If your 911 is configured as a router you need to go to IP->Firewall and set a NAT rule. chain=srcnat action=masquerade out-interface=yourwanport.
If your 911 is set to bridge wlan1 and ether1 then you don't need the firewall nat but you do need to set your wireless mode to "station pseudo-bridge" rather than "station" unless your AP is also a Mikrotik.
Thank you so much, I changed to station pseudo-bridge and hey presto- internet.
My next job then was putting security on AP (tp-link CPE510) and adding the passkey to my station, this returned me to my original problem of connecting then dropping connection loop.
My log shows
(My mac)@wlan1-gateway established connection on 5660000, SSID (my AP)
(My mac)@wlan1-gateway: lost connection, received disassociate: authentication not valid (2)
Then continues on this loop.
My AP settings are: SSID: XXXX My Station Settings SSID: XXXX
Security Mode: WPA-PSK Mode: Dynamic Keys
Version: WPA Authentication Types WPA PSK (X)
Encryption: TKIP Unicast cyphers: tkip
Update Period: 3600 group cyphers: tkip
WPA Pre-Shared key XXXXXXXX
Group key update 01:00:00
Management protection: allowed
The passkeys are the same copy and past ensured this, please help!