-to-home-user
add allow-lan=yes file-access=full file-access-path="/BTH Files" name=Thinkpad.X1 public-key=\
    "REDACTED"
add allow-lan=yes file-access=full file-access-path="/BTH Files" name=Thinkpad.X1.Linux public-key=\
    "REDACTED"
/ip dhcp-client
add comment=ATT.FIBER.WAN default-route-tables=main interface=ether1 use-peer-dns=no
/ip dhcp-server network
add address=192.168.100.0/24 dns-server=192.168.100.250,1.1.1.1,8.8.8.8 gateway=192.168.100.1
add address=192.168.101.0/24 dns-server=192.168.100.250,1.1.1.1,8.8.8.8 gateway=192.168.101.1
add address=192.168.102.0/24 dns-server=192.168.100.250,1.1.1.1,8.8.8.8 gateway=192.168.102.1
add address=192.168.103.0/24 dns-server=192.168.100.250,1.1.1.1,8.8.8.8 gateway=192.168.103.1
/ip dns
set allow-remote-requests=yes servers=192.168.100.250,1.1.1.1,8.8.8.8
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=192.168.35.0/24 disabled=yes list=management.addresses
add address=192.168.100.0/24 list=management.addresses
add address=192.168.216.0/24 list=management.addresses
/ip firewall filter
add action=accept chain=input comment="Permit: Established, related, and untracked input traffic." connection-state=\
    established,related,untracked
add action=drop chain=input comment="Drop: Invalid input traffic." connection-state=invalid
add action=accept chain=input comment="Permit: ICMP input traffic." protocol=icmp
add action=accept chain=input comment="Permit: BGP input traffic." dst-port=179 protocol=tcp
add action=accept chain=input comment="Permit: OSPF input traffic from list backbone.interfaces." in-interface-list=WAN \
    protocol=ospf
add action=accept chain=input comment="Permit: Input traffic from list management.addresses" src-address-list=\
    management.addresses
add action=accept chain=input comment="Permit: BFD input traffic from backbone.interfaces." dst-port=3784 in-interface-list=WAN \
    protocol=udp
add action=accept chain=input comment="Permit: Bandwidth test server input traffic." dst-port=2000 protocol=tcp
add action=drop chain=input comment="Drop: All other input traffic."
add action=accept chain=forward comment="ACCEPT: ESTABLISHED AND RELATED" connection-state=established,related
add action=accept chain=forward comment="ACCEPT: ADMIN TO SUBNETS" disabled=yes src-address-list=management.addresses
add action=accept chain=forward comment="ACCEPT: OUT TO PIHOLE" dst-address=192.168.100.250
add action=accept chain=forward comment="ACCEPT: ADMIN TO IOT" dst-address=192.168.101.0/24 src-address=192.168.100.0/24
add action=accept chain=forward comment="ACCEPT: MGMT VLAN TO IOT" dst-address=192.168.101.0/24 src-address=192.168.103.0/24
add action=accept chain=forward comment="ACCEPT: ADMIN TO LAB" dst-address=192.168.102.0/24 src-address=192.168.100.0/24
add action=accept chain=forward comment="ACCEPT: MGMT VLAN TO LAB" dst-address=192.168.102.0/24 src-address=192.168.103.0/24
add action=accept chain=forward comment="ACCEPT: OUT TOWARDS INTERNET" out-interface-list=WAN
add action=drop chain=forward comment="DROP: IOT TO ADMIN" dst-address=192.168.100.0/24 src-address=192.168.101.0/24
add action=drop chain=forward comment="DROP: IOT TO MGMT VLAN" dst-address=192.168.103.0/24 src-address=192.168.101.0/24
add action=drop chain=forward comment="DROP: IOT TO LAB" dst-address=192.168.102.0/24 src-address=192.168.101.0/24
add action=drop chain=forward comment="DROP: EVERYTHING ELSE"
/ip firewall nat
add action=masquerade chain=srcnat comment="GENERAL INTERNET MASQ" out-interface=ether1
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=\
    fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!*2000011
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!*2000011
/system clock
set time-zone-name=America/Chicago
/system identity
set name=EDGE.RTR
/system package update
set channel=long-term
/tool mac-server
set allowed-interface-list=*2000011
/tool mac-server mac-winbox
set allowed-interface-list=*2000011
/tool romon
set enabled=yes

cap AX config (I added reboots to fix the dropping issue for now)

# 2026-06-16 12:27:17 by RouterOS 7.21.4
# software id = G20U-MQYJ
#
# model = cAPGi-5HaxD2HaxD
# serial number = HGZ0ABNW12N
/interface bridge
add name=LOCAL.BRIDGE vlan-filtering=yes
/interface wifi
# managed by CAPsMAN F4:1E:57:C1:68:E7%LOCAL.BRIDGE-VLAN4000, traffic processing on CAP
# mode: AP, SSID: REDACTED, channel: 5885/ax/eeeC
set [ find default-name=wifi1 ] configuration.manager=capsman .mode=ap disabled=no \
    security.authentication-types="" .ft=yes
# managed by CAPsMAN F4:1E:57:C1:68:E7%LOCAL.BRIDGE-VLAN4000, traffic processing on CAP
# mode: AP, SSID: REDACTED, channel: 2462/ax/eC
set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap disabled=no \
    security.authentication-types="" .ft=yes
/interface vlan
add interface=LOCAL.BRIDGE name=LOCAL.BRIDGE-VLAN4000 vlan-id=4000
/interface ethernet switch
set 0 cpu-flow-control=yes
/interface bridge port
add bridge=LOCAL.BRIDGE interface=wifi2
add bridge=LOCAL.BRIDGE interface=wifi1
add bridge=LOCAL.BRIDGE interface=ether2
add bridge=LOCAL.BRIDGE interface=ether1
add bridge=LOCAL.BRIDGE interface=wifi3 pvid=2000
add bridge=LOCAL.BRIDGE interface=wifi4 pvid=2000
/interface bridge vlan
add bridge=LOCAL.BRIDGE tagged=LOCAL.BRIDGE,ether1 vlan-ids=4000
add bridge=LOCAL.BRIDGE tagged=LOCAL.BRIDGE,ether1 untagged=wifi3,wifi4 vlan-ids=2000
/interface wifi cap
set discovery-interfaces=LOCAL.BRIDGE-VLAN4000 enabled=yes
/ip dhcp-client
add default-route-tables=main interface=LOCAL.BRIDGE-VLAN4000 use-peer-dns=no
/ip dns
set servers=1.1.1.1,8.8.8.8
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=America/Chicago
/system identity
set name="cAP 1"
/system package update
set channel=long-term
/system scheduler
add interval=1d name=reboot-caps on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=2026-06-14 \
    start-time=04:00:00
add interval=2h name=auto-reboot on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup
/tool romon
set enabled=yes

I had a second consultant write a new config using current vlan best practices on a single bridge, and regardless if I start from a default config or a totally blank slate with no config, it doesn't work. I either lose internet, lose access to winbox, or both.

RB5009 config2 below

/interface bridge
add name=LOCAL.BRIDGE vlan-filtering=no

/interface vlan
add interface=LOCAL.BRIDGE name=VLAN2000-IOT vlan-id=2000
add interface=LOCAL.BRIDGE name=VLAN3000-GUEST vlan-id=3000
add interface=LOCAL.BRIDGE name=VLAN4000-MGMT vlan-id=4000

/interface list
add name=WAN
add name=LAN
add name=ISOLATED_VLANS
add name=MGMT
add name=PIHOLE_ACCESS

/interface list member
add interface=ether1 list=WAN
add interface=LOCAL.BRIDGE list=LAN
add interface=LOCAL.BRIDGE list=PIHOLE_ACCESS
add interface=VLAN2000-IOT list=ISOLATED_VLANS
add interface=VLAN2000-IOT list=PIHOLE_ACCESS
add interface=VLAN3000-GUEST list=ISOLATED_VLANS
add interface=VLAN4000-MGMT list=MGMT
add interface=VLAN4000-MGMT list=PIHOLE_ACCESS

/ip address
add address=192.168.10.1/24 interface=LOCAL.BRIDGE network=192.168.10.0
add address=192.168.20.1/24 interface=VLAN2000-IOT network=192.168.20.0
add address=192.168.30.1/24 interface=VLAN3000-GUEST network=192.168.30.0
add address=192.168.40.1/24 interface=VLAN4000-MGMT network=192.168.40.0

/ip pool
add name=POOL-TRUSTED ranges=192.168.10.100-192.168.10.200
add name=POOL-IOT ranges=192.168.20.100-192.168.20.200
add name=POOL-GUEST ranges=192.168.30.100-192.168.30.200
add name=POOL-MGMT ranges=192.168.40.100-192.168.40.240

/ip dhcp-server
add address-pool=POOL-TRUSTED interface=LOCAL.BRIDGE name=DHCP-TRUSTED
add address-pool=POOL-IOT interface=VLAN2000-IOT name=DHCP-IOT
add address-pool=POOL-GUEST interface=VLAN3000-GUEST name=DHCP-GUEST
add address-pool=POOL-MGMT interface=VLAN4000-MGMT name=DHCP-MGMT

/ip dhcp-server network
add address=192.168.10.0/24 dns-server=192.168.40.250 gateway=192.168.10.1
add address=192.168.20.0/24 dns-server=192.168.40.250 gateway=192.168.20.1
add address=192.168.30.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=192.168.30.1
add address=192.168.40.0/24 dns-server=192.168.40.250 gateway=192.168.40.1

/ip dhcp-server lease
add address=192.168.40.254 mac-address=D4:01:C3:70:7A:98 server=DHCP-MGMT comment="CRS312"
add address=192.168.40.253 mac-address=F4:1E:57:B2:B1:F3 server=DHCP-MGMT comment="CRS328"
add address=192.168.40.252 mac-address=F4:1E:57:32:60:13 server=DHCP-MGMT comment="CAP.1"
add address=192.168.40.251 mac-address=F4:1E:57:32:5F:AD server=DHCP-MGMT comment="CAP.2"
add address=192.168.40.250 mac-address=F4:1E:57:32:62:A3 server=DHCP-MGMT comment="CAP.3"

/interface bridge port
add bridge=LOCAL.BRIDGE interface=ether2 frame-types=admit-all ingress-filtering=yes comment="TRUNK to CRS312 (Hybrid)"
add bridge=LOCAL.BRIDGE interface=ether3 frame-types=admit-all ingress-filtering=yes comment="TRUNK to CRS328 (Hybrid)"
add bridge=LOCAL.BRIDGE interface=ether4 pvid=4000 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes comment="ACCESS: Pi-Hole"
add bridge=LOCAL.BRIDGE interface=ether5 pvid=4000 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes comment="ACCESS: Home Assistant"
add bridge=LOCAL.BRIDGE interface=ether8 pvid=1 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes comment="ACCESS: Laptop Docking"

/interface bridge vlan
add bridge=LOCAL.BRIDGE tagged=LOCAL.BRIDGE,ether2,ether3 untagged=ether8 vlan-ids=1
add bridge=LOCAL.BRIDGE tagged=LOCAL.BRIDGE,ether2,ether3 vlan-ids=2000
add bridge=LOCAL.BRIDGE tagged=LOCAL.BRIDGE,ether2,ether3 vlan-ids=3000
add bridge=LOCAL.BRIDGE tagged=LOCAL.BRIDGE,ether2,ether3 untagged=ether4,ether5 vlan-ids=4000

/interface wifi datapath
add name=DP-TRUSTED bridge=LOCAL.BRIDGE
add name=DP-IOT bridge=LOCAL.BRIDGE vlan-id=2000
add name=DP-GUEST bridge=LOCAL.BRIDGE vlan-id=3000 client-isolation=yes

/interface wifi security
add name=SEC-TRUSTED authentication-types=wpa2-psk,wpa3-psk passphrase="YourTrustedPassword" ft=yes ft-over-ds=yes
add name=SEC-IOT authentication-types=wpa2-psk passphrase="YourIoTPassword" 
add name=SEC-GUEST authentication-types=wpa2-psk,wpa3-psk passphrase="YourGuestPassword"

/interface wifi configuration
add name=CFG-TRUSTED ssid=REDACTED security=SEC-TRUSTED datapath=DP-TRUSTED mode=ap
add name=CFG-IOT ssid=2.4ghz security=SEC-IOT datapath=DP-IOT mode=ap
add name=CFG-GUEST ssid=GUESTS.WIFI security=SEC-GUEST datapath=DP-GUEST mode=ap

/interface wifi provisioning
add action=create-dynamic-enabled master-configuration=CFG-TRUSTED slave-configurations=CFG-IOT,CFG-GUEST supported-bands=5ghz-ax
add action=create-dynamic-enabled master-configuration=CFG-TRUSTED slave-configurations=CFG-IOT,CFG-GUEST supported-bands=2ghz-ax

/interface wifi capsman
set enabled=yes interfaces=VLAN4000-MGMT,LOCAL.BRIDGE

/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input in-interface-list=MGMT comment="Admin access"
add action=drop chain=input in-interface-list=WAN comment="Drop WAN to Router"

add action=fasttrack-connection chain=forward connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward in-interface-list=MGMT comment="MGMT can reach anywhere"
add action=accept chain=forward in-interface=LOCAL.BRIDGE out-interface=VLAN2000-IOT comment="Trusted can manage IoT only"

add action=accept chain=forward in-interface-list=PIHOLE_ACCESS dst-address=192.168.40.250 protocol=udp dst-port=53 comment="Allow DNS UDP to Pi-Hole"
add action=accept chain=forward in-interface-list=PIHOLE_ACCESS dst-address=192.168.40.250 protocol=tcp dst-port=53 comment="Allow DNS TCP to Pi-Hole"
add action=accept chain=forward in-interface-list=PIHOLE_ACCESS dst-address=192.168.40.250 protocol=icmp comment="Allow Ping to Pi-Hole"

add action=accept chain=forward in-interface-list=ISOLATED_VLANS out-interface-list=WAN comment="IoT and Guest to Internet"
add action=drop chain=forward in-interface-list=ISOLATED_VLANS out-interface-list=!WAN comment="Isolate IoT and Guest entirely"

/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN

/interface bridge set LOCAL.BRIDGE vlan-filtering=yes

I really don't know what to do at this point. I can't spend anymore money on consulting, and chatgpt using the steering guidance to the mikrotik documentation isn't getting it done. Same issues, my internet or access to winbox keeps breaking once filtering is turned on.

kowal · June 16, 2026, 7:45pm

You mentioned CRS328,CRS312 - are they configured properly with vlan filtering (like config2 of rb5009)?

Those connection loss appears only for devices connected via wifi or also for wired clients?

And additionally, I suggest try to match cap's ax config to be familiar with:

(now it looks like configured for qcom-ac package)

helpmytik · June 17, 2026, 12:28am

Thanks for the info. I actually got the RB5009 vlans setup correctly with the help of Gemini. I just couldn't get capsman working with the caps just get. I plugged into a dumb AP for now to get the family some wifi.

Updated RB5009 config below:

# 2026-06-16 18:55:18 by RouterOS 7.21.4
# software id = C86P-TNCF
#
# model = RB5009UG+S+
# serial number = *
/interface bridge
add name=BR1 vlan-filtering=yes
/interface vlan
add interface=BR1 name=VLAN10_WIFI vlan-id=10
add interface=BR1 name=VLAN20_IOT vlan-id=20
add interface=BR1 name=VLAN30_GUEST vlan-id=30
add interface=BR1 name=VLAN40_TRUSTED vlan-id=40
/interface wifi security
add authentication-types=wpa2-psk name=sec_iot
add authentication-types=wpa2-psk name=sec_guest
add authentication-types=wpa2-psk,wpa3-psk name=sec_trusted
/interface wifi configuration
add disabled=no mode=ap name=redacted security=sec_trusted ssid=\
    redacted
add datapath.vlan-id=20 mode=ap name=redacted security=sec_trusted ssid=\
    redacted
add datapath.vlan-id=30 mode=ap name=redacted security=sec_guest ssid=\
    redacted
/ip pool
add name=pool_IOT ranges=192.168.20.10-192.168.20.254
add name=pool_GUEST ranges=192.168.30.10-192.168.30.254
add name=pool_TRUSTED ranges=192.168.40.10-192.168.40.254
add name=pool_WIFI ranges=192.168.10.10-192.168.10.254
/ip dhcp-server
add address-pool=pool_IOT interface=VLAN20_IOT name=dhcp_IOT
add address-pool=pool_GUEST interface=VLAN30_GUEST name=dhcp_GUEST
add address-pool=pool_TRUSTED interface=VLAN40_TRUSTED name=dhcp_TRUSTED
add address-pool=pool_WIFI interface=VLAN10_WIFI name=dhcp_WIFI
/interface bridge port
add bridge=BR1 comment="Trunk to CRS312" interface=ether2
add bridge=BR1 comment="Trunk to CRS328" interface=ether3
add bridge=BR1 interface=ether4 pvid=40
add bridge=BR1 interface=ether5 pvid=20
/interface bridge vlan
add bridge=BR1 tagged=BR1,ether2,ether3 vlan-ids=20
add bridge=BR1 tagged=BR1,ether2,ether3 vlan-ids=30
add bridge=BR1 tagged=BR1,ether2,ether3 untagged=ether5 vlan-ids=40
add bridge=BR1 tagged=BR1,ether2,ether3 vlan-ids=10
/interface wifi capsman
set enabled=yes interfaces=VLAN40_TRUSTED upgrade-policy=none
/interface wifi provisioning
add action=create-dynamic-enabled master-configuration=redacted \
    slave-configurations=redacted,redacted supported-bands=5ghz-ax,5ghz-ac
add action=create-dynamic-enabled master-configuration=redacted \
    slave-configurations=cfg_2ghz,redacted supported-bands=2ghz-ax,2ghz-g
/ip address
add address=192.168.88.1/24 interface=ether8 network=192.168.88.0
add address=192.168.20.1/24 interface=VLAN20_IOT network=192.168.20.0
add address=192.168.30.1/24 interface=VLAN30_GUEST network=192.168.30.0
add address=192.168.40.1/24 interface=VLAN40_TRUSTED network=192.168.40.0
add address=192.168.10.1/24 interface=VLAN10_WIFI network=192.168.10.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=192.168.10.1
add address=192.168.20.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=192.168.20.1
add address=192.168.30.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=192.168.30.1
add address=192.168.40.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=192.168.40.1
/ip firewall filter
add action=accept chain=input comment="Allow CAPsMan Traffic" dst-port=\
    5246,5247 protocol=udp
add action=fasttrack-connection chain=forward comment="Fasttrack connections" \
    connection-state=established,related
add action=accept chain=forward comment="Accept established/related" \
    connection-state=established,related
add action=drop chain=forward comment="Drop invalid packets" \
    connection-state=invalid
add action=accept chain=forward comment="Allow Trusted Outbound" \
    in-interface=VLAN40_TRUSTED
add action=accept chain=forward comment="Allow IoT to Internet" in-interface=\
    VLAN20_IOT out-interface=ether1
add action=accept chain=forward comment="Allow Guest to Internet" \
    in-interface=VLAN30_GUEST out-interface=ether1
add action=drop chain=forward comment="Drop all other inter-VLAN routing"
add action=accept chain=input comment="Accept to router CPU" \
    connection-state=established,related
add action=accept chain=input comment="Allow Ping" protocol=icmp
add action=accept chain=input comment="Allow Winbox via Emergency Port" \
    in-interface=ether8
add action=accept chain=input comment="Allow Winbox via Trusted VLAN" \
    in-interface=VLAN40_TRUSTED
add action=drop chain=input comment="Drop all other access to router CPU"
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=America/Chicago
/tool bandwidth-server
set enabled=no
/tool romon
set enabled=yes

Buckeye · June 17, 2026, 12:38am

What is connected to the RB5009 ports?

Your latest gemini assisted config is not consistent:

/interface bridge port
add bridge=BR1 comment="Trunk to CRS312" interface=ether2
add bridge=BR1 comment="Trunk to CRS328" interface=ether3
add bridge=BR1 interface=ether4 pvid=40
add bridge=BR1 interface=ether5 pvid=20
/interface bridge vlan
add bridge=BR1 tagged=BR1,ether2,ether3 vlan-ids=20
add bridge=BR1 tagged=BR1,ether2,ether3 vlan-ids=30
add bridge=BR1 tagged=BR1,ether2,ether3 untagged=ether5 vlan-ids=40
add bridge=BR1 tagged=BR1,ether2,ether3 vlan-ids=10

look at ether5, in /interface bridge port it is setup with pvid 20, but in the /interface bridge vlan section is is set as untagged for vlan 40

Win 7.21 you shouldn't need to have ether4 or ether5 mentioned in the /interface bridge vlan section.

If you do

/interface/bridge/vlan print

what does it display?

Buckeye · June 17, 2026, 12:43am

I see you have what is connected documented in the first post.

What isn't documented is what vlan each device is supposed to be in (we will assume the connections between the RB5009 and CRS switches are trunk ports).

But you need to upload configs of the two CRS switches.

Also, I know nothing about any MikroTik wireless device, I own none. So someone else will need to help with that.

Buckeye · June 17, 2026, 1:00am

The latest config at least makes it easier to seeing the connection between vlans and ip subnets easier.

While having vlans match a part of the ip subnet (usually the third octet when using /24) isn't a requirement, it makes support and understanding much easier. When you see vlan 20, you can more easily associate it with 192.168.20.0/24.

helpmytik · June 17, 2026, 1:23am

THanks. It shows

[admin@MikroTik] > /interface/bridge/vlan print
Flags: D - DYNAMIC
Columns: BRIDGE, VLAN-IDS, CURRENT-TAGGED, CURRENT-UNTAGGED
#   BRIDGE  VLAN-IDS  CURRENT-TAGGED  CURRENT-UNTAGGED
0   BR1           20  BR1                             
                      ether3                          
                      ether2                          
1   BR1           30  BR1                             
                      ether3                          
                      ether2                          
2   BR1           40  BR1             ether5          
                      ether3                          
                      ether2                          
;;; added by pvid
3 D BR1            1                  BR1             
                                      ether3          
                                      ether2          
4   BR1           10  BR1                             
                      ether3                          
                      ether2                          
;;; added by pvid
5 D BR1           20                  ether5          
;;; added by pvid
6 D BR1           40                  ether4

Also, I think a big part of the problem is I didn't have the qcom package installed

helpmytik · June 17, 2026, 1:26am

I think a big part of my capsman issue was not having the qcom package installed. I'm going to test it later. Here are the CRS312 and CRS328 configs. Yes, they are trunk ports, but the CRS328 feeds the caps POE.

CRS312

# 2026-06-16 18:56:39 by RouterOS 7.21.4
# software id = GSJA-IVIM
#
# model = CRS312-4C+8XG
# serial number = *
/interface bridge
add name=BR1 vlan-filtering=yes
/interface vlan
add interface=BR1 name=VLAN40_MGMT vlan-id=40
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=BR1 comment="Uplink to RB5009" interface=ether1
add bridge=BR1 interface=ether2
add bridge=BR1 interface=ether3
add bridge=BR1 interface=ether4
add bridge=BR1 interface=ether5
add bridge=BR1 interface=ether6
/interface bridge vlan
add bridge=BR1 tagged=ether1,ether2,ether3,ether4,ether5,ether6 vlan-ids=20
add bridge=BR1 tagged=ether1,ether2,ether3,ether4,ether5,ether6 vlan-ids=30
add bridge=BR1 tagged=BR1,ether1,ether2,ether3,ether4,ether5,ether6 vlan-ids=\
    40
/ip dhcp-client
add comment="Pull Trusted Management IP" interface=VLAN40_MGMT
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=America/Chicago
/system routerboard settings
set enter-setup-on=delete-key
/tool bandwidth-server
set enabled=no

CRS328

# 2026-06-16 19:02:01 by RouterOS 7.21.4
# software id = 0MFI-QCZD
#
# model = CRS328-24P-4S+
# serial number = *
/interface bridge
add name=BR1 vlan-filtering=yes
/interface vlan
add interface=BR1 name=VLAN40_MGMT vlan-id=40
/interface bridge port
add bridge=BR1 comment="Uplink to RB5009" interface=ether1
add bridge=BR1 comment="To cAP ax AP 1" interface=ether4 pvid=40
add bridge=BR1 comment="To cAP ax AP 2" interface=ether6 pvid=40
add bridge=BR1 comment="To cAP ax AP 3" interface=ether8
/interface bridge vlan
add bridge=BR1 tagged=ether1,ether8 vlan-ids=20
add bridge=BR1 tagged=ether1,ether8 vlan-ids=30
add bridge=BR1 tagged=ether1,ether8 untagged=BR1 vlan-ids=40
add bridge=BR1 tagged=ether1,ether8 vlan-ids=10
/ip dhcp-client
add comment="Pull Trusted Management IP" interface=VLAN40_MGMT
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=America/Chicago
/system routerboard settings
set enter-setup-on=delete-key
/tool bandwidth-server
set enabled=no

helpmytik · June 17, 2026, 1:26am

Thanks for the feedback.

Buckeye · June 17, 2026, 2:36am

[admin@MikroTik] > /interface/bridge/vlan print
Flags: D - DYNAMIC
Columns: BRIDGE, VLAN-IDS, CURRENT-TAGGED, CURRENT-UNTAGGED
#   BRIDGE  VLAN-IDS  CURRENT-TAGGED  CURRENT-UNTAGGED
0   BR1           20  BR1                             
                      ether3                          
                      ether2                          
1   BR1           30  BR1                             
                      ether3                          
                      ether2                          
2   BR1           40  BR1             ether5          
                      ether3                          
                      ether2                          
;;; added by pvid
3 D BR1            1                  BR1             
                                      ether3          
                                      ether2          
4   BR1           10  BR1                             
                      ether3                          
                      ether2                          
;;; added by pvid
5 D BR1           20                  ether5          
;;; added by pvid
6 D BR1           40                  ether4

ether5 on the RB5009 is in my opinion misconfigured. It is transmitting both vlan 40 and vlan 20 untagged (i.e. as standard ethernet frames without any IEEE 802.1Q tag) How is home assistant supposed to know which vlan the untagged traffic from RB5009 ether5 is associated with, is it from vlan 20 or vlan 40?

Is the printer attached to CRS312 ether4 vlan aware? all traffic will have IEEE 802.1Q tags. Likewise with ether5 nvr and ether7 nas. Are these devices able to interpret vlan tags? More likely than a printer, but make sure.

The vlan config for vlan 40 on the CRS328 looks suspect to me.

/interface bridge vlan
add bridge=BR1 tagged=ether1,ether8 vlan-ids=20
add bridge=BR1 tagged=ether1,ether8 vlan-ids=30
add bridge=BR1 tagged=ether1,ether8 untagged=BR1 vlan-ids=40
add bridge=BR1 tagged=ether1,ether8 vlan-ids=10

Because you have a VLAN40_MGMT vlan interface configured, I think BR1 should be tagged, similar to the way it is on the CRS312

It's possible that what I am pointing out makes no sense to you if this is your first experience using vlans on MikroTik ROS. If you have just been copy/pasting without understanding, its going to be difficult for you to troubleshoot.

helpmytik · June 17, 2026, 2:41am

Thank you for your insight. You're right, it will be hard for me to troubleshoot, but I'm going to stick with it. I'll take your feedback and do some research. Thank you.

tadawson · June 17, 2026, 3:02am

Do yourself a favor, and ignore "Artificial Imbecile" and instead start with a template config, or use a recent ROS7 based video tutorial.

Is this a home, or ??? If a home environment, why all the VLAN stuff?

helpmytik · June 17, 2026, 3:36am

Problem is I haven't found a template that has vlans and capsman together.

It's a home. Vlans because there are a lot of IOT devices and family devices running apps/services that I don't want touching my stuff.

tadawson · June 17, 2026, 4:06am

Run your AP's on the default vlan with cqpsman, and breakout the other stuff to VLANs . . . . win/win.

Or uae the VLANs, but let the edge swich untag the ports going to the AP's.

Or create a subnet for the IOT stuff, and do this with subs and not VLANs (if wiring permits)

Or this sounds like what you want to do:
https://mikrotikmasters.com/mikrotik-capsman-with-vlans-full-setup-guide-hex-2x-cap-ax/

BartoszP · June 17, 2026, 6:37am

@helpmytik

Edited your post to remove serials. Do not share them.

rextended · June 17, 2026, 10:05am

The setup is broken and completely worthless.

So, in the default configurations, to avoid creating incompatibilities between manufacturers,
only 2 to 511 should be used as IDs, making only 510 VLANs available to the user...

helpmytik · June 17, 2026, 4:54pm

That's really strange, and I'm not sure where that came from.

rextended · June 17, 2026, 4:56pm

I know where it came from: The default LAN group has been deleted.

helpmytik · June 17, 2026, 5:01pm

That's crazy. Looking back at the first "working" config, the only interface list is WAN. LAN gets created on the default config, right? Either way, it wasn't there. That could have been a big part of the issue, right?

rextended · June 17, 2026, 5:12pm

Look, I'm replying out of courtesy because I just received info about a loss on my family.

I seriously recommend you put the device back into default and get help from the guys here on the forum.

Good luck.