Configured using: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
hex S:
# aug/01/2019 18:21:07 by RouterOS 6.45.2
# software id = HJFI-YNP6
#
# model = RB760iGS
# serial number =
/interface bridge
add name=BR1 protocol-mode=none vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN-livebox
set [ find default-name=ether4 ] name=ether4-TRUNK-MR3020
set [ find default-name=ether5 ] advertise=100M-full,1000M-full name=ether5-TRUNK-RB951G
/interface vlan
add interface=BR1 name=GUEST_VLAN vlan-id=20
add interface=BR1 name=HOME_VLAN vlan-id=10
add interface=BR1 name=MANAGEMENT vlan-id=99
/interface list
add name=WAN
add name=VLAN
add name=BASE
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip ipsec mode-config
add name=NordVPN responder=no src-address-list=HOME
/ip ipsec policy group
add name=NordVPN
/ip ipsec profile
add name=NordVPN
/ip ipsec peer
add address=ca458.nordvpn.com exchange-mode=ike2 name=NordVPN_CA458 profile=NordVPN
/ip ipsec proposal
add name=NordVPN pfs-group=none
/ip pool
add name=HOME ranges=192.168.5.100-192.168.5.254
add name=GUEST ranges=192.168.20.2-192.168.20.254
add name=MANAGEMENT ranges=192.168.0.10-192.168.0.254
/ip dhcp-server
add address-pool=GUEST disabled=no interface=GUEST_VLAN name=GUEST
add address-pool=MANAGEMENT disabled=no interface=MANAGEMENT name=MANAGEMENT
add address-pool=HOME disabled=no interface=HOME_VLAN lease-time=12h name=HOME
/dude
set enabled=yes
/interface bridge port
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=ether2 pvid=10
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=ether3 pvid=10
add bridge=BR1 frame-types=admit-only-vlan-tagged ingress-filtering=yes interface=ether4-TRUNK-MR3020
add bridge=BR1 ingress-filtering=yes interface=ether5-TRUNK-RB951G
/interface bridge vlan
add bridge=BR1 tagged=BR1,ether4-TRUNK-MR3020,ether5-TRUNK-RB951G untagged=ether2,ether3 vlan-ids=10
add bridge=BR1 tagged=BR1,ether4-TRUNK-MR3020,ether5-TRUNK-RB951G vlan-ids=99
add bridge=BR1 tagged=BR1,ether4-TRUNK-MR3020,ether5-TRUNK-RB951G vlan-ids=20
/interface detect-internet
set detect-interface-list=all
/interface list member
add interface=ether1-WAN-livebox list=WAN
add interface=MANAGEMENT list=VLAN
add interface=HOME_VLAN list=VLAN
add interface=GUEST_VLAN list=VLAN
add interface=MANAGEMENT list=BASE
/ip address
add address=192.168.0.1/24 interface=MANAGEMENT network=192.168.0.0
add address=192.168.5.1/24 interface=HOME_VLAN network=192.168.5.0
add address=192.168.20.1/24 interface=GUEST_VLAN network=192.168.20.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether1-WAN-livebox use-peer-dns=no use-peer-ntp=no
/ip dhcp-server lease
add address=192.168.5.40 client-id=1:6c:88:14:9:f4:dc comment="" mac-address=6C:88:14:09:F4:DC server=HOME
add address=192.168.5.41 client-id=1:3c:a9:f4:35:9f:60 comment="" mac-address=3C:A9:F4:35:9F:60 server=HOME
add address=192.168.5.61 comment= mac-address=34:CE:00:8B:97:2E server=HOME
add address=192.168.5.60 comment= mac-address=34:CE:00:8C:FA:18 server=HOME
add address=192.168.5.30 client-id=1:3c:97:e:86:dd:4a comment="" mac-address=3C:97:0E:86:DD:4A server=HOME
add address=192.168.5.20 comment= mac-address=00:11:32:05:03:60 server=HOME
add address=192.168.5.10 comment= mac-address=1C:C1:DE:84:07:85 server=HOME
add address=192.168.5.11 comment= mac-address=04:B1:67:AD:57:EC server=HOME
add address=192.168.5.50 client-id=1:48:2c:a0:7d:8:6b comment="" mac-address=48:2C:A0:7D:08:6B server=HOME
add address=192.168.0.41 client-id=1:3c:a9:f4:35:9f:60 comment="" mac-address=3C:A9:F4:35:9F:60 server=MANAGEMENT
add address=192.168.5.246 comment= mac-address=34:CE:00:8B:55:CC server=HOME
add address=192.168.0.40 client-id=1:6c:88:14:9:f4:dc comment="" mac-address=6C:88:14:09:F4:DC server=MANAGEMENT
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.0.1
add address=192.168.5.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.5.1 ntp-server=192.168.5.1
add address=192.168.20.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.20.1 ntp-server=192.168.20.1
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=192.168.5.0 list=HOME
/ip firewall filter
add action=drop chain=forward comment="Drop invalid connections through router" connection-state=invalid
add chain=forward comment="Allow established connections through router" connection-state=established
add chain=forward comment="Allow related connections through router" connection-state=related
add action=accept chain=forward comment="Allow new connections through router coming in LAN interface" connection-state=new in-interface-list=VLAN
add action=drop chain=forward comment="Drop all other connections through the router"
add action=accept chain=input comment="Allow everything from the LAN interface to the router" in-interface-list=VLAN
add chain=input comment="Allow established connections to the router, these are OK because we aren't allowing new connections" connection-state=established
add chain=input comment="Allow related connections to the router, these are OK because we aren't allowing new connections" connection-state=related
add action=drop chain=input comment="Drop everything else to the router" disabled=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-WAN-livebox src-address=192.168.5.0/24
add action=masquerade chain=srcnat out-interface=ether1-WAN-livebox src-address=192.168.20.0/24
add action=masquerade chain=srcnat out-interface=ether1-WAN-livebox src-address=192.168.0.0/24
/ip ipsec identity
add auth-method=eap certificate="" eap-methods=eap-mschapv2 generate-policy=port-strict mode-config=NordVPN peer=NordVPN_CA458 policy-template-group=NordVPN username=\
sliwma@
/ip ipsec policy
add dst-address=0.0.0.0/0 group=NordVPN proposal=NordVPN src-address=0.0.0.0/0 template=yes
/ip route
add distance=1 gateway=192.168.1.1
/snmp
set enabled=yes
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=RB760iGS
/system ntp client
set enabled=yes primary-ntp=193.110.137.171 secondary-ntp=158.75.5.245
/system ntp server
set enabled=yes manycast=no multicast=yes
/tool graphing interface
add
/tool graphing queue
add
/tool graphing resource
add
RB951G-2HnD:
# aug/01/2019 18:22:13 by RouterOS 6.45.2
# software id = H0WX-WRI7
#
# model = 951G-2HnD
# serial number = 5D610578998E
/interface bridge
add name=BR1 protocol-mode=none vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=ether1-TRUNK
/interface vlan
add interface=BR1 name=MANAGEMENT-VLAN vlan-id=99
/interface list
add name=BASE
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=GUEST supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name= MANAGEMENT supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=HOME supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] disabled=no frequency=auto mode=ap-bridge name=wlan1-HOME security-profile=HOME ssid="Home 2G"
add disabled=no mac-address=E6:8D:8C:9C:A3:39 master-interface=wlan1-HOME name=wlan2-GUEST security-profile=GUEST ssid="Guest 2G" wps-mode=disabled
add disabled=no mac-address=E6:8D:8C:9C:A3:3A master-interface=wlan1-HOME name=wlan3-MANAGEMENT security-profile=MANAGEMENT ssid=Management wps-mode=disabled
/interface bridge port
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=wlan1-HOME pvid=10
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=wlan2-GUEST pvid=20
add bridge=BR1 frame-types=admit-only-untagged-and-priority-tagged ingress-filtering=yes interface=wlan3-MANAGEMENT pvid=99
add bridge=BR1 interface=ether2 pvid=10
add bridge=BR1 interface=ether3 pvid=10
add bridge=BR1 interface=ether4 pvid=10
add bridge=BR1 interface=ether5 pvid=10
add bridge=BR1 frame-types=admit-only-vlan-tagged ingress-filtering=yes interface=ether1-TRUNK
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=BR1 tagged=ether1-TRUNK untagged=wlan1-HOME,ether2,ether3,ether4,ether5 vlan-ids=10
add bridge=BR1 tagged=ether1-TRUNK untagged=wlan2-GUEST vlan-ids=20
add bridge=BR1 tagged=ether1-TRUNK untagged=wlan3-MANAGEMENT vlan-ids=30
add bridge=BR1 tagged=BR1,ether1-TRUNK untagged=wlan3-MANAGEMENT vlan-ids=99
/interface list member
add interface=MANAGEMENT-VLAN list=BASE
/ip address
add address=192.168.0.2/24 interface=MANAGEMENT-VLAN network=192.168.0.0
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip route
add distance=1 gateway=192.168.0.1
/snmp
set enabled=yes
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=RB951G-2HnD
/tool mac-server
set allowed-interface-list=BASE
/tool mac-server mac-winbox
set allowed-interface-list=BASE