Today I've gotten a lot further with some "outside" help..
(tnx Peter!)
I'll post what I did to make it work so that others (beginners) like me can benefit of this knowledge.
This applies for dutch fiber connection like KPN, Xs4all etc..
First create two vlan interfaces on ether1-gateway (or whatever interface you've connected the Genexis Fiber NTU on):
# NAME MTU ARP VLAN-ID INTERFACE
0 R vlan4 1500 enabled 4 ether1-gateway
1 R vlan6 1500 enabled 6 ether1-gateway
In my setup I decided to keep bridge-local for "untagged" vlan6 (internet) traffic. And i've created a new bridge for vlan4 (TV) traffic.
0 R name="bridge-local" mtu=1500 l2mtu=1598 arp=enabled mac-address=XX:XX:XX:XX:XX:XX protocol-mode=rstp priority=0x8000 auto-mac=no admin-mac=XX:XX:XX:XX:XX:XX max-message-age=20s
forward-delay=15s transmit-hold-count=6 ageing-time=5m
1 R name="bridge-vlan4" mtu=1500 l2mtu=1594 arp=enabled mac-address=XX:XX:XX:XX:XX:XX protocol-mode=none priority=0x8000 auto-mac=yes admin-mac=00:00:00:00:00:00 max-message-age=20s
forward-delay=15s transmit-hold-count=6 ageing-time=5m
Then add the ports to the bridges.. Since I use bridge-local for "internet" traffic, I only need to add ports to bridge-vlan4 for TV.
5 ether2 bridge-vlan4 0x80 10 none
6 vlan4 bridge-vlan4 0x80 10 none
5: interface on which the TV receivers are connected.
6: interface for vlan4 on ether1-gateway
Then you need to create a pppoe interface on the vlan6 interface to authenticate with the ISP.
Retrieve the settings from your ISP supplied modem, the following example is for KPN fiber:
/interface pppoe-client
add ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 dial-on-demand=no disabled=no
interface=<vlan6 interface> max-mru=1480 max-mtu=1480 mrru=disabled name=<interface name> password=kpn profile=default service-name="" use-peer-dns=no user=<username>
KPN username is the mac-addr of the modem in following format: XX-XX-XX-XX-XX-XX@direct-adsl
password is "kpn" or anything else, but cannot be empty.
Also make sure that the time of de device is accurately set, and that ether1-gateway has the same mac-address as the ISP supplied modem.
The pppoe client will start after creating, and it will fail. (connecting, disconnected, connecting, disconnected).. Let this go for a while and suddenly it will be connected. Strange behavior, but my "outside help" told me that this is normal behavior.
After the connection is established add the masquerade rule:
/ip firewall nat
add action=masquerade chain=srcnat disabled=no out-interface=<jouw pppoe interface van hierboven> src-address=192.168.0.0/16 to-addresses=0.0.0.0
Then you should be able to access the internet and start configuring the rest of the unit.
The filter settings are the most important since the mikrotik is currently accessible from the internet.
This is an example of my first (basic) filter set.
0 chain=input action=drop protocol=icmp in-interface=pppoe-kpn
1 chain=input action=accept src-address=192.168.0.0/16 in-interface=bridge-local
2 chain=forward action=accept protocol=tcp dst-address=192.186.xx.xx in-interface=pppoe-kpn dst-port=22
3 chain=input action=accept connection-state=established
4 chain=input action=accept connection-state=related
5 chain=input action=drop in-interface=sfp1-gateway
6 chain=input action=drop in-interface=ether1-gateway
7 chain=input action=drop in-interface=pppoe-kpn
0: drop icmp (ping)
1: allow input to the mikrotik from local subnet
2: forward ssh from "outside" to a local (openVZ) system.
3: accept established (default rule)
4: accept related (default rule)
5: drop input on sfp1-gateway (default rule)
6: drop input on ether1-gateway (default rule)
7: drop input on pppoe-kpn
Also configure things like DNS and DHCP:
[admin@MikroTik] /ip dns> print
servers: 8.8.8.8,8.8.4.4
dynamic-servers:
allow-remote-requests: yes
max-udp-packet-size: 4096
cache-size: 2048KiB
cache-max-ttl: 1w
cache-used: 54KiB
[admin@MikroTik] /ip dhcp-server> network print
# ADDRESS GATEWAY DNS-SERVER WINS-SERVER DOMAIN
0 192.168.xx.xx/xx 192.168.xx.xx 192.168.xx.xx lan.example.com example.com
And that's about it to get "KPN glasvezel" running properly so you can (bin/trash/destroy/mutilate/return to ISP/put on shelf) the ZTE H220N "KPN Experiabox" router.
Again: I'm also only a beginner, and this is what I've learned today and I like to share my newly found knowledge. But note: there could be errors in this configuration! I hope (dutch) readers of this post will find this helpful in setting up their own Mikrotik as a replacement for their locked down ISP router.
Personally I'm thinking of following a MTCNA course next year.. I'm really starting to like Mikrotik stuff
Too bad there are no training facilities here in the netherlands, but that's also a good reason to make a nice trip abroad!