First: Please remove router serial number from your post!
Second: Config is incomplete, the base subnet is missing typical networking items, ip pool etc.....
THird:
remove or set to
NO the ip bridge firewall settings! This is an advanced menu that is normally not needed.
Fourth: Normally "allow fast path" is set to yes.. Why did you set it to NO??
Fifth: Ether2 should be a hybrid port to the UNIFI..... the untagged vlan should be the base vlan ( the management vlan and the unifis IP should be 192.168.0.X ) PVID of 99, and the other two vlans, main and guest should be tagged as data vlans.
Sixth: Firewall rules need work...............
# model = RB751G-2HnD
# serial number = XXXXXXXXXX
/interface bridge
add name=BR1 protocol-mode=none vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=latvia frequency=auto \
mode=ap-bridge ssid=BLUE
/interface vlan
add interface=BR1 name=BASE_VLAN vlan-id=99
add interface=BR1 name=BLUE_VLAN vlan-id=10
add interface=BR1 name=GREEN_VLAN vlan-id=20
/interface list
add name=WAN
add name=VLAN
add name=BASE
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
supplicant-identity=MikroTik
add authentication-types=wpa2-psk mode=dynamic-keys name=guest \
supplicant-identity=MikroTik
/interface wireless
add mac-address=02:0C:42:FB:C7:4B master-interface=wlan1 name=wlan2 \
security-profile=guest ssid=GREEN
/ip pool
add name=BLUE_POOL ranges=10.0.10.2-10.0.10.254
add name=GREEN_POOL ranges=10.0.20.2-10.0.20.254
add name=BASE_POOL ranges=192.168.0.2-192.168.0.10
/ip dhcp-server
add address-pool=BLUE_POOL interface=BLUE_VLAN name=BLUE_DHCP
add address-pool=GREEN_POOL interface=GREEN_VLAN name=GREEN_DHCP
add address-pool=BASE_POOL interface=BASE_VLAN name=BASE_DHCP
/interface bridge port
add bridge=BR1 interface=ether2 pvid=99 comment="hybrid port to UNIFI"
add bridge=BR1 ingress-filtering=yes frame-type=admit-only-priority-and-untagged interface=ether3 pvid=10
add bridge=BR1 ingress-filtering=yes frame-type=admit-only-priority-and-untagged interface=ether4 pvid=20
add bridge=BR1 ingress-filtering=yes frame-type=admit-only-priority-and-untagged interface=ether5 pvid=99
add bridge=BR1 ingress-filtering=yes frame-type=admit-only-priority-and-untagged interface=wlan1 pvid=10
add bridge=BR1 ingress-filtering=yes frame-type=admit-only-priority-and-untagged interface=wlan2 pvid=20
/interface bridge settings
set use-ip-firewall-for-vlan=no
/ip neighbor discovery-settings
set discover-interface-list=BASE
/ip settings
set allow-fast-path=yes
/interface bridge vlan
add bridge=BR1 tagged=BR1,ether2 untagged=ether3,wlan1 vlan-ids=10
add bridge=BR1 tagged=BR1,ether2 untagged=ether4,wlan2 vlan-ids=20
add bridge=BR1 tagged=BR1 untagged=ether2,ether5 vlan-ids=99
/interface list member
add interface=ether1 list=WAN
add interface=BASE_VLAN list=VLAN
add interface=BLUE_VLAN list=VLAN
add interface=GREEN_VLAN list=VLAN
add interface=BASE_VLAN list=BASE
/ip address
add address=192.168.0.1/24 interface=BASE_VLAN network=192.168.0.0
add address=10.0.10.1/24 interface=BLUE_VLAN network=10.0.10.0
add address=10.0.20.1/24 interface=GREEN_VLAN network=10.0.20.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=10.0.10.0/24 dns-server=192.168.0.1 gateway=10.0.10.1
add address=10.0.20.0/24 dns-server=192.168.0.1 gateway=10.0.20.1
add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1
/ip dns
set allow-remote-requests=yes servers=9.9.9.9
/ip firewall filter
add action=accept chain=input comment="Allow Estab, Related & untracked" \
connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input protocol=icmp
add action=accept chain=input comment="Allow admin" in-interface-list=BASE
add action=accept chain=input comment="users to services" in-interface-list=VLAN dst-port=53,123 protocol=udp
add action=accept chain=input comment="users to services" in-interface-list=VLAN dst-port=53 protocol=tcp
add action=drop chain=input comment="Drop all else" { put this rule in last }
+++++++++++++++++++++++
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward comment="Allow Estab,Related & Untracked" \
connection-state=established,related,untracked
add action=accept chain=forward comment="internet traffic" in-interface-list=VLAN out-interface-list=WAN
add action=accept chain=forward comment="admin to vlans" in-interface-list=BASE out-interface-list=VLAN
add action=accept chain=forward comment="port forwarding" connection-nat-state=dstnat disabled=yes { enable or remove if not required }
add action=drop chain=forward comment="Drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="Default masquerade" \
out-interface-list=WAN
/system clock
set time-zone-name=Europe/Riga
/system identity
set name=RouterSwitchAP
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=ntp.org
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=BASE
)