You've Never Seen a Noob Like Me

RouterOS Beginner Basics
4

Agree on the "VLAN bible" being a good read. I'll note that some things have become simpler WRT to VLANs.

Overall VLAN are the well-trotted path to isolating devices in a home networks. For the real pandantic, you can also layer on /interface/bridge/filters, which operate at the ethernet level, if you want to "whitelist" devices...but I'd start with VLANs.

The only downside to VLANs, is things like device discovery becomes harder. Some network "things" expect to be on same LAN for their app to work. Often add DNS and/or firewall rules can help to allow needed communication. But something to be aware of when "VLAN-ing".

If you just want to see something work, and will to "start from scratch"... Assuming this one of the "home routers", the TL;DR be:

Using some CLI syntax, but it generally matches WinBox menus

  1. Upgrade your device to 7.20.6 (stable) in /system/package/update/install ("Check for Updates" in UI). If you haven't already, setup a new user for yourself in full group, using a secure password, and disable admin account.
  2. Also upgrade to matching "fireware" (BIOS), using /system/routerboard/update. It will reboot again. And, recent default is to upgrade firmware automatically, but it only does that after a 2nd reboot, since the BIOS comes from the RouterOS package, so chicken-and-egg problem
  3. Get the current default configuration for your device using /system/reset-configuration keep-users=yes. The will remove all configuration (but keep your current user/password) and apply the 7.20.6 version of the default configuration. This is needed since the default on the device may be from the factory version but the defaults do change over time, so these apply the "latest defaults"...
  4. After this [third] reboot (e.g. the upgrade to stable, upgrade RouterBOOT firmware, reset configuration), you can start configuration VLANs...
  5. Enable VLAN bridge on the default bridge using /interface/bridge/set [find] vlan=filtering=yes (Bridge > Bridge tab > double-clock on bridge1 (or bridge) > select VLAN tab in dialog > check "VLAN Filtering" box. WinBox may disconnect but should reconnect, and your bridge is ready for VLANs.
  6. To create VLAN, the "bible" linked above has all the details... but you can add one like this for a "VLAN 2":
    /interface vlan add name=vlan2 vlan-id=2 interface=([/interface/bridge/find]->0)
/ip address add address=192.168.2.1/24 interface=vlan2
/ip pool add name=vlan2 ranges=192.168.2.2-192.168.2.254
/ip dhcp-server add address-pool=vlan2 interface=vlan2 name=vlan2
/ip dhcp-server network add address=192.168.2.0/24 dns-server=192.168.2.1 gateway=192.168.2.1
    and be same steps in WInBox, names should match, although "network" is a tab in IP > DHCP Server.
  7. To use the VLAN on an ethernet port of router.... The default should have some ports listed in Bridge > Ports tab, if you pick the port you want to test on VLAN 2 created above... you double-click that bridge port (say ether3), go to VLAN tab, and set pvid=2 and frame-types=admit-only-untagged-and-priority-tagged in the dialog. If you Apply/OK, any device on that port will get a 192.168.2.0/24 address. It won't have internet access (even if you configured it already) since the default firewall will block it. But by default it will be able to ping the router at 192.168.88.1.
  8. Now restricting access... that where the @pcunite VLAN bible has more information. The key thing to know is ~7.18 and above, you don't have to worry about /interface/bridge/vlan anymore — which VLAN guide is very careful about explain, since it used to be a PITA... But in latest RouterOS, the right things happens in bridge vlan setting, when you add a /interface/vlan or change /interface/bridge/port's pvid=/frame-types.

And if you post a diagram that really help with more questions. But always think seeing "something" working often help motivate to figure out the rest... There is a lot to learn to be good a RouterOS, but you have to start somewhere.