Hello guys. So i have been following the Mikrotik youtube tutorial to create a separate Wifi with VLAN for my IoT devices. However i have been getting a weird error message saying "vlan interface already configured on bridge" and i can not connect to the new wifi network. I tried connecting by setting IP address manually and it works. However DHCP/VLAN don't seem to be working. My theory is that the MLD Wifi Adapter is causing the problem. Can anyone please do a sanity check on my config?
# 2026-07-27 21:28:34 by RouterOS 7.23.2
# software id = JBAG-PMAD
#
# model = MA53UG+HbeH
# serial number = HM4***
/interface bridge
add admin-mac=D0:EA:11:24:35:F3 auto-mac=no comment=defconf name=bridge
vlan-filtering=yes
/interface ethernet
set \[ find default-name=ether2 \] l2mtu=1598
set \[ find default-name=ether3 \] l2mtu=1598
set \[ find default-name=ether4 \] l2mtu=1598
set \[ find default-name=ether5 \] l2mtu=1598
/interface wifi
add configuration.country=Germany .mode=ap .ssid=HTrN disabled=no
mac-address=D2:EA:11:24:35:F7 mld-name=mld-d0ea112435f7 name=mld1
security.authentication-types=wpa3-psk
set \[ find default-name=wifi1 \] channel.skip-dfs-channels=10min-cac
configuration.country=Germany .mode=ap .ssid=HTrN disabled=no
mld-interface=mld1 security.authentication-types=wpa2-psk,wpa3-psk .ft=no
.ft-over-ds=no
set \[ find default-name=wifi2 \] channel.skip-dfs-channels=10min-cac
configuration.country=Germany .mode=ap .ssid=HTrN disabled=no
mld-interface=mld1 security.authentication-types=wpa2-psk,wpa3-psk .ft=no
.ft-over-ds=no
set \[ find default-name=wifi3 \] channel.skip-dfs-channels=10min-cac
configuration.country=Germany .mode=ap .ssid=HTrN disabled=no
mld-interface=mld1 security.authentication-types=wpa3-psk .ft=no
.ft-over-ds=no
/interface vlan
add interface=bridge name=vlan10-LAN vlan-id=10
add interface=bridge name=vlan20-IoT-NoI vlan-id=20
/interface wifi
add configuration.mode=ap .ssid=HNIoTN datapath.client-isolation=yes
disabled=no mac-address=D2:EA:11:24:35:F8 master-interface=wifi1 name=
IoT-NoI security.authentication-types=wpa2-psk,wpa3-psk
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_pool1 ranges=192.168.20.2-192.168.20.254
/ip dhcp-server
add address-pool=default-dhcp interface=vlan10-LAN name=defconf
add address-pool=dhcp_pool1 interface=vlan20-IoT-NoI name=DHCP-IoT-NoI
/interface ppp-client
add apn=internet name=ppp-out1 port=usb2
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf frame-types=
admit-only-untagged-and-priority-tagged interface=ether2 pvid=10
add bridge=bridge comment=defconf frame-types=
admit-only-untagged-and-priority-tagged interface=ether3 pvid=10
add bridge=bridge comment=defconf frame-types=
admit-only-untagged-and-priority-tagged interface=ether4 pvid=10
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged
interface=ether5
add bridge=bridge comment=defconf frame-types=
admit-only-untagged-and-priority-tagged interface=mld1 pvid=10
# vlan interface already configured on bridge
add bridge=bridge comment="Nontrusted VLAN w/o Internet" frame-types=
admit-only-untagged-and-priority-tagged interface=vlan20-IoT-NoI pvid=20
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set allow-fast-path=no disable-ipv6=yes forward=no
/interface bridge vlan
add bridge=bridge tagged=ether5 vlan-ids=10
add bridge=bridge tagged=ether5 vlan-ids=20
/interface detect-internet
set detect-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=vlan10-LAN list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=vlan10-LAN network=
192.168.88.0
add address=192.168.20.1/24 comment="Nontrusted VLAN IOT NoI" interface=
vlan20-IoT-NoI network=192.168.20.0
/ip dhcp-client
add comment=defconf interface=ether1 name=client1
/ip dhcp-server lease
add address=192.168.88.3 mac-address=BC:24:11:F8:BD:39 server=defconf
add address=192.168.88.4 client-id=1:bc:24:11:53:3e:1b mac-address=
BC:24:11:53:3E:1B server=defconf
/ip dhcp-server network
add address=192.168.20.0/24 dns-server=192.168.20.1 gateway=192.168.20.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=
192.168.88.1
/ip dns
set allow-remote-requests=yes mdns-repeat-ifaces=vlan10-LAN,vlan20-IoT-NoI
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=drop chain=forward comment="Disallow connection from IoT into LAN"
connection-state=new in-interface=vlan20-IoT-NoI out-interface=vlan10-LAN
add action=accept chain=forward comment=
"Exempt mDNS Traffic from IoT NoI Network" in-interface=vlan20-IoT-NoI
protocol=udp src-port=5353
add action=accept chain=input comment="defconf: accept ICMP" in-interface=
vlan10-LAN protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
in-interface=lo src-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1 type=external
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute"
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/system clock
set time-zone-name=Europe/Berlin
/system package update
set ip-version=ipv4
/system resource irq rps
set ether1 disabled=no
set ether2 disabled=no
set ether3 disabled=no
set ether4 disabled=no
set ether5 disabled=no
/system ups
add name=ups1 offline-time=5m port=\*80000002
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN