Why use a management vlan?

[jaclaz]

If you have (as you should have) the default firewall rules instead of adding that rule you should be able to get connection by categorizing correctly ether5 in interface list members.
See:

How to prevent router fatal failures during configuration changes

I was referring to the fact that the advice in the given link is to use preferably Winbox v.3.x and not v.4. x because something may still be inaccessible or difficult to find in the newer version. What anav meant was the usually suggested way to put in practice Rule #7: Here is an example: and another one:

There Is normally a rule in input chain that drops anything that comes from anything BUT LAN, so if ether5 belongs to LAN (besides MGMT) that rule won’t prevent connection