Basically my friend has a small board game store with a play area with a mikrotik router and multiple TP-link AP. He got into an argument with the previous IT guy who refused to give them admin access to the mikrotik router. Meaning we're going to have to reset it and set everything up all over again. They have a certain setup and I'm wondering if anyone can lead me towards how I can recreate it for them as I've honestly never worked with Mikrotik before.

The setup is as follows:
They have the ISPs router plugged into the Mikrotik router that is then plugged into a HUB. They want to have two subnets setup. One for the office administration type stuff and another one for customers. The customers will have their own subnet with multiple TP-LINK routers being setup to provide coverage. These TP-LINK routers do not have a bridged AP setting for some reason. They also want to have usernames for the customers and eventually generate vouchers.

I can probably figure out how to set two subnets and seperate them but one thing I don't understand is how to setup the TP-link routers to work with the mikrotik router. I'm hoping someone here can help me out.

Did he pay the last guy?

1. There is a reason there are certifications and trainings.
2. There is a reason the Mikrotik hardware is so incredibly powerful and cheap.

We do managed service for our systems. If the customer demands access to the router... They have violated the terms of service the instant they log in.

Access to our managed services are removed prior to the handoff, and the customer must "sign off" that they are now on their own.

No longer can/will we provide support at all hours of the day and night.

No longer will we check in and apply critical patches.

No longer will we help... Even for money.

We wish them luck.

Hourly consulting and "design to spec" is available at a different rate. But starts at zero. Meaning a blank /clean install.

Also... You make reference to TP-Link ROUTERS. Do you mean WAPs that have the ability to do VLANs on SSIDs? Or do you mean routers with Wifi that you turn off the non "bridged parts".

And setting up vouchers???
How much time do they wanna spend managing this stuff?

ISP router -> Mikrotik -> Hub -> TP-link router's in AP mode or with DHCP disabled (is this correct?)

I sadly can't help much with the MT config but I can give some advice as follows:

1) Office VLAN for office computers EG workstations / laptops. Maybe something like 192.168.10.0/28 , or /29-26 if you need fewer/more devices. Lets assume VLAN10.
1.1) Office VLAN for IoT / staff phones or tablets. 172.16.20.0/26 VLAN 20.
2) Client VLAN for clients 171.16.66.0/26 VLAN 666.
3) Firewall the VLANS from accesing each other.
3.1) Firewall the VLANs bar VLAN10 from accessing Winbox / mangement of the MT.
4) Don't bother with vouchers etc.

I would get a smart or semi smart hub that is VLAN aware. You can obv get another MT to do this function. Hope this helps

PS: I would certainly get someone experianced to help with this setup, mainly so security is covered & the business devices / network is not compromised.