I've got the ethernet ports working the way I'd like, but now I'm trying to add the 2Ghz interface to vlan 10 but so far nothing I've changed seems to work. When I connect, my phone just says obtaining IP address and then fails. I'm not exactly sure what vlan-mode should be set to, but "no tag" and "use tag" don't seem to make a difference. "use service tag" didn't seem right seem right from what I found on the forum and the wiki.
I did change VLANs on ports 3 and 5 since my original post.
# mar/01/2016 08:18:47 by RouterOS 6.33.5
#
/interface ethernet
set [ find default-name=ether2 ] master-port=ether1
set [ find default-name=ether3 ] master-port=ether1
set [ find default-name=ether5 ] master-port=ether1 poe-out=off
/interface wireless
set [ find default-name=wlan1 ] bridge-mode=enabled distance=indoor disabled=no mode=ap-bridge ssid=Removed vlan-id=10 wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac bridge-mode=disabled distance=indoors frequency=auto mode=ap-bridge ssid=Removed vlan-id=10 vlan-mode=use-tag wireless-protocol=802.11 wps-mode=disabled
/interface vlan
add interface=ether1 name=vlan10 vlan-id=10
/interface ethernet switch port
set 0 vlan-header=add-if-missing vlan-mode=secure
set 1 vlan-header=add-if-missing vlan-mode=secure
set 2 default-vlan-id=10 vlan-header=always-strip vlan-mode=secure
set 4 default-vlan-id=20 vlan-header=always-strip vlan-mode=secure
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys wpa2-pre-shared-key=Removed
/interface ethernet switch vlan
add ports=ether1,ether2,ether3,switch1-cpu switch=switch1 vlan-id=10
add ports=ether1,ether2,ether5 switch=switch1 vlan-id=20
add ports=ether1,ether2 switch=switch1 vlan-id=30
add ports=ether1,ether2 switch=switch1 vlan-id=40
/ip address
add address=10.10.10.2/24 interface=vlan10 network=10.10.10.0
/ip firewall filter
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept establieshed,related" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid