Today I did some reconfiguration. I followed one of the configuration examples from http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 and added:
/interface bridge vlan
add bridge=bridge tagged=bridge,ether2,ether3,ether4,ether5,wlan1,wlan2 vlan-ids=50
add bridge=bridge tagged=bridge,ether2,ether3,ether4,ether5,wlan1,wlan2 vlan-ids=60
add bridge=bridge tagged=bridge,ether2,ether3,ether4,ether5,wlan1,wlan2 vlan-ids=70
/interface bridge port (added frame-types=admit-only-vlan-tagged)
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=ether2 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=ether3 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=ether5 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=wlan1 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=wlan2 internal-path-cost=10 path-cost=10
/interface bridge (added vlan-filtering=yes)
add admin-mac=18:FD:blabla auto-mac=no comment=defconf name=bridge port-cost-mode=short protocol-mode=none vlan-filtering=yes
/interface list
add name=VLAN
/interface list member
add interface=vlan50 list=VLAN
add interface=vlan60 list=VLAN
add interface=vlan70 list=VLAN
/ip firewall filter
add action=accept chain=input comment="Allow VLAN - input" in-interface-list=VLAN
add action=accept chain=forward comment="Allow VLAN - forward" in-interface-list=VLAN
Also the following has been changed (to be more logical and replaced /16 to /24):
/ip address
add address=172.16.10.1/24 comment=defconf interface=bridge network=172.16.10.0
/ip pool
add name=dhcp ranges=172.16.10.10-172.16.10.254
/ip dhcp-server network
add address=172.16.10.0/24 comment=defconf dns-server=172.16.10.1 gateway=172.16.10.1
After this reconfiguration I was able to ping PC2 from PC1. From the opposite direction was then only needed to allow ping to VLAN with PC1 on my Antivirus software and with that my problem has been solved.
Thank you all for help.
Complete final configuration export: (relevant, so only without snmp, sheduler and ipv6)
# 2024-01-07 19:49:46 by RouterOS 7.13
# software id = IU8T-YSM6
#
# model = RBD53iG-5HacD2HnD
# serial number = blabla
/interface bridge
add admin-mac=18:FD:blabla auto-mac=no comment=defconf name=bridge port-cost-mode=short protocol-mode=none vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX country="blabla" disabled=no distance=indoors frequency=auto installation=indoor mode=\
ap-bridge ssid=MikroTik wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-onlyac channel-width=20/40/80mhz-XXXX country="blabla" disabled=no distance=indoors frequency=auto installation=indoor \
mode=ap-bridge ssid=MikroTik wireless-protocol=802.11 wps-mode=disabled
/interface vlan
add interface=bridge name=vlan50 vlan-id=50
add interface=bridge name=vlan60 vlan-id=60
add interface=bridge name=vlan70 vlan-id=70
add interface=ether1 name=vlan848 vlan-id=848
/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan848 max-mru=1492 max-mtu=1492 name=pppoe-isp user=blabla
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VLAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=172.16.10.10-172.16.10.254
add name=dhcp_pool50 ranges=172.16.50.1-172.16.50.87,172.16.50.89-172.16.50.254
add name=dhcp_pool60 ranges=172.16.60.1-172.16.60.87,172.16.60.89-172.16.60.254
add name=dhcp_pool70 ranges=172.16.70.1-172.16.70.87,172.16.70.89-172.16.70.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=12h name=defconf
add address-pool=dhcp_pool50 interface=vlan50 lease-time=12h name=dhcp50
add address-pool=dhcp_pool60 interface=vlan60 lease-time=12h name=dhcp60
add address-pool=dhcp_pool70 interface=vlan70 lease-time=12h name=dhcp70
/interface bridge port
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=ether2 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=ether3 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=ether5 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=wlan1 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=wlan2 internal-path-cost=10 path-cost=10
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=bridge,ether2,ether3,ether4,ether5,wlan1,wlan2 vlan-ids=50
add bridge=bridge tagged=bridge,ether2,ether3,ether4,ether5,wlan1,wlan2 vlan-ids=60
add bridge=bridge tagged=bridge,ether2,ether3,ether4,ether5,wlan1,wlan2 vlan-ids=70
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=vlan50 list=VLAN
add interface=vlan60 list=VLAN
add interface=vlan70 list=VLAN
/ip address
add address=172.16.10.1/24 comment=defconf interface=bridge network=172.16.10.0
add address=172.16.50.88/24 interface=vlan50 network=172.16.50.0
add address=172.16.60.88/24 interface=vlan60 network=172.16.60.0
add address=172.16.70.88/24 interface=vlan70 network=172.16.70.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=172.16.10.0/24 comment=defconf dns-server=172.16.10.1 gateway=172.16.10.1
add address=172.16.50.0/24 dns-server=172.16.50.88 gateway=172.16.50.88
add address=172.16.60.0/24 dns-server=172.16.60.88 gateway=172.16.60.88
add address=172.16.70.0/24 dns-server=172.16.70.88 gateway=172.16.70.88
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.1.1.2 verify-doh-cert=yes
/ip dns static
add address=172.16.10.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="Allow VLAN - input" in-interface-list=VLAN
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="Allow VLAN - forward" in-interface-list=VLAN
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=pppoe-isp
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN