No connection on 2 router setup

RouterOS Beginner Basics
1

I am trying to create a separate network from my landlord. He ran an ethernet cable for me that I connected to a MT hap3. I configured it and can ping out from the router and confirm that it resolves dns (www.google.com) but devices connected to it cannot connect to the internet. The NAT is set to masquerade…not sure what’s wrong.
Landlord’s router is 192.168.1.1 and my MT is 192.168.88.1

# feb/01/2024 22:39:35 by RouterOS 7.8
# software id = **ELIDED**
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = **ELIDED**
/interface bridge
add name=local
/interface list
add name=listBridge
/ip pool
add name=dhcp_pool0 ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=local name=dhcp1
/interface bridge port
add bridge=local interface=ether2
/ip neighbor discovery-settings
set discover-interface-list=listBridge
/interface list member
add interface=local list=listBridge
/ip address
add address=192.168.88.1/24 interface=local network=192.168.88.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip firewall filter
add action=accept chain=input comment="accept established,related" \
    connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment="allow ICMP" in-interface=ether1 \
    protocol=icmp
add action=accept chain=input comment="allow Winbox" in-interface=ether1 port=\
    8291 protocol=tcp
add action=accept chain=input comment="allow SSH" in-interface=ether1 port=22 \
    protocol=tcp
add action=drop chain=input comment="block everything else" in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=2200
set api disabled=yes
set winbox address=192.168.88.0/24
/system clock
set time-zone-name=America/New_York
/tool bandwidth-server
set enabled=no
/tool mac-server mac-winbox
set allowed-interface-list=listBridge
2

Why are you adding ether1 for winbox access…? You want your landlord to be able to reach your router for config purposes??
Suggest you need something like BEFORE the drop rule.
add chain=input action=accept in-interface=local comment=“Allow LAN users DNS services:”

3

“Devices,” plural, yet you have only one interface on the bridge called “local,” ether2. Are these “devices” you’re having trouble with plugged into one of the other interfaces, not on the bridge? If so, they aren’t getting DHCP addresses, so of course they can’t route out to the landlord’s side of the LAN.