So if i reboot first 1 min he work good but after all new users take this bad ip pool (0.0.0.2-0.0.0.255)
Deafault config. on 6.44.2 i change only port from ethernet1 to sfp1.
post your config (/export hide-sensitive) in code tags and we may be able to help.
[admin@MikroTik] > /export hide-sensitive
# apr/19/2019 15:54:51 by RouterOS 6.44.2
# software id = SKN4-0GV1
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 83060844E7F2
/interface bridge
add admin-mac=CC:2D:E0:2B:63:30 auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=\
MikroTik-2B6336 wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX \
disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=kpst18630 \
wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" mode=\
dynamic-keys supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf disabled=yes interface=sfp1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
add bridge=bridge interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=sfp1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether1 network=\
192.168.88.0
/ip arp
add address=192.168.88.246 interface=bridge mac-address=18:31:BF:BD:2E:7E
add address=192.168.88.247 interface=bridge mac-address=18:31:BF:DF:8C:C2
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=sfp1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=\
out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-address=185.60.44.131 dst-port=10999 \
in-interface=sfp1 protocol=tcp to-addresses=192.168.88.246 to-ports=10999
add action=dst-nat chain=dstnat dst-address=185.60.44.131 dst-port=10000 \
in-interface=sfp1 protocol=tcp to-addresses=192.168.88.246 to-ports=10000
add action=dst-nat chain=dstnat dst-address=185.60.44.131 dst-port=9014 \
in-interface=sfp1 protocol=tcp to-addresses=192.168.88.246 to-ports=9014
add action=dst-nat chain=dstnat dst-address=185.60.44.131 dst-port=2106 \
in-interface=sfp1 protocol=tcp to-addresses=192.168.88.246 to-ports=2106
add action=dst-nat chain=dstnat dst-address=185.60.44.131 dst-port=7777 \
in-interface=sfp1 protocol=udp to-addresses=192.168.88.246 to-ports=7777
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Asia/Krasnoyarsk
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Why?the interface used as the external interface should never be on a bridge. It should always be a routed interface.
In case your external IPs are all in one range you could add them to the same external interface and only expose the ports you want via NAT. In case you have a complete net and you have several IPs then you can have them on an internal bridge. In order to stay save the external interface should be routed. There might be situations where this doesnt make sense. But this is something everybody has to decide on its own.Why?the interface used as the external interface should never be on a bridge. It should always be a routed interface.
Lets say you hva 16 public IP and you would like to use a group of interface as a outside switch , to connect to other stuff, I would have used bridge.
add bridge=bridge comment=defconf disabled=yes interface=sfp1
/ip address add address=192.168.88.1/24 comment=defconf interface=ether1 network=192.168.88.0
/ip address add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0