Ok, so sadly not everything is working as expected and problem is not just cosmetic.
I followed them like 20 times with adjustments to my situation and always ending up with whole network not working. Either I got red warnings about vlan on cap wifi interfaces, or I am getting disconnected from main router and cant login back or in winbox everything is peachy but devices are unable to connect.
Seeking for some kind soul who can help me to adjust it to my needs.
Situation from before migration:
hap ac2 was running old capsman and had 3 bridges:
- default one for everything except:
– iot things which were connecting to bridge_10
– guest things which were connecting to bridge_100
Config was moved from hap ac2 to hap ax2 to have things like ppppoe and firewall rules set up.
Current situation:
- caps are connecting to capsman
- devices can connect to guest (goscie) and iot wifi through caps
- devices cannot connect to home (domek) wifi, this is most likely caused by trying to set vlan5 on caps, but not being able to reflect it on capsman device, whatever I try I am getting disconnected from main device once I touch the default bridge and I need to reset it and restore settings from backup
- getting random iot connection drops, not sure why
capsman device config:
# 2025-02-19 14:51:09 by RouterOS 7.17.2
# software id = 56DB-EV57
#
# model = C52iG-5HaxD2HaxD
/interface bridge
add admin-mac=74:4D:28:1E:2C:BB auto-mac=no comment=defconf name=bridge \
port-cost-mode=short
add name=bridge_vlan10 port-cost-mode=short
add name=bridge_vlan100 port-cost-mode=short
/interface ethernet
set [ find default-name=ether1 ] advertise=\
100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full comment=Input \
l2mtu=1598 mac-address=74:4D:28:1E:2C:BA
set [ find default-name=ether2 ] l2mtu=1598 mac-address=74:4D:28:1E:2C:BB
set [ find default-name=ether3 ] disabled=yes l2mtu=1598 mac-address=\
74:4D:28:1E:2C:BC
set [ find default-name=ether4 ] disabled=yes l2mtu=1598 mac-address=\
74:4D:28:1E:2C:BD
set [ find default-name=ether5 ] l2mtu=1598 mac-address=74:4D:28:1E:2C:BE
/interface vlan
add interface=ether1 name=ether1.20 vlan-id=20
add interface=bridge name=vlan10 vlan-id=10
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1.20 name=pppoe-out1 \
use-peer-dns=yes user=01266
/interface ethernet switch port
set 0 default-vlan-id=auto
set 1 default-vlan-id=auto
set 2 default-vlan-id=auto
set 3 default-vlan-id=auto
set 4 default-vlan-id=auto
set 5 default-vlan-id=auto
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wifi datapath
add bridge=bridge_vlan100 client-isolation=yes disabled=no name=dp_guest
add bridge=bridge disabled=no name=dp_home
add bridge=bridge_vlan10 disabled=no name=dp_iot
add bridge=bridge_vlan100 client-isolation=yes disabled=no name=dp_guest_ac
add bridge=bridge disabled=no name=dp_home_ac
add bridge=bridge_vlan10 disabled=no name=dp_iot_ac
/interface wifi security
add authentication-types=wpa2-psk disabled=no ft=yes ft-over-ds=yes name=\
sec_guest
add authentication-types=wpa2-psk disabled=no ft=yes ft-over-ds=yes name=\
sec_iot
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes \
name=sec_home
/interface wifi steering
add disabled=no name=steering neighbor-group=dynamic-Domek-a4d9f796 rrm=yes \
wnm=yes
/interface wifi configuration
add datapath=dp_guest datapath.bridge=bridge_vlan100 disabled=no name=\
cfg_guest security=sec_guest ssid=Goscie steering=steering
add datapath=dp_home disabled=no name=cfg_home2.4 security=sec_home ssid=\
Domek steering=steering
add datapath=dp_iot datapath.bridge=bridge_vlan10 disabled=no name=cfg_iot \
security=sec_iot ssid=IoT steering=steering
add datapath=dp_home disabled=no name=cfg_home5 security=sec_home ssid=Domek \
steering=steering
add datapath=dp_iot_ac datapath.bridge=bridge_vlan10 disabled=no name=\
cfg_iot_ac security=sec_iot ssid=IoT steering=steering
add datapath=dp_home_ac disabled=no name=cfg_home5_ac security=sec_home ssid=\
Domek steering=steering
add datapath=dp_home_ac disabled=no name=cfg_home2.4_ac security=sec_home \
ssid=Domek steering=steering
add datapath=dp_guest_ac datapath.bridge=bridge_vlan100 disabled=no name=\
cfg_guest_ac security=sec_guest ssid=Goscie steering=steering
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip ipsec policy group
add name=ike2-group
add name=ike2-policies
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
add dpd-interval=2m dpd-maximum-failures=5 enc-algorithm=aes-256,aes-128 \
hash-algorithm=sha256 name=ike2
/ip ipsec peer
add exchange-mode=ike2 name=ike2 passive=yes profile=ike2 \
send-initial-contact=no
/ip ipsec proposal
add auth-algorithms=sha256,sha1 enc-algorithms=aes-256-cbc name=ike2_proposal \
pfs-group=none
/ip kid-control
add fri=0s-1d mon=0s-1d name=system-dummy sat=0s-1d sun=0s-1d thu=0s-1d tue=\
0s-1d tur-fri=0s-1d tur-mon=0s-1d tur-sat=0s-1d tur-sun=0s-1d tur-thu=\
0s-1d tur-tue=0s-1d tur-wed=0s-1d wed=0s-1d
/ip pool
add name=dhcp ranges=192.168.1.100-192.168.1.254
add name=pool_iot ranges=192.168.10.100-192.168.10.254
add name=pool_guest ranges=192.168.100.100-192.168.100.254
add name=ike2-pool ranges=192.168.77.2-192.168.77.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=12h name=dhcp_local
add address-pool=pool_guest interface=bridge_vlan100 lease-script="if (\$lease\
Bound = \"1\") do={\r\
\nglobal telegramMessage \"\$\"lease-hostname\" (\$leaseActMAC) otrzymal a\
dres \$leaseActIP z DHCP_guest\"\r\
\n/system script run SendToTelegram\r\
\n}" lease-time=1d name=dhcp_guest
add address-pool=pool_iot interface=bridge_vlan10 lease-time=6h name=dhcp_iot
/ip ipsec mode-config
add address-pool=ike2-pool address-prefix-length=32 name=ike2-conf
/ip smb users
set [ find default=yes ] disabled=yes
add disabled=yes name=Arek
/queue simple
add max-limit=60M/300M name=Guest target=192.168.100.0/24
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/system logging action
set 1 disk-file-count=10 disk-file-name=flash/log
set 3 remote=192.168.1.115 src-address=192.168.1.1
/ip smb
set domain=WORKGROUP interfaces=bridge
/interface vlan
add interface=*D name=vlan100 vlan-id=100
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4 \
internal-path-cost=10 path-cost=10
add bridge=bridge_vlan10 comment=defconf ingress-filtering=no interface=\
ether5 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=*1 \
internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=*2 \
internal-path-cost=10 path-cost=10
add bridge=bridge_vlan10 ingress-filtering=no interface=*A \
internal-path-cost=10 path-cost=10
add bridge=bridge_vlan10 ingress-filtering=no interface=vlan10 \
internal-path-cost=10 path-cost=10
add bridge=bridge_vlan100 ingress-filtering=no interface=*D \
internal-path-cost=10 path-cost=10
add bridge=bridge_vlan100 ingress-filtering=no interface=vlan100 \
internal-path-cost=10 path-cost=10
/interface bridge settings
set use-ip-firewall=yes
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=all
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface detect-internet
set detect-interface-list=all
/interface l2tp-server server
set use-ipsec=required
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=pppoe-out1 list=WAN
add disabled=yes interface=ether1 list=WAN
/interface ovpn-server server
add auth=sha1,md5 mac-address=FE:2A:FB:0A:77:BE name=ovpn-server1
/interface sstp-server server
set default-profile=default-encryption
/interface wifi cap
set caps-man-addresses=192.168.1.1 certificate=request discovery-interfaces=\
bridge enabled=yes slaves-static=yes
/interface wifi capsman
set enabled=yes package-path="" require-peer-certificate=no upgrade-policy=\
none
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=cfg_home5 \
slave-configurations=cfg_guest supported-bands=5ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=\
cfg_home5_ac slave-configurations=cfg_guest_ac supported-bands=5ghz-ac
add action=create-dynamic-enabled disabled=no master-configuration=\
cfg_home2.4 slave-configurations=cfg_iot supported-bands=2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=\
cfg_home2.4_ac slave-configurations=cfg_iot_ac supported-bands=\
2ghz-g,2ghz-n
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge network=\
192.168.1.0
add address=192.168.10.1/24 interface=bridge_vlan10 network=192.168.10.0
add address=192.168.100.1/24 interface=bridge_vlan100 network=192.168.100.0
/ip arp
add address=192.168.1.240 interface=bridge mac-address=08:ED:ED:6C:AE:1A
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.1.0/24 comment="Home + Pi-hole" dns-server=\
192.168.1.110,8.8.8.8 gateway=192.168.1.1
add address=192.168.10.0/24 comment=IoT dns-server=8.8.8.8 gateway=\
192.168.10.1
add address=192.168.100.0/24 comment=Guests dns-server=8.8.8.8 gateway=\
192.168.100.1
/ip dns
set allow-remote-requests=yes servers=192.168.1.110,8.8.8.8
/ip dns static
add address=192.168.1.1 name=router.lan type=A
/ip firewall address-list
add address=192.168.1.140 list=domek_blocked_from_LAN
add address=192.168.1.141 list=domek_blocked_from_LAN
add address=192.168.1.141 list=domek_blocked_to_LAN
add address=192.168.1.140 list=domek_blocked_to_LAN
add address=192.168.1.200 list=domek_blocked_from_LAN
add address=192.168.1.200 list=domek_blocked_to_LAN
add address=39.98.204.251 disabled=yes list="port scanners"
add address=81.22.45.171 disabled=yes list="port scanners"
add address=104.152.52.18 disabled=yes list="port scanners"
add address=113.96.223.207 disabled=yes list="port scanners"
add address=64.32.11.69 disabled=yes list="port scanners"
add address=23.248.219.63 disabled=yes list="port scanners"
add address=192.168.1.120 list=iot_adm
add address=192.168.1.130 list=iot_adm
add address=192.168.1.132 list=iot_adm
add address=192.168.1.115 list=iot_adm
add address=192.168.1.200/30 list=iot_adm
/ip firewall filter
add action=drop chain=forward comment="domek blocked to LAN" disabled=yes \
dst-address=192.168.1.0/24 src-address-list=domek_blocked_to_LAN
add action=drop chain=forward comment="domek blocked from LAN" disabled=yes \
dst-address-list=domek_blocked_from_LAN src-address=192.168.1.0/24
add action=accept chain=input comment="0:0 and limit for 5pac/s" \
icmp-options=0:0-255 limit=5,5:packet protocol=icmp
add action=accept chain=input comment="3:3 and limit for 5pac/s" \
icmp-options=3:3 limit=5,5:packet protocol=icmp
add action=accept chain=input comment="3:4 and limit for 5pac/s" \
icmp-options=3:4 limit=5,5:packet protocol=icmp
add action=accept chain=input comment="8:0 and limit for 5pac/s" \
icmp-options=8:0-255 limit=5,5:packet protocol=icmp
add action=accept chain=input comment="11:0 and limit for 5pac/s" \
icmp-options=11:0-255 limit=5,5:packet protocol=icmp
add action=drop chain=input comment="Drop everything else" protocol=icmp
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=none-static chain=input comment=\
"Port scanners to list " log=yes protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=none-static chain=input comment=\
"NMAP FIN Stealth scan" log=yes protocol=tcp tcp-flags=\
fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=none-static chain=input comment="SYN/FIN scan" log=\
yes protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=none-static chain=input comment="SYN/RST scan" log=\
yes protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=none-static chain=input comment="FIN/PSH/URG scan" \
log=yes protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=none-static chain=input comment="ALL/ALL scan" log=\
yes protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=none-static chain=input comment="NMAP NULL scan" \
log=yes protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="dropping port scanners" log=yes \
src-address-list="port scanners"
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=WAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
"guests: accept established,related, untracked" connection-state=\
established,related,untracked out-interface=bridge_vlan100
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes src-address=\
!192.168.100.0/24
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=accept chain=forward dst-address=192.168.10.10 src-address-list=\
iot_adm
add action=accept chain=forward dst-address-list=iot_adm src-address=\
192.168.10.10
add action=drop chain=forward disabled=yes dst-address=192.168.10.0/24 \
src-address=192.168.1.0/24
add action=drop chain=forward dst-address=192.168.100.0/24 src-address=\
192.168.1.0/24
add action=drop chain=forward disabled=yes dst-address=192.168.1.0/24 \
src-address=192.168.10.0/24
add action=drop chain=forward dst-address=192.168.100.0/24 src-address=\
192.168.10.0/24
add action=drop chain=forward dst-address=192.168.1.0/24 src-address=\
192.168.100.0/24
add action=drop chain=forward dst-address=192.168.10.0/24 src-address=\
192.168.100.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip ipsec identity
add auth-method=digital-signature certificate=hAPAX2 generate-policy=\
port-strict match-by=certificate mode-config=ike2-conf peer=ike2 \
policy-template-group=ike2-group remote-certificate=S22
/ip ipsec policy
add dst-address=192.168.77.0/24 group=ike2-group proposal=ike2_proposal \
src-address=0.0.0.0/0 template=yes
/ip service
set telnet disabled=yes
set ftp address=192.168.1.0/24 disabled=yes
set www address=192.168.1.0/24
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.1.0/24
set api-ssl disabled=yes
/ip smb shares
set [ find default=yes ] directory=/flash/pub
/ip upnp interfaces
add disabled=yes interface=bridge type=internal
add disabled=yes interface=pppoe-out1 type=external
/routing bfd configuration
add disabled=no
/snmp
set trap-target=192.168.1.120
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name="hAP AX^2"
/system logging
set 0 topics=info,!firewall
add action=remote topics=error
add action=remote topics=critical
add action=remote topics=warning
add action=remote topics=info
add disabled=yes topics=debug,!packet
add topics=ipsec,!packet
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=pl.pool.ntp.org
cap device config:
# 2025-02-19 14:34:25 by RouterOS 7.17.2
# software id = YXT8-GNKV
#
# model = RBcAPGi-5acD2nD
/interface bridge
add admin-mac=74:4D:28:12:A3:F6 auto-mac=no comment=defconf name=bridgeLocal \
vlan-filtering=yes
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi
# managed by CAPsMAN 74:4D:28:1E:2C:BB%bridgeLocal, traffic processing on CAP
# mode: AP, SSID: Domek, channel: 2412/n/Ce
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=capdp \
disabled=no
# managed by CAPsMAN 74:4D:28:1E:2C:BB%bridgeLocal, traffic processing on CAP
# mode: AP, SSID: Domek, channel: 5500/ac/Ceee/D
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=capdp \
disabled=no
# managed by CAPsMAN 74:4D:28:1E:2C:BB%bridgeLocal, traffic processing on CAP
# mode: AP, SSID: IoT
add disabled=no mac-address=76:4D:28:12:A3:F8 master-interface=wifi1 name=\
wifi5
# managed by CAPsMAN 74:4D:28:1E:2C:BB%bridgeLocal, traffic processing on CAP
# mode: AP, SSID: Goscie
add disabled=no mac-address=76:4D:28:12:A3:F9 master-interface=wifi2 name=\
wifi6
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
add bridge=bridgeLocal interface=wifi1 pvid=5
add bridge=bridgeLocal interface=wifi2 pvid=5
add bridge=bridgeLocal interface=wifi5 pvid=10
add bridge=bridgeLocal interface=wifi6 pvid=100
/interface bridge vlan
add bridge=bridgeLocal tagged=ether1 untagged=wifi5 vlan-ids=10
add bridge=bridgeLocal tagged=ether1 untagged=wifi6 vlan-ids=100
add bridge=bridgeLocal tagged=ether1 untagged=wifi1,wifi2 vlan-ids=5
/interface wifi cap
set caps-man-addresses=192.168.1.1 certificate=request discovery-interfaces=\
bridgeLocal enabled=yes slaves-static=yes
/ip dhcp-client
add comment=defconf interface=bridgeLocal
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name="cAP AC 1"
/system note
set show-at-login=no
I will read this article later, once I am back from work, but not sure if I will understand it completely 
