Have you tried specifyng src-address in nat rule? (also you can try src-address-list in advanced tab for specific IPs, making your own list in firewall-address lists ) Something like: /ip firewall add action=src-nat chain=src-nat out-interface=ether1-wan src-address=172.16.101.0/24 to-addresses=1.2....

Same problem here! Hours lost, but I'm lucky enough to have found this post. Thank you very much! For those asking which rule/how to move, go to menu IP->Firewall. In Filter tab look for the rule in chain forward, action accept, comment = defconf: accept established, related, untracked and move it (...

Check that capsman interface is set to be a tagged port for vlan200 on the bridge. xvo, I've spent days trying to troubleshoot VLANs + CAPsMAN, working on Saturday + Sunday because I've to deliver this tomorrow Monday at 8:00. Not the easiest scenario to try CAPsMAN for the first time... Now it wor...