A few (minor) problems:
/interface bridge
add name=bridge1 > pvid=100 > vlan-filtering=yes
/interface vlan
add interface=bridge1 name=vlan100 vlan-id=100
/interface bridge vlan
add bridge=bridge1 tagged=ether1,bridge1 untagged=ether2,ether3,ether4,ether5 vlan-ids=100
First configuration (setting PVID on bridge interface … read more about bridge roles) configures bridge interface as untagged for VLAN ID 100 … the other two configure bridge interface as tagged member of VLAN ID 100. In short: unset PVID setting on bridge (the first command). Things may seem to work just fine with your current config, but it’s not correct anyway.
And to the problem with wireless:
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=“united states” disabled=no installation=indoor mode=ap-bridge security-profile=Public ssid=TRUSTED-2.4 > vlan-mode=use-tag > wps-mode=disabled
/interface bridge port
add bridge=bridge1 interface=wlan1 > pvid=101
/interface bridge vlan
add bridge=bridge1 tagged=ether1,bridge1 > untagged=wlan1> ,wlan2 vlan-ids=101
Either use use-vlan=yes on wireless interface (but then you have to set vlan-id=101) or use pvid setting on bridge port, not both.
Explanation:
- historically bridge was not VLAN-aware and only way of managing VLAN was directly on underlying hardware. For ethernet ports this meant dealing with VLAN tags through switch chip configuration, for wireless interfaces this meant using vlan-id=XY vlan-mode=use-tag which made wireless driver to deal with VLAN tags. N.b.: implicit default is vlan-id=1 which is not shown in exported config (unless running it with verbose parameter) because export only shows differences from “bare metal” defaults (and VLAN ID set to 1 everywhere is “bare metal” default).
Setting VLANs on wireless interface this way made wireless interface a tagged-only (trunk) port of bridge. It is possible to keep using configuration this way, but in bridge settings such port has to be configured as tagged member of appropriate VLAN (including configuration under /interface bridge vlan). - In modern times, when bridge is VLAN aware, it’s possible to set everything related to VLANs on bridge, which includes wireless interfaces (and other interfaces which historically did not allow VLAN settings). Which means that wireless interface has to keep (default) setting vlan-mode=no-tag and configure bridge port with PVID set.
And you have the same error for all wireless interfaces/ports.
BTW, since you’re using hAP ac2 as simple AP / ethernet switch combo, you don’t need bridge configured as tagged member of all VLANs … you only need bridge tagged member of VLAN which will be used to manage the device itself. Which means moving DHCP server to central router. The whole exercise is a security measure.
This includes the following configuration items (and the rest of similar ones):
/interface bridge vlan
add bridge=bridge1 tagged=ether1> ,bridge1 > untagged=wlan3 vlan-ids=103 > # bridge1 doesn’t have to be member
/interface vlan
add interface=bridge1 name=vlan103 vlan-id=103 > # not needed at all
/ip address
add address=192.168.103.202/24 interface=vlan103 network=192.168.103.0
/ip dhcp-server network
add address=192.168.103.0/24 dns-server=192.168.0.1,8.8.8.8 gateway=192.168.103.1 netmask=24 > # move DHCP server to central router
/ip route
add distance=1 gateway=192.168.100.1remove all default routes below this line, device itself only needs route belonging to own (management) subnet
add distance=1 gateway=192.168.101.1
add distance=1 gateway=192.168.102.1
add distance=1 gateway=192.168.103.1