I have been batteling with cap-ax and wifiwave2 with capsman for a few weeks now. It seems the issue is something deep. Some weird magic is going on where client requests are being filtered somewhere in the capsman host machine.
The wifi clients can ping the GW and other clients in the vlan, but can not get past the capsman host to other parts of the network - SOMETIMES. I have some AP-s configured fully manually. But some still have some dynamic conf.
For example client device can connect outside network when it is connected to an AP with a dynamic /interface/bridge/vlan, like the following output from below.
/interface/bridge/vlan> print
Flags: D - DYNAMIC
Columns: BRIDGE, VLAN-IDS, CURRENT-TAGGED, CURRENT-UNTAGGED
# BRIDGE VLAN-IDS CURRENT-TAGGED CURRENT-UNTAGGED
0 bridge 1 bridge
ether1
1 bridge 40 bridge
ether1
2 bridge 6 bridge
ether1
wifi1
wifi2
3 D bridge 6 wifi1
Also the bridge ports are done dynamically on the AP, but when I removed these and set them manually it wont allow clients past the CAPSMAN controller.
/interface/bridge/port> print
Flags: D - DYNAMIC
Columns: INTERFACE, BRIDGE, HW, PVID, PRIORITY, PATH-COST, INTERNAL-PATH-COST, HORIZON
# INTERFACE BRIDGE HW PVID PRIORITY PATH-COST INTERNAL-PATH-COST HORIZON
;;; trunk
0 ether1 bridge yes 1 0x80 10 10 none
1 D wifi1 bridge 6 0x80 10 10 none
2 D wifi2 bridge 6 0x80 10 10 none
We also chose to not use dynamic mode, because it requires that bridge has vlan-filtering=no, because of that we cant use MSTP for our spanning tree on the AP-s.
All of this knowledge is taken from the examples in mikrotik wifiwave2 vlan config recommendation. As I have come to understand the dynamic vlan stuff for AP-s where you dont define the VLAN-s inside the AP, but in the datapath seems finecky and for example the vlan-filtering=no for the dynamic creation and access to work is rather poor imo.
I guess I have some questions how is the wifi supposed to work overall with capsman.
Why is the /interface/bridge/port dynamically created and the vlanid set for the bridge port? why is it not vlanid=1 ???