You can replace R2 with a L3 switch. Just define a trunk on eth 1, and untag all other ports and map the VID to the correct ports. There is nothing to route for R2.

That way everything "to the right" of the dish (behind R2) will be "controllable" from one point.

R1: standard router, with VLAN's on the ports.
Sxt1: Just a fixed IP like the SX2. Just make sure they are in a subnet you can reach.

You can replace R2 with a L3 switch. Just define a trunk on eth 1, and untag all other ports and map the VID to the correct ports. There is nothing to route for R2.

That way everything "to the right" of the dish (behind R2) will be "controllable" from one point.

R1: standard router, with VLAN's on the ports.
Sxt1: Just a fixed IP like the SX2. Just make sure they are in a subnet you can reach.

Thank you haik for your reply.

I would like to keep R2 for future network upgrade. I want to know the true config for each device. I manage to get the VLANs working at after R1, but I couldn't figure out how to configure the rest. specially SXT1 & SXT2.

Any Ideas ?

UP UP UP

Here is a configuration I have running on a SXT5nDr2
Should give you a start

# dec/07/2016 17:09:12 by RouterOS 6.37.2
# software id = 179R-CK5P
#
/interface bridge
add name=bridge-vlan20
add name=bridge-vlan30
add name=bridge-vlan40
/interface ethernet
set [ find default-name=ether1 ] mtu=1504
/ip neighbor discovery
set bridge-vlan20 discover=no
set bridge-vlan30 discover=no
/interface vlan
add interface=ether1 loop-protect-disable-time=0s loop-protect-send-interval=\
1s name=ether1-vlan20 vlan-id=20
add interface=ether1 loop-protect-disable-time=0s loop-protect-send-interval=\
1s name=ether1-vlan30 vlan-id=30
add interface=ether1 loop-protect-disable-time=0s loop-protect-send-interval=\
1s name=ether1-vlan40 vlan-id=40
/interface ethernet switch port
set 0 default-vlan-id=30 vlan-header=add-if-missing vlan-mode=secure
set 1 default-vlan-id=30 vlan-header=add-if-missing vlan-mode=secure
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=profile1 supplicant-identity="" \
wpa2-pre-shared-key=********
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=profile2 supplicant-identity="" \
wpa2-pre-shared-key=********
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=profile3 supplicant-identity="" \
wpa2-pre-shared-key=********
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=profile4 supplicant-identity="" \
wpa2-pre-shared-key=********
/interface wireless
set [ find default-name=wlan1 ] country=australia disabled=no frequency=5805 \
mode=station-bridge mtu=1504 security-profile=profile4 ssid="Lot94 5GHz"
/interface vlan
add interface=wlan1 loop-protect-disable-time=0s loop-protect-send-interval=\
1s name=wlan1-vlan20 vlan-id=20
add interface=wlan1 loop-protect-disable-time=0s loop-protect-send-interval=\
1s name=wlan1-vlan30 vlan-id=30
add interface=wlan1 loop-protect-disable-time=0s loop-protect-send-interval=\
1s name=wlan1-vlan40 vlan-id=40
/interface bridge port
add bridge=bridge-vlan20 interface=ether1-vlan20
add bridge=bridge-vlan20 interface=wlan1-vlan20
add bridge=bridge-vlan30 interface=ether1-vlan30
add bridge=bridge-vlan30 interface=wlan1-vlan30
add bridge=bridge-vlan40 interface=ether1-vlan40
add bridge=bridge-vlan40 interface=wlan1-vlan40
/interface ethernet switch vlan
add ports=switch1-cpu,ether1 switch=switch1 vlan-id=20
add ports=switch1-cpu,ether1 switch=switch1 vlan-id=30
add ports=switch1-cpu,ether1 switch=switch1 vlan-id=40
/ip address
add address=192.168.4.4/24 interface=bridge-vlan40 network=192.168.4.0
/ip dns
set servers=192.168.4.254
/ip route
add distance=1 gateway=192.168.4.254
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=8080
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Australia/Perth
/system identity
set name="Glencoe Remote"
/system routerboard settings
set protected-routerboot=disabled