Hi people, I finally got my setup working!!!
The setup is to have the Mikrotik Groove52 connected to the PPOE ether5 port on the Mikrotik HAP ac.
The scenario is to get a weak wifi signal at the Marina and make it stronger through the Groove52.
Then make it possible for people on the boat to access that internet AP through the local AP provided by the HAP ac.
eg. Marina weak signal (most of the time!) -> Groove52 -> HAP ac -> local devices via local wifi.
I spent too many hours on this so if my experience can help someone, then it is worth it!
Here is my Groove52 setup, it was the easiest thing.
Note that I do not have ethernet on my laptop, I was lucky enough that the groove had its AP setup initially so I connected to 192.168.88.1 on it and immediately changed it to 192.168.88.2.
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=malaysia disabled=no frequency=auto mode=station-pseudobridge ssid=Manua wireless-protocol=nv2-nstreme-802.11
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk group-ciphers=tkip,aes-ccm mode=dynamic-keys supplicant-identity=MikroTik unicast-ciphers=tkip,aes-ccm
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.100
/ip dhcp-server
add address-pool=dhcp name=dhcp1
add address-pool=dhcp disabled=no interface=ether1 name=dhcp2
/interface bridge port
add comment=defconf interface=ether1
add comment=defconf disabled=yes interface=wlan1
/ip address
add address=192.168.88.2/24 interface=ether1 network=192.168.88.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=wlan1
/ip dhcp-server network
add address=192.168.88.0/24 gateway=192.168.88.3 netmask=24
add address=192.168.99.0/24 gateway=192.168.99.5 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,208.67.222.222
/ip firewall nat
add action=masquerade chain=srcnat out-interface=wlan1
/system clock
set time-zone-name=Asia/Kuala_Lumpur
/system identity
set name="MikroTik Groove52A"
Then simply fire up the HAP ac and connect to 192.168.88.1
Here is the working config for the HAP ac:
# feb/17/2019 15:35:51 by RouterOS 6.43.12
# software id = W6ST-UE2A
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 8A7C08C59608
/interface bridge
add admin-mac=CC:2D:E0:E8:10:BB auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=MikroTik-E810C1 wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto mode=ap-bridge ssid=MikroTik-E810C0 wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
add bridge=bridge disabled=yes interface=ether1
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=ether5 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=192.168.88.0
add address=192.168.88.3/24 interface=ether3 network=192.168.88.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=8.8.8.8,208.67.222.222 gateway=192.168.88.3 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,208.67.222.222
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add distance=1 gateway=192.168.88.2
/system clock
set time-zone-name=Asia/Kuala_Lumpur
/system lcd
set contrast=0 enabled=no port=parallel type=24x4
/system lcd page
set time disabled=yes display-time=5s
set resources disabled=yes display-time=5s
set uptime disabled=yes display-time=5s
set packets disabled=yes display-time=5s
set bits disabled=yes display-time=5s
set version disabled=yes display-time=5s
set identity disabled=yes display-time=5s
set bridge disabled=yes display-time=5s
set wlan1 disabled=yes display-time=5s
set wlan2 disabled=yes display-time=5s
set ether1 disabled=yes display-time=5s
set ether2 disabled=yes display-time=5s
set ether3 disabled=yes display-time=5s
set ether4 disabled=yes display-time=5s
set ether5 disabled=yes display-time=5s
set sfp1 disabled=yes display-time=5s
This is what worked for me and actually in the end I do not even use the ether5 as a WAN port and I disabled the 192,168.88.1 IP/interface altogether.
One last comment : right after I got all pings/traceroute/DNS sorted out, I was thinking that its all good. But no of course. Google.com would work blazing fast, youtube as well! But Inbox by google or facebook would simply not show with a timeout. I had to disable the firewall on the HAP ac and voilà!! All working and with great speed if you can see the picture at the top (19/14 MBps from a distant wifi!)
Hope this helps and don't despair