Hi there,
I dont know what is the best option for you to
a. do vlans, either vlan filtering bridge method ( i prefer), or
b. switch chip method. ****
***** Your unit diagram shows a fancy PIPE connections between ports and I dont think there is any specific method to optimize those, at least I have not read anything. So I dont think the switch chip method applies anyway.
Here is the link for bridge vlan filtering which I use for many vlans myself,
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Stick with the default firewall rules until you understand them as they keep you safe from the start.
When you have a first config kind of done, do not hesitate to post the config here for review.
/export hide-sensitive file=anynameyouwish
Default rules in case your router didnt come with any. IP FIREWALL
all you have to do is copy and paste this in your winbox Terminal selection window ( without the { _____ chain part} of course )
/ip firewall filter
{input chain part}
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input protocol=icmp
add action=drop chain=input in-interface-list=!LAN
{forward chain part}
add action=accept chain=forward comment=“defconf: accept in ipsec policy” ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy” ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
If there are no NAT rules, this is the default rule for that as well.
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN