(1) What do you mean NONE? If you start using vlans, then simply make all subnets vlans, clean, apples to apples consistent approach.
(2) Questionable security approach - you have winbox&ssh disabled but you have IP Service WWW enabled. ???
(3) Just disable IPV6 if not using it.
(4) The confusing nomenclature for lists means errors, and yes, you have VLAN in commentary for DNS but use LAN for rules.
Stick to conventions for conventions, and use other names for distinct non OS conventional functions.
( NTP and DNS can go on same udp rule )
(5) What is the point of the above rules anyway if you have a nonsensical matching last rule…
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN log-prefix=a
If your last rule is block everything except from the LAN, why bother with allow services to LAN members above that…???
So change last rule to DROP ALL ELSE!!
/interface bridge
add admin-mac=CC:2D:E0:C2:9A:F2 auto-mac=no comment=defconf name=bridge \
vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b country="united states3" \
disabled=no distance=indoors frequency=auto hide-ssid=yes installation=\
indoor mode=ap-bridge name=wlan-2 ssid=squeegee-2 wireless-protocol=802.11 \
wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX country="united states3" disabled=no distance=indoors \
frequency=auto hide-ssid=yes installation=indoor mode=ap-bridge name=\
wlan-5 ssid=squeegee-5 wireless-protocol=802.11 wps-mode=disabled
/interface vlan
add interface=bridge name=vlan-device vlan-id=40
add interface=bridge name=vlan-server-external vlan-id=60
add interface=bridge name=vlan-server-internal vlan-id=50
add interface=bridge name=vlan-none vlan-id=11
/interface list
add comment=defconf name=WAN
add name=VLAN-SERVER
add include=VLAN-SERVER name=VLAN
add comment="no VLAN" exclude=VLAN name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=\
security-profile-device supplicant-identity=MikroTik
/interface wireless
add disabled=no hide-ssid=yes mac-address=CE:2D:E0:C2:9A:F6 master-interface=\
wlan-2 name=wlan-2-device security-profile=security-profile-device ssid=\
squeegee-2-device wds-default-bridge=bridge wps-mode=disabled
add disabled=no hide-ssid=yes mac-address=CE:2D:E0:C2:9A:F7 master-interface=\
wlan-5 name=wlan-5-device security-profile=security-profile-device ssid=\
squeegee-5-device wds-default-bridge=bridge wps-mode=disabled
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=pool-device ranges=10.0.40.2-10.0.40.254
add name=pool-server-internal ranges=10.0.50.2-10.0.50.254
add name=pool-server-external ranges=10.0.60.2-10.0.60.254
/ip dhcp-server
add address-pool=default-dhcp interface=vlan-none lease-time=10m name=defconf
add address-pool=pool-device interface=vlan-device lease-time=10m name=\
dhcp-server-device
add address-pool=pool-server-internal interface=vlan-server-internal \
lease-time=10m name=dhcp-server-server-internal
add address-pool=pool-server-external interface=vlan-server-external \
lease-time=10m name=dhcp-server-server-external
/interface bridge port
add bridge=bridge ingress-filtering=yes frame-types=\
admit-only-untagged-and-priority-tagged interface=ether2 pvid=50
add bridge=bridge ingress-filtering=yes frame-types=\
admit-only-untagged-and-priority-tagged interface=ether3 pvid=60
add bridge=bridge ingress-filtering=yes frame-types=\
admit-only-untagged-and-priority-tagged interface=ether4 pvid=11
add bridge=bridge ingress-filtering=yes frame-types=\
admit-only-untagged-and-priority-tagged interface=ether5 pvid=11
add bridge=bridge ingress-filtering=yes frame-types=\
admit-only-untagged-and-priority-tagged interface=wlan-2 pvid=11
add bridge=bridge ingress-filtering=yes frame-types=\
admit-only-untagged-and-priority-tagged interface=wlan-5 pvid=11
add bridge=bridge ingress-filtering=yes frame-types=\
admit-only-untagged-and-priority-tagged interface=wlan-2-device pvid=40
add bridge=bridge ingress-filtering=yes frame-types=\
admit-only-untagged-and-priority-tagged interface=wlan-5-device pvid=40
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=bridge untagged=ether4,ether5,wlan-2,wlan-5 vlan-ids=11
add bridge=bridge tagged=bridge untagged=ether2 vlan-ids=50
add bridge=bridge tagged=bridge untagged=ether3 vlan-ids=60
add bridge=bridge tagged=bridge untagged=wlan-2-device,wlan-5-device vlan-ids=40
/interface list member
add comment=defconf interface=ether1 list=WAN
add interface=vlan-none list=LAN
add interface=vlan-server-external list=LAN
add interface=vlan-server-internal list=LAN
add interface=vlan-device list=LAN
add interface=vlan-server-external list=VLAN-SERVER { but why you have no rules for this }
add interface=vlan-server-internal list=VLAN-SERVER { but why you have no rules for this }
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=192.168.88.1/24 comment=defconf interface=vlan-none network=\
192.168.88.0
add address=10.0.40.1/24 interface=vlan-device network=10.0.40.0
add address=10.0.50.1/24 interface=vlan-server-internal network=10.0.50.0
add address=10.0.60.1/24 interface=vlan-server-external network=10.0.60.0
/ip cloud
set update-time=no
/ip dhcp-client
add comment=defconf interface=ether1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router.home
/ip firewall address-list
add ip-address=admin-1 list=Authorized comment=admin-desktop
add ip-address=admin-2 list=Authorized comment=admin-laptop
add ip-address=admin-3 list=Authorized comment=admin-smartphone
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes \
protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" disabled=yes \
dst-address=127.0.0.1
add action=accept chain=input in-interface-list=LAN src-address=list=Authorized
add action=accept chain=input comment="accept Services UDP" \
dst-port=53,123 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="accept Services TCP" \
dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment="drop all else"
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid log-prefix=b
add action=accept chain=forward comment="internet" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat { disable or remove if not required }
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set www-ssl address=192.168.88.0/24 certificate=router.home \
disabled=no tls-version=only-1.2
set api disabled=yes
set winbox disabled=no
set api-ssl disabled=yes
/ipv6 settings
set disable-ipv6=yes forward=no
/system clock
set time-zone-autodetect=no time-zone-name=UTC
/system identity
set name=router
/system logging
add action=disk prefix=a topics=firewall
add action=disk prefix=b topics=firewall
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes
/system ntp client servers
add address=216.239.35.12
add address=216.239.35.4
/system routerboard settings
set auto-upgrade=yes
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=LAN
…
Thus far with the above firewall rules, all vlans are not accessible to one another.
If you desire specific access then add forward chain rules before the drop all rule at the end.
Typically - All LAN to shared printer
Typically - ADMIN to all LAN
