VLAN Internet access through Wireguard

RouterOS Beginner Basics
1

Hi All,

I am in the process of replacing a pfSense device with a HAP AC2 and I came across a difficulty where I need to create a VLAN 13 that goes out to the Internet through a Wireguard connected UDM in the office. The UDM is at 10.255.11.1
I have the Wireguard connected but the route I cannot figure out like on pfs, where I can just add a gateway on the wireguard interface and force connection out on that with an outbound NAT rule.

Here is my current config as a base:

# 2025-05-08 17:01:07 by RouterOS 7.18.2
/interface bridge
add auto-mac=yes comment=defconf name=bridge
add comment=MGMT name=bridge_main vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    country=hungary distance=indoors frequency=auto mode=ap-bridge ssid=\
    MikroTik wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX country=hungary distance=indoors frequency=auto mode=\
    ap-bridge ssid=MikroTik wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment="Def LAN"
/interface wireguard
add comment=OfficeUnifi listen-port=PORT mtu=1420 name=wireguard1
/interface vlan
add comment=Upper interface=bridge_main name=vlan11 vlan-id=11
add comment=Basement interface=bridge_main name=vlan12 vlan-id=12
add comment=VPN interface=bridge_main name=vlan13 vlan-id=13
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_mgmt ranges=192.168.135.100-192.168.135.199
add name=dhcp_pool_11 ranges=192.168.136.100-192.168.136.199
add name=dhcp_pool_12 ranges=192.168.137.100-192.168.137.199
add name=dhcp_pool_13 ranges=192.168.138.100-192.168.138.199
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=dhcp_mgmt interface=bridge_main name=dhcp_mgmt
add address-pool=dhcp_pool_11 interface=vlan11 name=dhcp_11
add address-pool=dhcp_pool_12 interface=vlan12 name=dhcp_12
add address-pool=dhcp_pool_13 interface=vlan13 name=dhcp_13
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf hw=no interface=ether2
add bridge=bridge_main interface=wlan2
add bridge=bridge_main interface=ether3
add bridge=bridge_main interface=ether4
add bridge=bridge_main interface=ether5 pvid=12
add bridge=bridge_main frame-types=admit-only-vlan-tagged interface=\
    wlan_11_upper pvid=11
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge_main comment=Upper tagged=\
    bridge_main,ether4,wlan_11_upper vlan-ids=11
add bridge=bridge_main comment=Basement tagged=bridge_main,ether4 \
    untagged=ether5 vlan-ids=12
add bridge=bridge_main comment=VPN tagged=bridge_main,ether4 vlan-ids=\
    13
add bridge=bridge_main comment=MGMT untagged=bridge_main,ether4 vlan-ids=1
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add comment=Management interface=bridge_main list=LAN
/interface wireguard peers
add allowed-address=10.255.11.0/24,10.9.110.0/24 comment=WWHQ-UDM \
    endpoint-address=PUBIP endpoint-port=PORT interface=wireguard1 \
    name=wg_peer_wwhq persistent-keepalive=30s preshared-key=\
    "PSK" public-key=\
    "PUB"
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.135.1/24 comment=IP_Management interface=bridge_main \
    network=192.168.135.0
add address=192.168.136.1/24 comment=IP_Upper interface=vlan11 network=\
    192.168.136.0
add address=192.168.137.1/24 comment=IP_Basement interface=vlan12 \
    network=192.168.137.0
add address=192.168.138.1/24 comment=IP_VPN interface=vlan13 network=\
    192.168.138.0
add address=10.255.11.5/24 comment=WG-WWHQ interface=wireguard1 \
    network=10.255.11.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
add address=192.168.135.0/24 dns-server=9.9.9.9,1.1.1.1 gateway=192.168.135.1
add address=192.168.136.0/24 dns-server=9.9.9.9,1.1.1.1 gateway=192.168.136.1
add address=192.168.137.0/24 dns-server=9.9.9.9,1.1.1.1 gateway=192.168.137.1
add address=192.168.138.0/24 dns-server=9.9.9.9,1.1.1.1 gateway=192.168.138.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" in-interface=lo \
    protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=reject chain=forward comment="block all targeting port 0 TCP" \
    port=0 protocol=tcp reject-with=icmp-port-unreachable
add action=reject chain=forward comment="block all targeting port 0 UDP" \
    port=0 protocol=udp reject-with=icmp-port-unreachable
add action=accept chain=forward comment="VL12 to WAN" in-interface=vlan12 \
    out-interface-list=WAN
add action=drop chain=forward comment="VL11 to VL12 drop" in-interface=vlan11 \
    out-interface=vlan12
add action=drop chain=forward comment="VL11 to MGMT drop" in-interface=vlan11 \
    out-interface=bridge_main
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat dst-address=10.255.11.0/24 out-interface=\
    wireguard1 src-address=192.168.135.0/24
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Budapest
/system identity
set name=MkrTk_HAP_ac2
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.hu.pool.ntp.org
add address=1.hu.pool.ntp.org
add address=2.hu.pool.ntp.org
/system routerboard mode-button
set enabled=yes on-event=wifi-change
/system script
add comment="Turn Wifi on/off" dont-require-permissions=no name=wifi-change \
    owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
    if ([/interface wireless get wlan1 disabled]=no) do={\
    \n\t/interface wireless disable [find]\
    \n\t:log info message=\"Wifi turned off\"\
    \n} else={\
    \n\t/interface wireless enable [find]\
    \n\t:log info message=\"Wifi turned on\"\
    \n}"
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Thank for the help in advance!

2

Yes, this is a dogs breakfaST of a config, surprized much works, before tackling wireguard must read this and apply: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
One bridge, all subnets expressed as vlans!! ( and where in the heck did you conjure up this non-existent interface interface=wlan_11_upper ???

3

I have tried to apply the one device to rule them all approach for now. Here is the new exported config:

# 2025-05-09 09:53:38 by RouterOS 7.18.2
/interface bridge
add name=bridge_main vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    country=hungary distance=indoors frequency=auto mode=ap-bridge ssid=\
    MikroTik wireless-protocol=802.11 wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX country=hungary distance=indoors frequency=auto mode=\
    ap-bridge ssid=MikroTik wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
/interface wireguard
add comment=OfficeUnifi listen-port=51832 mtu=1420 name=wireguard1
/interface vlan
add comment=Upper interface=bridge_main name=vlan11 vlan-id=11
add comment=Basement interface=bridge_main name=vlan12 vlan-id=12
add comment=VPN interface=bridge_main name=vlan13 vlan-id=13
add comment=MGMT interface=bridge_main name=vlan99 vlan-id=99
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VLAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
    supplicant-identity=MikroTik
add authentication-types=wpa2-psk comment=Profile_Upper mode=dynamic-keys \
    name=profile1 supplicant-identity=""
/interface wireless
add comment="Wifi Upper" mac-address=C6:AD:34:FA:0A:AF master-interface=wlan1 \
    name=wlan_11_upper security-profile=profile1 ssid=M11U vlan-id=11 \
    vlan-mode=use-tag wps-mode=disabled
/interface wireless manual-tx-power-table
set wlan_11_upper comment="Wifi Upper"
/interface wireless nstreme
set *F comment="Wifi Upper"
/ip pool
add name=dhcp_pool_mgmt ranges=192.168.135.100-192.168.135.199
add name=dhcp_pool_11 ranges=192.168.136.100-192.168.136.199
add name=dhcp_pool_12 ranges=192.168.137.100-192.168.137.199
add name=dhcp_pool_13 ranges=192.168.138.100-192.168.138.199
/ip dhcp-server
add address-pool=dhcp_pool_mgmt interface=vlan99 name=dhcp_mgmt
add address-pool=dhcp_pool_11 interface=vlan11 name=dhcp_11
add address-pool=dhcp_pool_12 interface=vlan12 name=dhcp_12
add address-pool=dhcp_pool_13 interface=vlan13 name=dhcp_13
/disk settings
set auto-media-interface=*9 auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge_main interface=wlan1
add bridge=bridge_main interface=wlan2
add bridge=bridge_main frame-types=admit-only-untagged-and-priority-tagged \
    interface=ether2 pvid=99
add bridge=bridge_main frame-types=admit-only-untagged-and-priority-tagged \
    interface=ether3 pvid=11
add bridge=bridge_main frame-types=admit-only-untagged-and-priority-tagged \
    interface=ether4 pvid=12
add bridge=bridge_main interface=ether5 pvid=13
add bridge=bridge_main frame-types=admit-only-vlan-tagged interface=\
    wlan_11_upper pvid=11
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge_main comment=Upper tagged=\
    bridge_main,ether4,wlan_11_upper vlan-ids=11
add bridge=bridge_main comment=Basement tagged=bridge_main,ether4 \
    untagged=ether5 vlan-ids=12
add bridge=bridge_main comment=VPN tagged=bridge_main,ether4 vlan-ids=\
    13
add bridge=bridge_main comment=Main untagged=bridge_main,ether4 vlan-ids=1
add bridge=bridge_main comment=MGMT tagged=bridge_main untagged=ether2 \
    vlan-ids=99
/interface list member
add interface=ether1 list=WAN
add comment=MGMT interface=vlan99 list=LAN
add comment=Upper interface=vlan11 list=VLAN
add comment=Basement interface=vlan12 list=VLAN
add comment=VPN interface=vlan13 list=VLAN
/interface wireguard peers
add allowed-address=10.255.11.0/24,10.9.110.0/24 comment=WWHQ-UDM \
    endpoint-address=PUBIP endpoint-port=PUBPORT interface=wireguard1 \
    name=wg_peer_wwhq persistent-keepalive=30s preshared-key=\
    "PSK" public-key=\
    "PUBKEY"
/ip address
add address=192.168.135.1/24 comment=IP_Management interface=vlan99 network=\
    192.168.135.0
add address=192.168.136.1/24 comment=IP_Upper interface=vlan11 network=\
    192.168.136.0
add address=192.168.137.1/24 comment=IP_Basement interface=vlan12 network=\
    192.168.137.0
add address=192.168.138.1/24 comment=IP_VPN interface=vlan13 network=\
    192.168.138.0
add address=10.255.11.5/24 comment=WG_WWHQ interface=wireguard1 network=\
    10.255.11.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.135.0/24 dns-server=9.9.9.9,1.1.1.1 gateway=192.168.135.1
add address=192.168.136.0/24 dns-server=9.9.9.9,1.1.1.1 gateway=192.168.136.1
add address=192.168.137.0/24 dns-server=9.9.9.9,1.1.1.1 gateway=192.168.137.1
add address=192.168.138.0/24 dns-server=9.9.9.9,1.1.1.1 gateway=192.168.138.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" in-interface=lo \
    protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=reject chain=forward comment="block all targeting port 0 TCP" \
    port=0 protocol=tcp reject-with=icmp-port-unreachable
add action=reject chain=forward comment="block all targeting port 0 UDP" \
    port=0 protocol=udp reject-with=icmp-port-unreachable
add action=accept chain=forward comment="LAN Internet Access only" \
    connection-state=new in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="VLAN Internet Access only" \
    connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=drop chain=forward comment="VL11 to VL12 drop" in-interface=vlan11 \
    out-interface=vlan12
add action=drop chain=forward comment="VL11 to MGMT drop" in-interface=vlan11 \
    out-interface=vlan99
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat dst-address=10.9.110.0/24 out-interface=\
    wireguard1 src-address=192.168.135.0/24
add action=masquerade chain=srcnat dst-address=10.255.11.0/24 out-interface=\
    wireguard1 src-address=192.168.135.0/24
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Budapest
/system identity
set name=MkrTk_HAP_ac2
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.hu.pool.ntp.org
add address=1.hu.pool.ntp.org
add address=2.hu.pool.ntp.org
/system routerboard mode-button
set enabled=yes on-event=wifi-change
/system script
add comment="Turn Wifi on/off" dont-require-permissions=no name=wifi-change \
    owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
    if ([/interface wireless get wlan1 disabled]=no) do={\
    \n\t/interface wireless disable [find]\
    \n\t:log info message=\"Wifi turned off\"\
    \n} else={\
    \n\t/interface wireless enable [find]\
    \n\t:log info message=\"Wifi turned on\"\
    \n}"
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Is this easier to work with? No hybrid ports, only access for now since there’s no switch behind it yet, default network removed, management created on VLAN.
The wlan_11_upper was a halfway left attempt to create a Wifi on the VLAN 11.