(1) DONT make vlan1 some sort of data vlan, it doesnt need defining as you have done, it sits in the background used by the Router.
VLAN1 seems to be your HOME LAN, so make it vlan11 all good!
(2) Your input and forward chain rules are intermingled making it more difficult then necessary to read…
(3) Bridge port settings are incorrect unless you are saying they are all trunk ports going to smart devices??
Suggest reading: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
(4) Not the complete config so not much more to say…
+++++++++++++++++++++++++++++++++++
In terms of firewall rules, see the below and stick in additional admin rules in where needed ( Answers the question what traffic flows are permitted, the rules block everything else ). Get rid of of most of the junk extra rules you created.
/ip firewall filter
{Input Chain}
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
(admin rules)
add action=accept chain=input in-interface-list=Authorized
add action=accept chain=input comment=“Allow LAN DNS/NTP-UDP”
dst-port=53,123 in-interface-list=LAN protocol=udp
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
dst-port=53 in-interface-list=LAN protocol=tcp
***** Place any other needed flow rules here *****
add action=drop chain=input comment=“drop all else”
{forward chain}
add action=accept chain=forward comment=“defconf: accept in ipsec policy” ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy” ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
(admin rules)
add action=accept chain=forward comment=“allow internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“allow dst-nat from both WAN and LAN (including port forwarding)” connection-nat-state=dstnat
add action=accept chain=forward in-interface-list=Schild log=yes out-interface-list=Mama
********* Place any other needed flow rules here *********
add action=drop chain=forward comment=“drop all else”
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade” ipsec-policy=out,none out-interface-list=WAN
Where firewall address list Authorized consists of static leases or assigned ips:
add ip address=IP_address1 list=Authorized comment=“Admin Desktop”
add ip address=IP_address2 list=Authorized comment=“Admin Laptop”
add ip address=IP_address3 list=Authorized comment=“Admin Smartphone”
add ip address=IP_address4 list=Authorized comment=“Admin remote vpn connection, if any”