Creating "Internet of S**t" VLAN and wireless network + FW and whitelist (1100x2AH with 411AR as access point)

I did something similar recently, but at the time I used a CRS125 and a HAP AC Lite. The VLAN configuration for CRS is very different from your equipment, but HAP AC Lite stuff should be the same.

Here’s the wiki that explains VLANs for the 1100 and 433. You need to create a VLAN trunk that contains both of your VLANs between the 1100 and the 433.
http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features

Here’s a forum topic when I setup mine.
http://forum.mikrotik.com/t/vlan-trunks-without-bridges/95834/1