Ping specific IP from different VLAN?

RouterOS General
1

In Mikrotik RB951ui-2hnd, I setup 2 WANs and 4 LANs. For the first and second LANs, they access Internet using WAN1. I have attached a printer to the first VLAN. I cannot communicate to the printer from other VLANs. I have tried Google for a month, but I cannot do it. Could you please help me.

Below is my script on the RB951Ui-2HnD

jan/02/1970 14:29:44 by RouterOS 6.34.4

software id = QSI1-GKWK

/interface bridge
add name=bridge1
add name=bridgemgt
/interface vlan
add interface=bridge1 name=AAA vlan-id=1100
add interface=bridge1 name=BBB vlan-id=1200
add interface=bridge1 name=CCC vlan-id=1300
add interface=bridge1 name=DDD vlan-id=1400
/ip pool
add name=dhcp_pool1 ranges=192.168.8.2-192.168.8.20
add name=dhcp_pool2 ranges=192.168.3.10-192.168.3.254
add name=dhcp_pool3 ranges=192.168.4.10-192.168.4.254
add name=dhcp_pool4 ranges=192.168.5.10-192.168.5.254
add name=dhcp_pool5 ranges=192.168.6.10-192.168.6.254
add name=dhcp_pool6 ranges=192.168.8.2-192.168.8.20
/ip dhcp-server
add address-pool=dhcp_pool2 disabled=no interface=AAA name=dhcp2
add address-pool=dhcp_pool3 disabled=no interface=BBB name=dhcp3
add address-pool=dhcp_pool4 disabled=no interface=CCC name=dhcp4
add address-pool=dhcp_pool5 disabled=no interface=DDD name=dhcp5
add address-pool=dhcp_pool6 disabled=no interface=bridge1 name=dhcp1
/interface bridge port
add bridge=bridge1 interface=ether3
add bridge=bridgemgt interface=ether5
/ip address
add address=192.168.8.1/24 interface=ether3 network=192.168.8.0
add address=192.168.3.1/24 interface=AAA network=192.168.3.0
add address=192.168.4.1/24 interface=BBB network=192.168.4.0
add address=192.168.5.1/24 interface=CCC network=192.168.5.0
add address=192.168.6.1/24 interface=DDD network=192.168.6.0
/ip dhcp-client
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no
interface=ether1
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no
interface=ether2
/ip dhcp-server network
add address=192.168.3.0/24 gateway=192.168.3.1
add address=192.168.4.0/24 gateway=192.168.4.1
add address=192.168.5.0/24 gateway=192.168.5.1
add address=192.168.6.0/24 gateway=192.168.6.1
add address=192.168.8.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.8.1
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=GETCSWAN1
src-address=192.168.3.0/24
add action=mark-routing chain=prerouting new-routing-mark=GETDSUWAN1
src-address=192.168.4.0/24
add action=mark-routing chain=prerouting new-routing-mark=GETGUESTWAN2
src-address=192.168.5.0/24
add action=mark-routing chain=prerouting new-routing-mark=GETSTAFFWAN2
src-address=192.168.6.0/24
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=ether2
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set pptp disabled=yes
/ip route
add distance=1 gateway=192.168.1.1 routing-mark=GETCSWAN1
add distance=1 gateway=192.168.1.1 routing-mark=GETDSUWAN1
add distance=1 gateway=192.168.2.1 routing-mark=GETGUESTWAN2
add distance=1 gateway=192.168.2.1 routing-mark=GETSTAFFWAN2
add distance=1 gateway=192.168.2.1
add distance=1 gateway=192.168.1.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system leds
set 5 interface=wlan1
/system routerboard settings
set protected-routerboot=disabled

2

You have to exclude the local destination subnets from the mangle rules assigning the routing marks. Excluding the whole 192.168.0.0/16 may be the simplest way unless you access part of this range via the WANs. Once a packet gets a routing mark, only routes with the same routing mark are used for that packet, and there are no such routes to the local destinations. The other way round would be to add routing-marked routes to the connected subnets.

3

My take on the subject… (by the way your pool1 and pool6 are duplicates)

Interface list
WAN-ether1
WAN-ether2
LAN-bridge1
LAN-bridgemgt

/ip route
add distance=1 gateway=192.168.1.1 routing-mark=markWAN1
add distance=1 gateway=192.168.2.1 routing-mark=markWAN2
add distance=2 gateway=192.168.2.1
add distance=1 gateway=192.168.1.1 ping gateway

/ip firewall mange
add chain=prerouting action=mark-connection new-connection-mark=cm_wan1 in-interface=bridge1 src-address-list=useWAN1 passthrough=yes
add chain=prerouting action=mark-route connection-mark=cm_wan1 new-routing-mark=markWAN1 passthrough=no

add chain=prerouting action=mark-connection new-connection-mark=cm_wan2 in-interface=bridge1 src-address-list=useWAN2 passthrough=yes
add chain=prerouting action=mark-route connection-mark=cm_wan2 new-routing-mark=markWAN2 passthrough=no

/ip firewall address list NAME=useWAN1
add 192.168.3.10-192.168.2.254
add 192.168.4.10-192.168.254

/ip firewall address lit NAME=useWAN2
add 192.168.5.10-192.168.4.254
add 192.168.6.10-192.168.5.254

/IP firewall address list NAME=ALL_LANS
add 192.168.3.10-192.168.2.254
add 192.168.4.10-192.168.254
add 192.168.5.10-192.168.4.254
add 192.168.6.10-192.168.5.254
add 192.168.8.2-192.168.8.20

/IP firewall address list NAME=adminaccess
pc 1 allowed to administer router
pc 2 allowed to administer router etc.

/ip firewall address list NAME=shared devices
printer1_colour - 192.168.3.22
printer2_bw -192.168.4.22
printer3_11x17 - 192.168.5.22
printer_photos - 192.168.6.22

/IP firewall filter
{input chain}
add action=accept in-interface=bridgemgt source-address-list=admin access

{forward chain}
{default rules at start of chain} then
add action=accept in-interface=bridgemgt out-interface=WAN
add action=accept in-interface=bridge1 out-interface=WAN1 source-address-list=useWAN1
add action=accept in-interface=bridge1 out-interface=WAN2 source-address-list=useWAN2
add action=accept in-interface=LAN source-address-list=ALL_LANS dst-address-list=shared devices
add action=accept in-interface=bridgemgt source-address-list=adminaccess dst-address-list=ALL_LANS
Add drop all else.