Thanks for the reply! Well, I have no experience on setting up the top-level firewall, I just use defaults. Can you explain please what I need to do to setup a firewall inside bridge?

Thanks for wiki:) Ok, to make things easier - this topic is a continuation of that one: https://forum.mikrotik.com/viewtopic.php?p=610136#p610136 In the end of conversation, I was recommended to set a (different) IP address, configure a DHCP pool, configure a DHCP network, and a DHCP server for my w...

What do you mean by a "plan"?:)

I have home ap, I don't have any serious plan) The only thing I want to achieve is to separate wlan1 from ether interfaces. It would be good also if I can to separate each ether from each other - because I don't use any home/local network. Probably I misunderstood something because I don't really kn...

So, what I got to do after I will remove ether 1,2,3,4 and wlan1 from the bridge? Should I also delete bridge after that?

Ether2 - S, Ether3 - RS, Ether4- RS, Wlan1 - RS

P.S I need to make Internet working also

I have default configuration - bridge, ether1 - ethernet, ether2- mastered ,ether3,ether4,wlan1.

Well, since I had an experience with removing wlan1 from the bridge and had no internet access from wi-fi, I thought that there should be more steps to do.

Ideally, I need ether2, ether2, ether3, ether4 and wlan1 running separately. Can you explain to me how to remove these interfaces from the bridge and make them work with step-by step explanation(I am a beginner)?

Also, do I need DHCP-server or DHCP-client?

Should I remove default configuration if I don't use home network or something like that?( I mean, can I go on without any bridge?)

Okay, I've tried to add IP adress to my wlan1 via IP menu -> adresses, but is it a right way to do it?( I have no internet access on wi-fi)

How can I remove wlan1 from my bridge?

I don't need one common network) As i've mentioned I didn't remove default configuration

Have I done everything right?
Chain - input
In.interface - wlan1
In.Bridge - bridge(that's name of my bridge)
Mac Protocol 800(ip)
IP
--Dst.Adress 255.255.255.255
--Dst.Port 20561
--Protocol 17(udp)
Action tab:
Action - drop

It definitely blocks something, but I still able to log on via mac. Each time I log on amount of dropped packets and bytes increases. (First time when I've applied this rule, i have been disconnected)

According to this, which addresses I should block?

Any ideas how to fix it?

Thanks for replies! What is good - i can not anymore log on via wifi to 192.168.88.1 with my username and password, what is not very good - i can log on via wifi with mac adress and my username and password :/.

I think we are slightly moving away from my question. I was asking for help because i don't know how to make certain thing happen.

I am talking about one particular feature, not router.

I understand that) It simply looks like a security feature to me that should be accessible for casual user, because somebody simply can get lucky with wifi password.

"create interface list from interface menu" What exactly i should do?) I have interface menu, but what is interface list? What exactly is doing the code you have written? I saw similar(almost) topic , https://forum.mikrotik.com/viewtopic.php?t=85852 , and there is comment Drop port 80 in ...

Yeah... i have only general understanding how firewall works, and unfortunately no idea what is bridge:D.

Well, i didn't edit default configuration, so i have ether2-master, and bridge. Also i don't really understand how to perform mentioned firewall setup, so i will be grateful if you can help me:)

I have router Mikrotik hAP lite (RB941-2nD).
I want to make winbox/web interface accessible only from ether2/3/4 interfaces. I saw some other routers(TP-Link) that have this option as simple checkbox. What should i do to make it work with Microtik?