I am currently using the default config. I have modified ports 9 and 10 with their own DHCP server in an attempt to guarantee a predicable IP address to any devices attached to those ports. This router will never be connected to the internet and will only be used for automated testing of devices. Current config is below.
# may/23/2023 09:51:58 by RouterOS 6.48.6
# software id = 52YK-F3F9
#
# model = RB3011UiAS
# serial number = HDF08K87RZ0
/interface bridge
add admin-mac=48:A9:8A:08:00:66 auto-mac=no comment=defconf name=bridge
add name=bridge9
add name=bridge10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.19
add name=dhcp_pool1 ranges=192.168.10.22-192.168.88.20
add name=pool9 ranges=192.168.9.10-192.168.9.12
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
add address-pool=pool9 disabled=no interface=bridge9 name="DHCP server9"
add address-pool=dhcp_pool1 disabled=no interface=bridge10 name=server10
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf disabled=yes interface=ether8
add bridge=bridge9 comment=defconf interface=ether9
add bridge=bridge10 comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.9.1 interface=bridge9 network=192.168.9.0
add address=192.168.88.20 interface=bridge10 network=192.168.88.20
/ip arp
add address=192.168.9.1 interface=bridge9 published=yes
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.9.0/24 dns-server=192.168.9.1 domain=test gateway=\
192.168.9.1 netmask=24 wins-server=192.168.9.1
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
add address=192.168.88.20/32 dns-server=192.168.88.1 gateway=192.168.88.1 \
netmask=24 wins-server=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=192.168.9.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip route
add distance=1 dst-address=192.168.9.0/24 gateway=bridge
add distance=1 dst-address=192.168.88.0/24 gateway=bridge9
/system identity
set name=RouterOS
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN