Okay so you want the Switch to act as a router and pass some off the LAN subnets from the router directly to local portson the switch (transparently) and then some local ports to get local DHCP etc…
This is how I would do it.
Coming from main router.
vlan10 - this translates to the subnet on bridge main.
vlan20 - this translates to the subnet on bridge isolated
vlan66 - this is the management or base vlan that the admin can access on the router and where switch gets its IP address from ( and where isolated subnet gets its internet access )
There is a TRUNK port on the main router carrying all three vlans to the SWITCH.
Ether1 on the switch is where the trunk port leads to.
START WITH OFF BRIDGE port first!! , and then do all config from there…
to avoid vlan filtering hiccups, and to config from a safe spot, recommend you take ether20 off the bridge.
/interface ethernet
set [ find default-name=ether20] name=OffBridge20
/ip address
add address=192.168.55.1/29 interface=OffBridge20 network=192.168.55.0
/interface list member
add interface=Offbridge20 list=LAN
Now plug in your laptop into ether20, change ipv4 settings to 192.168.55.2 and you should be in!!!
/interface bridge
add name=bridge vlan-filtering=no { turn on as last step }
/interface ethernet
set [ find default-name=ether20 ] name=OffBridge20
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface vlan
add interface=bridge name=vlan66-base vlan-id=66 comment="management vlan"
add interface=bridge name=vlan20-isolated vlan-ids=20 comment-="isolated vlan"
/ip pool
add name=pool-isolated ranges=192.168.100.100-192.168.100.200
/ip dhcp-server
add address-pool=pool-isolated interface=vlan20-isolated name=dhcp-isolated
/interface bridge port
add bridge=bridge ingress filtering=yes frame-types=admit-only-vlan-tagged interface=ether1
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether2 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether3 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether4 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether5 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether6 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether7 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether8 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether9 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether10 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether11 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether12 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether13 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether14 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether15 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether16 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether17 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether18 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether19 pvid=10
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether21 pvid=20
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether22 pvid=20
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether23 pvid=20
add bridge=bridge ingress-filtering=yes frame-types=admit-only-priority-and-untagged interface=ether24 pvid=20
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/interface bridge vlan
add bridge=bridge tagged=ether1, untagged=ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19 vlan-id=10
add bridge=bridge tagged=bridge,ether1 untagged=ether21,ether22,ether23,ether24 vlan-id=20
add bridge=bridge tagged=bridge,ether1 vlan-id=66
/ip address
add address=192.168.66.X/24 interface=vlan66 network=192.168.66.0 { where X is a static dhcp lease on main router }
add address=192.168.55.1/30 interface=OffBridge20 network=192.168.55.0
add address=192.168.100.1/24 interface=vlan20-isolated network=192.168.100.0
/ip dhcp-server network
add address=192.168.100.0/24 dns-server=192.168.100.1 gateway=192.168.100.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,1.1.1.1
/interface list
add name=LAN
add name=WAN
add name=TRUSTED
/interface list member
add interface=vlan66 list=WAN
add interface=vlan20-isolated list=LAN
add interface=OffBridge20 list=LAN
add interface=vlan66 list=TRUSTED
add interface=OffBridge20 list=TRUSTED
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-address=127.0.0.1
add action=accept chain=input comment="admin access" in-interface-list=TRUSTED
add action=accept chain=input comment="isolated users to services" in-interface-list=LAN dst-port=53 protocol=udp
add action=accept chain=input comment="isolated users to services" in-interface-list=LAN dst-port=53 protocol=tcp
add action=drop chain=input comment="drop all else" { put this rule in only after the ones above are in place including interface list entries }
++++++++++++++++++
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment="internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system routerboard settings
set boot-os=router-os
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.66.1
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.66.1
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED
. Any ideas?
.