Only some generic advice, possibly not connected to the issue at hand, but (IMHO) useful to tidy up the configuration a bit.
- detect internet: it is possible that it will interfere with something else, the general advice is to disable it and use “static” port categorization, see:
http://forum.mikrotik.com/t/does-detect-internet-actually-do-anything/143971/1
http://forum.mikrotik.com/t/does-detect-internet-actually-do-anything/143971/1
What it seems “suspect” to me is that you have (in /interface detect-internet state) the pppoe-out1 categorized as “internet”, while you have it as “WAN” in /interface list member, see below point #2, it is possible that this creates issues in firewall rules using the interface list. - Then you have:
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1-ToRouter list=WAN
add interface=pppoe-out1 list=WAN
add interface=DHCPBridge list=LAN
but you have:
/interface bridge
add name=DHCPBridge
add admin-mac=6C:3B:6B:84:2A:CE auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=ether1-ToRouter
set [ find default-name=ether2 ] disabled=yes
set [ find default-name=ether3 ] disabled=yes
set [ find default-name=ether4 ] disabled=yes
set [ find default-name=ether6 ] disabled=yes
set [ find default-name=ether7 ] disabled=yes
set [ find default-name=ether8 ] disabled=yes
set [ find default-name=ether9 ] disabled=yes
set [ find default-name=ether10 ] disabled=yes
set [ find default-name=sfp1 ] name=sfp1-ToSwitch
and:
/interface bridge port
add bridge=DHCPBridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1-ToSwitch
What is the rationale behind having two bridges, each one with only one ethernet port? (what they are supposed to bridge?)
Essentially you are using only two interfaces (let’s for the moment set aside ether5, which by the way it is strangely not listed in /interface ethernet and interface sit1, which is related to some kind of tunnel):
sfp1=sfp1-ToSwitch which is definitely LAN
ether1=ether1-ToRouter which is definitely WAN
Personally I would get rid of both bridges and use the underlying ethernet interfaces directly.
3) about ether5:
- it should be listed in /interface ethernet
- why - if ether5 is a backup connection to the router - it has a DHCP server running on it (the “main” connection to the router is through ether1 which has a DHCP client running on it)?
- if it is connected to the router/modem (by itself or through the DHCP bridge) it is essentially “WAN”, but on the other hand it has a typical LAN IP address?
- you have something wrong here:
/ip neighbor discovery-settings
set discover-interface-list=*2000012
whenever there is an “*” (asterisk) in a configuration it means that it is a reference to something that existed but that now doesn’t exist anymore or that however RoS cannot find
5) this seems to me like a duplication:
/ip dhcp-client
add comment=defconf interface=ether1-ToRouter
add disabled=no interface=ether1-ToRouter