Hi, I’m quite new to Mikrotik. So I’m replacing the other HW to Mikrotik in my network, and have faced some issue on the subnet-to-subnet communication that I can’t get working myself.
To present the scenario I render the following part of the big picture:
So I’m testing this using my laptop, which is connected to the R1 router via the wifi1 interface. The R2 router is also connected to the R1 router via the wifi5 interface. Behind the R2 there are some local resources I’d like to use. Both R1 and R2 routers are internal, therefore they do not run any NAT or Firewall rules.
I found myself unable to ping R2’s upstream interface (10.0.11.2), R2’s ethernet bridge (10.0.3.1) and the server itself (10.0.3.220). At the same time, the R1 router (which actually routes my laptop’s traffic) can ping all those hosts within WinBox. I feel like I’m missing some important part. Why the router can get to the hosts that are unreachable for the laptop?
Nice start for a first post and compliments on your drawing skills (and that’s a serious remark !! Much better then users posting with zero drawings).
However, most likely the answer will be in the part you did not show.
Config of R1.
Thank you, so nice to hear 
The above post screenshot shows some R1 settings, and also below is the export:
/interface bridge
add admin-mac=78:9A:88:95:AD:0D auto-mac=no comment=defconf name=bridge \
port-cost-mode=short
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=\
10min-cac .width=20/40/80mhz .mode=ap \
.ssid=wifi1 disabled=no mac-address=78:9A:88:95:AD:0D \
security.authentication-types=wpa2-psk,wpa3-psk
set [ find default-name=wifi2 ] channel.band=2ghz-n .skip-dfs-channels=\
10min-cac .width=20/40mhz .mode=ap .ssid=\
wifi2 disabled=no security.authentication-types=wpa2-psk,wpa3-psk
add configuration.mode=ap .ssid=wifi3 disabled=no mac-address=\
7A:9A:88:95:AD:0E master-interface=wifi2 name=wifi3 \
security.authentication-types=wpa2-psk,wpa3-psk .encryption=""
add configuration.mode=ap .ssid=wifi4 disabled=no mac-address=\
7A:9A:88:95:AD:0F master-interface=wifi2 name=wifi4 \
security.authentication-types=wpa-psk,wpa2-psk .encryption=""
add configuration.mode=ap .ssid=wifi5 disabled=no l2mtu=1525 mac-address=\
7A:9A:88:95:AD:10 master-interface=wifi2 mtu=1500 name=wifi5 \
security.authentication-types=wpa2-psk,wpa3-psk
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=2ghz-g disabled=no frequency=2300-7300 name=ch2x20 \
skip-dfs-channels=10min-cac width=20mhz
/ip dhcp-server
add interface=wifi5 lease-time=1d name=MBridge
/ip kid-control
add fri=0s-1d mon=0s-1d name=system-dummy sat=0s-1d sun=0s-1d thu=0s-1d tue=\
0s-1d tur-fri=0s-1d tur-mon=0s-1d tur-sat=0s-1d tur-sun=0s-1d tur-thu=\
0s-1d tur-tue=0s-1d tur-wed=0s-1d wed=0s-1d
/ip pool
add name=dhcp ranges=10.0.102.51-10.0.102.199
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=5m name=MPoint
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=ether1 internal-path-cost=10 \
path-cost=10
add bridge=bridge comment=defconf interface=wifi2 internal-path-cost=10 \
path-cost=10
add bridge=bridge disabled=yes interface=*6 internal-path-cost=10 path-cost=\
10
add bridge=bridge interface=wifi4 internal-path-cost=10 path-cost=10
add bridge=bridge interface=wifi1 internal-path-cost=10 path-cost=10
add bridge=bridge interface=wifi3 internal-path-cost=10 path-cost=10
/ip neighbor discovery-settings
set discover-interface-list=all
/ipv6 settings
set disable-ipv6=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=10.0.102.1/22 comment=defconf interface=bridge network=10.0.100.0
add address=10.0.11.1/30 interface=wifi5 network=10.0.11.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server lease
add address=10.0.102.51 lease-time=1w mac-address=50:E9:88:BB:04:AC server=\
MPoint
add address=10.0.11.2 lease-time=1d mac-address=48:A9:88:AB:22:74 server=\
MBridge
/ip dhcp-server network
add address=10.0.102.0/24 comment=defconf dns-server=10.0.102.1 gateway=\
10.0.102.1 netmask=24 ntp-server=10.0.102.1 wins-server=10.0.102.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=10.0.102.1 comment=defconf name=MPoint
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked disabled=yes
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid disabled=yes
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new disabled=yes in-interface-list=WAN log=yes
add action=accept chain=forward disabled=yes protocol=icmp
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes \
ipsec-policy=out,none out-interface-list=WAN
/ip route
add comment=LAN3 disabled=yes distance=1 dst-address=10.0.103.0/24 gateway=\
bridge pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
add comment="to LAN3" disabled=no distance=1 dst-address=10.0.3.0/24 gateway=\
10.0.11.2 pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=12
/system identity
set name=MPoint
/system leds
set 0 interface=ether1 type=interface-transmit
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp server
set enabled=yes
/system ntp client servers
add address=10.0.100.1
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source="\r\
\n :if ([system leds settings get all-leds-off] = \"never\") do={\r\
\n /system leds settings set all-leds-off=immediate \r\
\n } else={\r\
\n /system leds settings set all-leds-off=never \r\
\n }\r\
\n "
/tool graphing interface
add interface=ether1
add interface=wifi1
add interface=wifi2
add interface=wifi3
add interface=wifi4
add interface=wifi5