Hi guys,

Apologies if this has been asked before.

I'm using a hAP Lite, and this is my first RouterOS device. I have played with a Cisco router before now - sadly the ADSL was awful and the WiFi was old, so it just turned into an experience...

I want to "wire" wlan1 to ether4 only, so that packets don't touch any more of the router and "pass through" to a switch. From the switch, there's an additional bridged device on ether2 which I want to be the only ingress point to reach pppoe1.

In essense I want to force this route:

wlan1 <--> ether4 <--> switch <--> device <--> ether2 <--> pppoe1 <--> ether1 <--> modem

(unnumbered objects are outside the router)

So all internet traffic must pass through ether1 only, and all wlan traffic must pass through ether2 only.

I've removed the master port from ether4, so it's not switching with ether2 at wire speed - but it's got to still be connected.
So far I have a separate bridge for WiFi, but that hasn't really done the job.
I have set both ports on the bridge to Horizon 1, but that hasn't helped either - in fact, it's worse: I can't see anything on the switch or get DHCP (so the "loop" isn't working at all.)
I have attempted to create an EoIP tunnel over an IP tunnel with a 2nd hAP Lite, and that failed miserably - with much the same issue, that I couldn't force traffic through the EoIP tunnel.

Advice (other than buying another device - or two separate devices) would be gratefully received!

I seem to have achieved my goal by increasing the path cost to ether2 - but I'm keen to understand if there are better ways to achieve this. (And to understand why this would work at all!)

I'm not sure I follow what all happens after the wifi traffic leaves ether2, but your stated goal of wiring the wifi to ether2 only is easy:

Just make a second bridge "wifi" and connect wlan1 and ether2 to this bridge.
Make sure that ether2 is set master=none, and that no other switch ports use ether2 as a master.

Your normal lan bridge should use the actual switch master - e.g. ether3 with ether4 and ether5 as slaves to ether3.

Many thanks ZeroByte - I was sure I was getting "leakage" from the 2nd bridge to the "primary" (default) bridge - but I must be mistaken.

The idea is that for traffic to reach the internet, it must always pass through the monitoring device situated between the LAN and ether4 - even if it's from WiFi on the same Mikrotik router. So I push it out through ether2 and it joins the rest of the LAN. Then all LAN traffic must come into ether4 before it can reach the internet - and to reach ether4, it has to pass through the bridge on the monitoring device.

The configuration is equivalent to using the hAP lite without WiFi, and having a separate WiFi AP on the LAN.