SOLVED: MikroTik Fault Report — Wireless Client-to-Client Forwarding Failure

RouterOS Wireless Networking
1

Device: MikroTik hAP be lite, model A42G-HbeP Serial number: HMQ0BAJG73N RouterOS version: 7.24.1 (stable), built 2026-08-21 RouterBOARD firmware: 7.24.1 (confirmed current, rebooted after upgrade)

Secondary device involved: MikroTik hEX, model E50UG hEX RouterBOARD firmware: 7.24.1 (confirmed current)

Summary

Wireless clients associated to the same AP/radio cannot exchange traffic directly with each other. Traffic from the same clients routed through a wired gateway (via the AP) works normally. This indicates the failure is at the wifi radio/driver's intra-BSS (station-to-station) relay layer, not at the bridge or IP layer.

Topology

  • hAP bridge: bridge-lan, arp=enabled, fast-forward=yes
  • Wifi interfaces: wifi1 (2.4GHz, SSID "Xierion 2.4 GHz"), wifi2 (5GHz, SSID "Xierion 5 GHz")
  • Both affected clients are associated on wifi1

Devices involved

Role Device MAC IP
Client A Raspberry Pi ("sparkx") B8:27:EB:08:E7:E9 192.168.100.9
Client B TP-Link Tapo P100 smart plug EC:B9:31:73:0E:7C 192.168.100.7

Symptom

  • 192.168.100.9 (Pi) → 192.168.100.7 (plug): ICMP requests sent, no replies ever received
  • 10.0.0.5 (separate subnet, routed through gateway Xierion-hEX → through hAP → wifi1): ICMP requests to same plug succeed 100%, every time
  • Both paths transit the same wifi1 radio to reach the plug — only the direct client-to-client path fails

Settings already checked and ruled out

  • /interface wifi configuration — datapath.client-isolation not set (default/off)
  • /interface bridge port — horizon=none on all ports including wifi1/wifi2
  • /interface bridge filter — empty, no rules
  • /ip firewall filter — not applicable (use-ip-firewall=no on bridge)
  • /interface bridge host print — plug's MAC correctly learned on wifi1 (bridge FDB is correct)
  • ARP resolution — confirmed failing specifically for direct/local queries; bypassing ARP entirely via static neighbor entries did not restore connectivity, ruling out ARP as root cause

Diagnostic evidence: packet capture

Captured on hAP via /tool sniffer filtered to both MACs on wifi1:

192.168.100.9 → 192.168.100.7   icmp   (repeated, e.g. t=7.642, 8.667, 9.694, 10.718, 11.742...)
   → no corresponding reply ever captured

10.0.0.5 → 192.168.100.7        icmp   (repeated throughout)
192.168.100.7 → 10.0.0.5        icmp   (reply, every single time)

Steps already taken that did not resolve it

  • Power cycling the plug (multiple times, including extended 30s+ off)
  • Static ARP entries on hAP and hEX pointing directly to the plug's MAC
  • Static neighbor entry on the Pi (ip neigh add ... nud permanent) — direct ICMP to plug's MAC still failed
  • Full RouterOS + RouterBOARD firmware upgrade on both hAP and hEX to 7.24.1, followed by reboot — issue persisted unchanged

Request

Confirm whether this is expected behavior, a known issue with the wifi driver's intra-BSS forwarding on the hAP be lite, or a bug — and what steps (if any) resolve it. Happy to provide a supout.rif file on request.

2

supout.rif is something only to be sent to support when you make a ticket.
This is a user forum, we usually would like to see export of configuration (minus serial, passwd, ...)

Paste here between < / > quotes.

3

Update: Since posting, I re-tested by clearing the ARP entry on the wired gateway (hEX) and forcing a fresh resolution rather than relying on ping. Result: the gateway also fails to resolve the plug's MAC once its ARP cache is cleared — identical failure to what I saw from the wireless clients.

This changes the picture from what I originally described. It's not specific to wireless client-to-client (intra-BSS) forwarding — the wired gateway going through the same AP uplink fails too, once a genuinely fresh ARP request is required. My earlier "wired path works" result was riding a stale cached ARP entry from before, not live resolution.

So the actual symptom looks like: the plug intermittently or persistently stops answering ARP requests from any querying device, not just wireless peers. Apologies for the incomplete framing in the original post — wanted to correct it before anyone spent time chasing the wireless-specific angle.

Second update: Further testing refined this again. A Windows PC on a separate subnet (10.0.0.5), routed through the same gateway (hEX), was able to ping the plug successfully on a genuinely fresh ARP resolution (no cached entry existed — arp -d returned "entry not found" before the successful ping).

So the failure isn't universal after all. The actual pattern looks like:

  • Direct wireless client-to-client traffic (e.g. a Pi and the plug, both associated to the same AP radio): fails consistently — no reply ever received
  • Traffic locally originated by a router's own control plane (e.g. /ping run directly from the gateway's own CLI) to the plug: fails once its ARP cache is cleared
  • Traffic forwarded/routed through a gateway (e.g. from a separate subnet, transiting the gateway to reach the plug): succeeds consistently, even on a fresh ARP resolution

This suggests two distinct failure modes rather than one: an intra-BSS (station-to-station) forwarding failure at the AP for direct wireless-to-wireless traffic, and a separate issue with routers' own locally-originated ARP resolution to this specific device — while the routing/forwarding datapath itself works fine. Will keep this thread updated as testing continues.

Config exports

As requested, sanitized /export hide-sensitive output from both devices, trimmed to sections relevant to this issue (IoT VLAN/bridge/wifi config). Unrelated VLANs, firewall rules, backup scripts, and other services removed for brevity and to avoid sharing unrelated internal details.

Xierion-hEX (gateway)

RouterOS 7.24.1

model = E50UG



/interface bonding
add mode=balance-xor name=Default slaves=ether2,ether3,ether4,ether5

/interface vlan
add interface=Default name=IoT vlan-id=100

/interface list
add name=WAN
add name=LAN

/ip pool
add name=IoT ranges=192.168.100.128-192.168.100.254

/ip dhcp-server
add address-pool=IoT interface=IoT name=IoT

/ip address
add address=192.168.100.1/24 comment=IoT interface=IoT network=192.168.100.0

/ip dhcp-server lease
add address=192.168.100.7 comment="Smart Plug" mac-address=EC:B9:31:73:0E:7C server=IoT
add address=192.168.100.9 client-id=1:b8:27:eb:8:e7:e9 comment="SparkX Pi" mac-address=B8:27:EB:08:E7:E9 server=IoT

/ip dhcp-server network
add address=192.168.100.0/24 comment=100 dns-server=192.168.100.1 gateway=192.168.100.1

Note: the hEX also carries several other VLANs (Server, DMZ, Other, Backup) unrelated to this issue — trimmed for brevity.

Xierion-hAP (AP, bridging the affected wireless clients)

RouterOS 7.24.1

model = A42G-HbeP

/interface bridge
add name=bridge-lan protocol-mode=none

/interface wifi security
add authentication-types=wpa2-psk disabled=no name=xierion-sec-5
add authentication-types=wpa2-psk name=xierion-sec-24

/interface wifi
set [ find default-name=wifi1 ] channel.band=2ghz-ax .width=20/40mhz configuration.ssid="Xierion 2.4 GHz" disabled=no security=xierion-sec-24
set [ find default-name=wifi2 ] channel.band=5ghz-ax .width=20/40/80mhz configuration.ssid="Xierion 5 GHz" disabled=no security=xierion-sec-5

/interface bridge port
add bridge=bridge-lan interface=ether1
add bridge=bridge-lan interface=ether2
add bridge=bridge-lan interface=ether3
add bridge=bridge-lan interface=ether4
add bridge=bridge-lan interface=wifi1
add bridge=bridge-lan interface=wifi2

/ip address
add address=192.168.100.2/24 interface=bridge-lan network=192.168.100.0

/ip route
add gateway=192.168.100.1

/tool sniffer
set file-name=tapo_21:04:51 filter-interface=wifi1 filter-mac-address=EC:B9:31:73:0E:7C/FF:FF:FF:FF:FF:FF,B8:27:EB:08:E7:E9/FF:FF:FF:FF:FF:FF
4

My two cents, though I understand how properly sanitizing a (complex) configuration may be a bit of work, the configuration snippets you posted are way too reduced to give us an idea of what might be happening.

5

If you know where the problem is, why are you asking help to us?
If we ask you for a total /export, you have to send that.

The only thing you need to do is check that there are no usernames, passwords, serial numbers, or IP (truly) public addresses in the export.
For the rest, we want to see it in full.

6

Nothing is related unless you already have a rood cause. And stuff like:

... suggests a high level complexity than a typical network.

7

I appreciate you all for taking the time to look at my issue. My apologies for any frustration caused, and i appreciate that my first impression is not the greatest.

I was using Claude AI to assist in troubleshooting and when it suggested to post in this forum, it provided me what to post along with the redacted configurations.

I have built the config for the hEX refresh myself over a period of time, however as the hAP was a new device, I (potentially mistakenly) used AI to build me a config. With my confidence in AI returning to what it once was (avoiding at all cost), my next step is to factory reset the hAP and build the config manually to see if the problem persists.

For what it is worth, please find below my manually sanitised configuration files:

hEX refresh (I have had to remove some of the address-list items due to text limitations when posting):

# 2026-08-29 09:30:26 by RouterOS 7.24.1
# software id = [REDACTED]
#
# model = E50UG
# serial number = [REDACTED]
/interface wireguard
add listen-port=13231 mtu=1420 name=WireGuard
/interface bonding
add mode=balance-xor name=Default slaves=ether2,ether3,ether4,ether5
/interface vlan
add interface=Default name=Backup vlan-id=4000
add interface=Default name=DMZ vlan-id=95
add interface=Default name=IoT vlan-id=100
add interface=Default name=Other vlan-id=69
add interface=Default name=Server vlan-id=3000
/interface list
add name=WAN
add name=LAN
/ip pool
add name=IoT ranges=192.168.100.128-192.168.100.254
add name=Server ranges=10.10.10.128-10.10.10.254
add name=Default ranges=10.0.0.128-10.0.0.254
add name=DMZ ranges=192.168.95.128-192.168.95.254
add name=Backup ranges=10.40.0.128-10.40.0.254
add name=Other ranges=192.168.69.128-192.168.69.254
/ip dhcp-server
add address-pool=IoT interface=IoT name=IoT
add address-pool=Server interface=Server name=Server
add address-pool=Default interface=Default name=Default
add address-pool=DMZ interface=DMZ name=DMZ
add address-pool=Backup interface=Backup name=Backup
add address-pool=Other interface=Other name=Other
/system logging action
add name=syslog remote=10.10.10.14 remote-log-format=syslog target=remote
/system script
add dont-require-permissions=no name=DailyBackupScript owner=Xierion policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
    log info \"Starting backup script\";\
    \n:global sysname [/system identity get name]\
    \n:global date [/system clock get date]\
    \n:global time [/system clock get time]\
    \n:global filename \"\$sysname-backup-\$date-\$time\"\
    \n\
    \n# Create binary backup file\
    \n/system backup save name=\"\$filename\" dont-encrypt=yes\
    \n:delay 2s\
    \n\
    \n# Create export configuration file (includes sensitive data like passwor\
    ds if \"show-sensitive\" is specified in RouterOS v7+)\
    \n/export file=\"\$filename\" show-sensitive\
    \n:delay 2s\
    \n\
    \n# Send both files via email\
    \n/tool e-mail send to=\"[REDACTED]" subject=\"MikroTik B\
    ackup: \$sysname \$date\" body=\"Attached are the backup (.backup) and exp\
    ort (.rsc) files for router \$sysname.\" file=\"\$filename.backup,\$filena\
    me.rsc\"\
    \n\
    \n# Log completion and clean up files (optional, helps save space)\
    \n:log info \"Backup script completed, files emailed.\"\
    \n:delay 10s\
    \n/file remove \"\$filename.backup\"\
    \n/file remove \"\$filename.rsc\""
add dont-require-permissions=no name=uptimerobot-update-iplist owner=Xierion \
    policy=ftp,read,write,test source=":local listName \"UptimeRobot\"\
    \n:local minExpected 50\
    \n:local tmpFile \"uptimerobot-update.txt\"\
    \n\
    \n:do {\
    \n    /file remove [/file find name=\$tmpFile]\
    \n} on-error={}\
    \n\
    \n/tool fetch url=\"https://cdn.uptimerobot.com/api/IPv4.txt\" dst-path=\$\
    tmpFile\
    \n:delay 3s\
    \n\
    \n:local data [/file get [/file find name=\$tmpFile] contents]\
    \n\
    \n:local ipList ({})\
    \n:local remaining \$data\
    \n:while ([:len \$remaining] > 0) do={\
    \n    :local pos [:find \$remaining \"\\n\"]\
    \n    :local ip \"\"\
    \n    :if (\$pos = -1) do={\
    \n        :set ip \$remaining\
    \n        :set remaining \"\"\
    \n    } else={\
    \n        :set ip [:pick \$remaining 0 \$pos]\
    \n        :set remaining [:pick \$remaining (\$pos+1) [:len \$remaining]]\
    \n    }\
    \n    :if ([:len \$ip] > 0) do={\
    \n        :if ([:pick \$ip ([:len \$ip]-1) [:len \$ip]] = \"\\r\") do={\
    \n            :set ip [:pick \$ip 0 ([:len \$ip]-1)]\
    \n        }\
    \n    }\
    \n    :if ([:len \$ip] > 6) do={\
    \n        :set ipList (\$ipList , \$ip)\
    \n    }\
    \n}\
    \n\
    \n:local newCount [:len \$ipList]\
    \n:if (\$newCount < \$minExpected) do={\
    \n    :log error (\"uptimerobot-update-iplist: ABORTED - only parsed \" . \
    \$newCount . \" IPs, expected at least \" . \$minExpected . \". List left \
    unchanged.\")\
    \n} else={\
    \n    :local today [/system clock get date]\
    \n    /ip firewall address-list remove [find list=\$listName]\
    \n    :foreach ip in=\$ipList do={\
    \n        /ip firewall address-list add list=\$listName address=\$ip comme\
    nt=(\"auto-updated \" . \$today)\
    \n    }\
    \n    :log info (\"uptimerobot-update-iplist: SUCCESS - list refreshed wit\
    h \" . \$newCount . \" IPs\")\
    \n}\
    \n\
    \n/file remove [/file find name=\$tmpFile]"
/interface detect-internet
set detect-interface-list=all lan-interface-list=LAN wan-interface-list=WAN
/interface list member
add interface=ether1 list=WAN
/interface ovpn-server server
add mac-address=FE:AE:E0:9B:06:98 name=ovpn-server1
/interface wireguard peers
add allowed-address=192.168.1.0/24 client-address=192.168.1.2/32 \
    client-allowed-address=0.0.0.0/0 client-dns=192.168.1.1 client-endpoint=\
    [REDACTED] client-listen-port=13231 interface=WireGuard \
    name=Xierion public-key=[REDACTED]
/ip address
add address=10.0.0.1/24 comment=Default interface=Default network=10.0.0.0
add address=10.10.10.1/24 comment=Server interface=Server network=10.10.10.0
add address=192.168.100.1/24 comment=IoT interface=IoT network=192.168.100.0
add address=192.168.69.1/24 comment=Other interface=Other network=\
    192.168.69.0
add address=192.168.95.1/24 comment=DMZ interface=DMZ network=192.168.95.0
add address=10.40.0.1/24 comment=Backup interface=Backup network=10.40.0.0
add address=192.168.1.1/24 comment=WireGuard interface=WireGuard network=\
    192.168.1.0
/ip arp
add address=10.10.10.127 comment="WoL Dummy" interface=*1A mac-address=\
    FF:FF:FF:FF:FF:FF
add address=10.10.10.20 comment=Xierion-PVE interface=*1A mac-address=\
    60:45:CB:9C:37:17
add address=10.10.10.12 comment=Xierion-NAS interface=*1A mac-address=\
    E0:D5:5E:CA:2A:19
/ip cloud
set ddns-enabled=yes ddns-update-interval=10m
/ip dhcp-client
add interface=ether1 name=client1
/ip dhcp-server lease
add address=192.168.100.3 mac-address=B8:27:EB:54:7A:36 server=IoT
add address=192.168.100.100 client-id=1:1c:bf:c0:f5:34:1b mac-address=\
    1C:BF:C0:F5:34:1B server=IoT
add address=192.168.100.13 client-id=1:32:13:83:6b:bd:d9 comment=\
    "Xierion A05s 5Ghz" mac-address=32:13:83:6B:BD:D9 server=IoT
add address=10.0.0.5 client-id=1:74:56:3c:ff:53:c mac-address=\
    74:56:3C:FF:53:0C server=Default
add address=192.168.100.64 client-id=1:2c:26:17:48:4b:ea mac-address=\
    2C:26:17:48:4B:EA server=IoT
add address=192.168.100.8 client-id=1:84:93:ec:14:60:f comment="SPARX i7" \
    mac-address=84:93:EC:14:60:0F server=IoT
add address=192.168.100.7 comment="Smart Plug" mac-address=EC:B9:31:73:0E:7C \
    server=IoT
add address=192.168.100.14 client-id=1:5a:a3:93:b6:89:94 comment=\
    "Xierion A05s 2.4Ghz" mac-address=5A:A3:93:B6:89:94 server=IoT
add address=192.168.100.9 client-id=1:b8:27:eb:8:e7:e9 comment="SparkX Pi" \
    mac-address=B8:27:EB:08:E7:E9 server=IoT
/ip dhcp-server network
add address=10.0.0.0/24 comment=1 dns-server=10.10.10.2 gateway=10.0.0.1
add address=10.10.10.0/24 comment=3000 dns-server=10.10.10.1 gateway=\
    10.10.10.1
add address=10.40.0.0/24 comment=4000 dns-server=10.40.0.1 gateway=10.40.0.1
add address=192.168.69.0/24 comment=69 dns-server=192.168.69.2 gateway=\
    192.168.69.1
add address=192.168.95.0/24 comment=95 dns-server=192.168.95.1 gateway=\
    192.168.95.1
add address=192.168.100.0/24 comment=100 dns-server=192.168.100.1 gateway=\
    192.168.100.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1
/ip firewall address-list
add address=10.0.0.0/8 list=RFC1918
add address=172.16.0.0/12 list=RFC1918
add address=192.168.0.0/16 list=RFC1918
add address=10.10.10.2 list=Pi-Hole
add address=10.0.0.5 list=Xierion-Prime
add address=10.10.10.12 list=Xierion-NAS
add address=0.0.0.0/0 list=WAN
add address=10.10.10.0/24 list="Server Subnet"
add address=10.10.10.20 list=Xierion-PVE
add address=192.168.95.10 list=SFTP
add address=[REDACTED]
add address=192.168.95.5 list=qBittorrent
add address=192.168.100.100 list=BrotherPrinter
add address=192.168.100.0/24 list="IoT Subnet"
add address=10.40.0.0/24 list="Backup Subnet"
add address=192.168.69.0/24 list="Other Subnet"
add address=192.168.95.0/24 list="DMZ Subnet"
add address=[REDACTED]
add address=[REDACTED]
add address=192.168.100.4 list=Fluidd
add address=192.168.1.2 list=Xierion-WG
add address=[REDACTED]
add address=192.168.1.0/24 list="WireGuard Subnet"
add address=10.10.10.14 list=rsyslog
add address=192.168.100.13 list=Xierion-s-A05s
add address=10.0.0.0/24 list="Default Subnet"
add address=192.168.100.64 list=Quest
add address=192.168.100.8 list="SPARK i7"
add address=192.168.100.14 list=Xierion-s-A05s
add address=192.168.100.9 list="SPARK i7 Pi"
add address=192.168.100.7 list="Smart Plug"
add address=10.10.10.4 list=Sonarr
add address=10.10.10.5 list="qBittorrent CT"
add address=10.10.10.3 list=Prowlarr
add address=10.10.10.6 list=Radarr
add address=10.10.10.7 list=Jellyfin
add address=10.10.10.9 list=Byparr
add address=192.168.100.2 list=Xierion-hAP
add address=10.10.10.10 list=UptimeKuma

add address=10.10.10.9 list=TapoHTTPBridge
/ip firewall filter
add action=fasttrack-connection chain=forward comment=FastTrack \
    connection-state=established,related
add action=accept chain=forward comment=Established connection-state=\
    established log-prefix=Established
add action=accept chain=forward comment=Related connection-state=related \
    log-prefix=Related
add action=accept chain=input comment=Established connection-state=\
    established log-prefix="Established Input"
add action=accept chain=input comment=Related connection-state=related \
    log-prefix="Related Input"
add action=accept chain=input log-prefix="ICMP Input" protocol=icmp
add action=accept chain=input dst-port=8291 log-prefix="WinBox TCP/IP" \
    protocol=tcp src-address-list="Default Subnet"
add action=accept chain=input dst-port=8291 log-prefix="WireGuard Admin" \
    protocol=tcp src-address-list=Xierion-WG
add action=accept chain=input dst-port=53 log-prefix="Internal DNS" protocol=\
    udp src-address-list=RFC1918
add action=accept chain=input dst-port=123 log=yes log-prefix="Internal Time" \
    protocol=udp src-address-list=RFC1918
add action=accept chain=input dst-port=80 log=yes log-prefix="Internal HTTP" \
    protocol=tcp src-address-list=RFC1918
add action=accept chain=input dst-port=13231 log-prefix="WireGuard Input" \
    protocol=udp
add action=drop chain=input comment="Input Deny" log-prefix="Input Deny"
add action=accept chain=forward comment=WoL dst-port=9 log=yes log-prefix=WoL \
    protocol=udp
add action=accept chain=forward comment=ICMP log-prefix="ICMP Forward" \
    protocol=icmp
add action=accept chain=forward dst-address-list=SFTP dst-port=5932 \
    log-prefix="SFTP Accept" protocol=tcp src-address-list=UptimeRobot
add action=accept chain=forward dst-address-list="SPARK i7 Pi" dst-port=5111 \
    log-prefix="SFTP Accept" protocol=tcp src-address-list=UptimeRobot
add action=accept chain=forward disabled=yes dst-address-list="SPARK i7 Pi" \
    dst-port=8080 log-prefix="SFTP Accept" protocol=tcp src-address-list=\
    [REDACTED]
add action=accept chain=forward dst-address-list=SFTP dst-port=5932 \
    log-prefix="SFTP Accept" protocol=tcp src-address-list=RFC1918
add action=accept chain=forward dst-address-list=SFTP dst-port=5932 log=yes \
    log-prefix="SFTP Accept" protocol=tcp src-address-list=[REDACTED]
add action=accept chain=forward dst-address-list=SFTP dst-port=5932 log=yes \
    log-prefix="SFTP Accept" protocol=tcp src-address-list=[REDACTED]
add action=accept chain=forward dst-address-list=SFTP dst-port=5932 log=yes \
    log-prefix="SFTP Accept" protocol=tcp src-address-list=\
    "[REDACTED]"
add action=drop chain=forward comment="SFTP Deny" dst-address-list=SFTP \
    dst-port=5932 log-prefix="SFTP Deny" protocol=tcp
add action=accept chain=forward dst-address-list=Pi-Hole dst-port=53 log=yes \
    log-prefix="Pi-Hole DNS" protocol=udp src-address-list=RFC1918
add action=accept chain=forward dst-address-list=rsyslog dst-port=514 log=yes \
    log-prefix=rsyslog protocol=udp src-address-list=RFC1918
add action=accept chain=forward dst-address-list=Xierion-NAS dst-port=80,443 \
    log-prefix="NAS Admin" protocol=tcp src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list=UptimeKuma dst-port=3001 \
    log-prefix="NAS Admin" protocol=tcp src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list=Xierion-NAS dst-port=445 \
    log-prefix="NAS SMB" protocol=tcp src-address-list="Other Subnet"
add action=accept chain=forward dst-address-list=Prowlarr log=yes log-prefix=\
    Prowlarr src-address-list="Other Subnet"
add action=accept chain=forward dst-address-list="Other Subnet" log=yes \
    log-prefix=Whisparr src-address-list=Prowlarr
add action=accept chain=forward dst-address-list=Xierion-NAS dst-port=445 \
    log-prefix="NAS SMB" protocol=tcp src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list=TapoHTTPBridge dst-port=5111 \
    log-prefix=Tapo protocol=tcp src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list=TapoHTTPBridge dst-port=5111 \
    log-prefix=Tapo protocol=tcp src-address-list="SPARK i7"
add action=accept chain=forward dst-address-list="Smart Plug" dst-port=80 \
    log-prefix=Tapo protocol=tcp src-address-list=TapoHTTPBridge
add action=accept chain=forward dst-address-list=Pi-Hole dst-port=22,80 \
    log-prefix="Pi-Hole Admin" protocol=tcp src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list=Xierion-NAS dst-port=445 \
    log-prefix="NAS SMB" protocol=tcp src-address-list="Default Subnet"
add action=accept chain=forward dst-address-list=Xierion-NAS dst-port=445 \
    log-prefix="NAS SMB" protocol=tcp src-address-list=Xierion-WG
add action=accept chain=forward dst-address-list=Xierion-PVE dst-port=8006 \
    log-prefix="NAS SMB" protocol=tcp src-address-list=Xierion-WG
add action=accept chain=forward dst-address-list="IoT Subnet" \
    src-address-list=Xierion-WG
add action=accept chain=forward dst-address-list=Xierion-NAS dst-port=445 \
    log-prefix="NAS SMB" protocol=tcp src-address-list=Xierion-s-A05s
add action=accept chain=forward dst-address-list=Xierion-PVE dst-port=8006 \
    log-prefix="PVE Admin" protocol=tcp src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list="IoT Subnet" \
    src-address-list="Default Subnet"
add action=accept chain=forward dst-address-list="DMZ Subnet" \
    src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list=Sonarr dst-port=8989 log=yes \
    log-prefix=Sonarr protocol=tcp src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list=Byparr dst-port=8191 log=yes \
    log-prefix=Byparr protocol=tcp src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list=Prowlarr dst-port=9696 log=\
    yes log-prefix=Prowlarr protocol=tcp src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list=Jellyfin dst-port=8096 log=\
    yes log-prefix=Jellyfin-arr protocol=tcp src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list=Jellyfin dst-port=8096 log=\
    yes log-prefix=Jellyfin-arr protocol=tcp src-address-list=Xierion-s-A05s
add action=accept chain=forward dst-address-list=Jellyfin dst-port=8096 log=\
    yes log-prefix=Jellyfin-arr protocol=tcp src-address-list=Xierion-WG
add action=accept chain=forward dst-address-list=Radarr dst-port=7878 log=yes \
    log-prefix=Radarr protocol=tcp src-address-list=Xierion-Prime
add action=accept chain=forward dst-address-list="qBittorrent CT" dst-port=\
    8080 log=yes log-prefix=qBittorrent-arr protocol=tcp src-address-list=\
    Xierion-Prime
add action=accept chain=forward dst-address-list="DMZ Subnet" \
    src-address-list=Xierion-WG
add action=accept chain=forward dst-address-list=Xierion-NAS dst-port=2049 \
    protocol=tcp src-address-list=qBittorrent
add action=accept chain=forward disabled=yes dst-address-list=Xierion-NAS \
    dst-port=111,2049 protocol=udp src-address-list=qBittorrent
add action=accept chain=forward dst-address-list=Xierion-NAS log-prefix=\
    rsnapshot src-address-list="Backup Subnet"
add action=accept chain=forward log-prefix=UptimeKuma src-address-list=\
    UptimeKuma
add action=accept chain=forward dst-address-list=Xierion-NAS dst-port=22 \
    log-prefix=dd2ssh protocol=tcp src-address-list=Fluidd
add action=accept chain=forward dst-address-list=Xierion-NAS dst-port=22 \
    log-prefix=dd2ssh protocol=tcp src-address-list="SPARK i7 Pi"
add action=accept chain=forward dst-address-list=Xierion-NAS log=yes \
    log-prefix="NAS Monitor" src-address-list=Xierion-Prime
add action=drop chain=forward disabled=yes dst-address-list=RFC1918 log=yes \
    log-prefix="qBitorrent noise" src-address-list=qBittorrent
add action=drop chain=forward comment="Inter-VLAN Deny" dst-address-list=\
    RFC1918 log=yes log-prefix="Inter-VLAN Deny" src-address-list=RFC1918
add action=drop chain=forward comment="SPARK i7 Deny" log=yes log-prefix=\
    "SPARKX i7 Deny" src-address-list="SPARK i7"
add action=log chain=forward dst-address=67.220.81.150 dst-port=80 log=yes \
    log-prefix=Afraid.org protocol=tcp
add action=accept chain=forward dst-address-list=WAN log=yes log-prefix=\
    "IoT WAN" src-address-list="IoT Subnet"
add action=accept chain=forward dst-address-list=WAN src-address-list=\
    "Other Subnet"
add action=accept chain=forward dst-address-list=WAN dst-port=53 log-prefix=\
    "Pi-Hole DNS Lookup" protocol=udp src-address-list=Pi-Hole
add action=log chain=input dst-port=53 log=yes log-prefix=\
    "External DNS request" protocol=udp src-address-list=RFC1918
add action=accept chain=forward dst-address-list=WAN src-address-list=\
    "Default Subnet"
add action=accept chain=forward dst-address-list=WAN src-address-list=\
    "Server Subnet"
add action=accept chain=forward dst-address-list=WAN src-address-list=\
    "Backup Subnet"
add action=accept chain=forward dst-address-list=WAN src-address-list=\
    "WireGuard Subnet"
add action=accept chain=forward dst-address-list=WAN src-address-list=\
    "DMZ Subnet"
add action=accept chain=forward dst-address-list=WAN log=yes log-prefix=\
    "External WAN" src-address-list="Default Subnet"
add action=drop chain=forward comment="Implicit Deny" log=yes log-prefix=\
    "Implicit Deny"
/ip firewall nat
add action=masquerade chain=srcnat log-prefix="Outgoing NAT" \
    out-interface-list=WAN
add action=masquerade chain=srcnat dst-address-list=SFTP dst-port=5932 \
    log-prefix="SFTP Hairpin NAT" protocol=tcp
add action=masquerade chain=srcnat dst-address-list="SPARK i7 Pi" dst-port=\
    5111 log-prefix="Tapo Hairpin NAT" protocol=tcp
add action=dst-nat chain=dstnat dst-address-type=local dst-port=5111 log=yes \
    log-prefix="Tapo Port Forward" protocol=tcp to-addresses=192.168.100.9 \
    to-ports=5111
add action=dst-nat chain=dstnat dst-address-type=local dst-port=5932 log=yes \
    log-prefix="SFTP Port Forward" protocol=tcp to-addresses=192.168.95.10 \
    to-ports=5932
/system clock
set time-zone-name=Australia/Adelaide
/system identity
set name=Xierion-hEX
/system logging
add action=syslog topics=info,!wireguard
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes
/system scheduler
add !days interval=1d name=EmailDailyBackup on-event=DailyBackupScript \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2026-02-23 start-time=01:00:00
add !days interval=5m name="Afraid.org DDNS update" on-event="/tool fetch url=\
    \"https://freedns.afraid.org/dynamic/update.php\[REDACTED]" keep-result=no" policy=ftp,read,write,test start-date=\
    2026-08-23 start-time=12:03:38
add !days interval=1d name=uptimerobot-update-schedule on-event=\
    uptimerobot-update-iplist policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2026-08-25 start-time=09:33:45
/tool e-mail
set certificate-verification=no from=[REDACTED] port=587 server=\
    smtp.gmail.com tls=starttls user=[REDACTED]
/tool graphing interface
add interface=ether1 store-on-disk=no
add interface=ether2 store-on-disk=no
add interface=ether3 store-on-disk=no
add interface=ether4 store-on-disk=no
add interface=ether5 store-on-disk=no
add interface=*2E store-on-disk=no
/tool graphing queue
add store-on-disk=no
/tool graphing resource
add store-on-disk=no
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set filter-ip-protocol=tcp filter-port=5111

hAP be lite:

# 2026-08-29 09:30:20 by RouterOS 7.24.1
# software id = [REDACTED]
#
# model = A42G-HbeP
# serial number = [REDACTED]
/interface bridge
add name=bridge-lan protocol-mode=none
/interface wifi
add mac-address=D2:EA:11:E5:82:F8 mld-name=mld-d0ea11e582f8 name=mld1
/interface wifi security
add authentication-types=wpa2-psk disabled=no name=xierion-sec-5
add authentication-types=wpa2-psk name=xierion-sec-24
/interface wifi
set [ find default-name=wifi1 ] channel.band=2ghz-ax .width=20/40mhz \
    configuration.ssid="Xierion 2.4 GHz" disabled=no security=xierion-sec-24
set [ find default-name=wifi2 ] channel.band=5ghz-ax .width=20/40/80mhz \
    configuration.ssid="Xierion 5 GHz" disabled=no security=xierion-sec-5
/system logging action
add name=syslog remote=10.10.10.14 remote-log-format=syslog target=remote
/system script
add dont-require-permissions=no name=DailyBackupScript owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
    log info \"Starting backup script\";\
    \n:global sysname [/system identity get name]\
    \n:global date [/system clock get date]\
    \n:global time [/system clock get time]\
    \n:global filename \"\$sysname-backup-\$date-\$time\"\
    \n\
    \n# Create binary backup file\
    \n/system backup save name=\"\$filename\" dont-encrypt=yes\
    \n:delay 2s\
    \n\
    \n# Create export configuration file (includes sensitive data like passwor\
    ds if \"show-sensitive\" is specified in RouterOS v7+)\
    \n/export file=\"\$filename\" show-sensitive\
    \n:delay 2s\
    \n\
    \n# Send both files via email\
    \n/tool e-mail send to=\"[REDACTED]" subject=\"MikroTik B\
    ackup: \$sysname \$date\" body=\"Attached are the backup (.backup) and exp\
    ort (.rsc) files for router \$sysname.\" file=\"\$filename.backup,\$filena\
    me.rsc\"\
    \n\
    \n# Log completion and clean up files (optional, helps save space)\
    \n:log info \"Backup script completed, files emailed.\"\
    \n:delay 10s\
    \n/file remove \"\$filename.backup\"\
    \n/file remove \"\$filename.rsc\""
/interface bridge port
add bridge=bridge-lan interface=ether1
add bridge=bridge-lan interface=ether2
add bridge=bridge-lan interface=ether3
add bridge=bridge-lan interface=ether4
add bridge=bridge-lan interface=wifi1
add bridge=bridge-lan interface=wifi2
/ip address
add address=192.168.100.2/24 interface=bridge-lan network=192.168.100.0
/ip dns
set servers=192.168.100.1
/ip route
add gateway=192.168.100.1
/system clock
set time-zone-name=Australia/Adelaide
/system identity
set name=Xierion-hAP
/system logging
add action=syslog topics=info
/system scheduler
add !days interval=1d name=EmailDailyBackup on-event=DailyBackupScript \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2026-08-19 start-time=01:00:00
/tool e-mail
set certificate-verification=no from=[REDACTED] port=587 server=\
    smtp.gmail.com tls=starttls user=[REDACTED]
/tool sniffer
set file-name=tapo_21:04:51 filter-interface=wifi1 filter-mac-address=\
    EC:B9:31:73:0E:7C/FF:FF:FF:FF:FF:FF,B8:27:EB:08:E7:E9/FF:FF:FF:FF:FF:FF
8

Malfunction guaranteed...

must be (find on forum why)

/interface detect-internet
set detect-interface-list=none lan-interface-list=none wan-interface-list=none internet-interface-list=none

Dead interface (*1A, *2E) on settings, remove all items on config...

Dead settings from previous versions, remove:

This rule blocks traffic even between devices in the same VLAN...
So, from 192.168.x.x to 192.168.x.x on forward is all blocked.

9

First two would be Rule #5:
The twelve Rules of Mikrotik Club
amd point #21 here:
GP & CSA (Good Practice and Common Sense Advice) for Mikrotik devices

10

Hi all,

Thank you for your advice. I have made the adjustments provided, but the issue remained. I am not sure of the cause of the issue, but rebuilding the hAP BE lite configuration from scratch and using 801.11AX, my devices are able to commuicate with each other again (802.11BE prevented devices communicaing on the same frequency)