Настройка MikroTik — удалённая работа в Москве

Сетевое оборудование: роутер, точки доступа. Есть MikroTik RB952Ui-5ac2nD и две точки RBcAPGi-5acD2nD-XL (подключил их через CAPsMAN). Всего одна сеть. На самом роутере поднял DHCP, точки подключены к роутеру через неуправляемый коммутатор. К точкам подключиться можно, но вот доступ в интернет как будто зажат. Канал 100 Мбит\с выход в интернет, когда делаешь спидтест с устройства, которое подключилось к точкам, 1-2 Мбит\с, через подключение с коммутатора, всё работает идеально. Тестировал, без точек, с подключением к роутеру, всё норм. Что настроил не правильно, не получается разобраться. Нужна помощь. Могу прислать конфиг. Перерыв связи не желателен((. > export # mar/06/2023 12:58:46 by RouterOS 6.49.6 # software id = CNTJ-FDU4 # # model = RB952Ui-5ac2nD # serial number = /caps-man channel add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=disabled frequency=2412 name=2.4Ghz tx-power=14 /interface bridge add name=bridge1 /interface ethernet set [ find default-name=ether1 ] name=ether1-WAN set [ find default-name=ether2 ] name=ether2-LAN /interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce country=no_country_set disabled=no mode=ap-bridge ssid=SC-2.4G \ wireless-protocol=802.11 set [ find default-name=wlan2 ] country=no_country_set disabled=no mode=ap-bridge ssid=SC-5G wireless-protocol=802.11 /caps-man datapath add bridge=bridge1 client-to-client-forwarding=yes local-forwarding=yes name=datapath1 /caps-man security add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm group-encryption=aes-ccm name=security passphrase=ххх /caps-man configuration add channel.band=2ghz-b/g channel.control-channel-width=20mhz channel.extension-channel=XX country=no_country_set \ datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes name=cfg-2ghz security=security ssid=SC-2.4GHz add channel.band=5ghz-a/n/ac channel.control-channel-width=20mhz channel.extension-channel=XXXX country=no_country_set \ datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes name=cfg-5ghz-ac security=security ssid=SC-5GHz add channel.band=5ghz-a/n channel.control-channel-width=20mhz channel.extension-channel=XX country=no_country_set \ datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes name=cfg-5ghz-an security=security ssid=SC-5GHz /caps-man interface add channel.band=2ghz-b/g/n channel.control-channel-width=20mhz channel.extension-channel=disabled channel.frequency=2412 channel.tx-power=\ 28 configuration=cfg-2ghz configuration.distance=dynamic configuration.mode=ap configuration.rx-chains=0,1,2,3 configuration.ssid=\ SC-2.4G configuration.tx-chains=0,1,2,3 datapath=datapath1 datapath.bridge=bridge1 datapath.client-to-client-forwarding=yes \ datapath.local-forwarding=yes disabled=no l2mtu=1600 mac-address=18:FD:74:95:07:16 master-interface=none name=AP-1 \ radio-mac=18:FD:74:95:07:16 radio-name=18FD74950716 security=security security.authentication-types=wpa-psk,wpa2-psk \ security.encryption=aes-ccm security.group-encryption=aes-ccm security.passphrase=ххх add channel.band=2ghz-b/g/n channel.control-channel-width=20mhz channel.extension-channel=disabled channel.frequency=2412 channel.tx-power=\ 28 configuration=cfg-2ghz configuration.country=no_country_set configuration.distance=dynamic configuration.mode=ap configuration.ssid=\ SC-2.4G datapath=datapath1 datapath.bridge=bridge1 datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes disabled=no \ l2mtu=1600 mac-address=18:FD:74:95:04:CE master-interface=none name=AP-2 radio-mac=18:FD:74:95:04:CE radio-name=\ 18FD749504CE security=security security.authentication-types=wpa-psk,wpa2-psk security.encryption=aes-ccm security.group-encryption=\ aes-ccm security.passphrase=ххх /interface list add name=WAN add name=LAN add name=“ALL ROUTABLE INT“ add name=LOCAL /interface wireless security-profiles set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=\ ххх wpa2-pre-shared-key=ххх /ip pool add name=dhcp ranges=10.100.10.100-10.100.10.200 /ip dhcp-server add address-pool=dhcp interface=ether2-LAN lease-time=1d name=dhcp1 add address-pool=dhcp disabled=no interface=bridge1 lease-time=12h name=dhcp2 /snmp community set [ find default=yes ] addresses=10.100.10.0/24 /caps-man manager set enabled=yes /caps-man provisioning add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=cfg-2ghz name-format=identity add action=create-dynamic-enabled hw-supported-modes=ac master-configuration=cfg-5ghz-ac name-format=prefix-identity name-prefix=5ghz-ac add action=create-dynamic-enabled hw-supported-modes=an master-configuration=cfg-5ghz-an name-format=prefix-identity name-prefix=5ghz-an /interface bridge port add bridge=bridge1 interface=ether2-LAN add bridge=bridge1 interface=ether3 add bridge=bridge1 interface=ether4 add bridge=bridge1 interface=ether5 add bridge=bridge1 disabled=yes interface=ether1-WAN add bridge=bridge1 interface=wlan2 add bridge=bridge1 interface=wlan1 /ip neighbor discovery-settings set discover-interface-list=!dynamic /interface list member add interface=ether1-WAN list=WAN add interface=ether2-LAN list=LAN add interface=ether3 list=LAN add interface=ether4 list=LAN add interface=ether5 list=LAN add interface=wlan2 list=LAN add interface=wlan1 list=LAN add interface=bridge1 list=LAN /interface wireless cap set bridge=bridge1 interfaces=wlan2,wlan1 /ip address add address=10.100.10.1/24 interface=bridge1 network=10.100.10.0 add address=ххх interface=ether1-WAN network=ххх /ip dhcp-client add interface=ether1-WAN /ip dhcp-server lease add address=10.100.10.183 client-id=1:18:fd:74:95:7:16 mac-address=18:FD:74:95:07:16 server=dhcp2 add address=10.100.10.181 client-id=1:18:fd:74:95:4:ce mac-address=18:FD:74:95:04:CE server=dhcp2 /ip dhcp-server network add address=10.100.10.0/24 gateway=10.100.10.1 netmask=24 /ip dns set servers=77.88.8.8,8.8.4.4,8.8.8.8,10.100.10.1 /ip firewall address-list add address=10.100.10.0/24 list=SUPPORT /ip firewall filter add action=add-dst-to-address-list address-list=BlackList address-list-timeout=10m chain=output comment=\ “F2B Winbox: Login Failure -> BlackList“ content=“invalid user name or password“ protocol=tcp src-port=8291 add action=add-dst-to-address-list address-list=BlackList address-list-timeout=10m chain=output comment=\ “F2B Web: Login Failure - BlackList“ connection-state=established content=“Error 403“ protocol=tcp src-port=80 /ip firewall nat add action=masquerade chain=srcnat out-interface-list=WAN /ip firewall service-port set ftp disabled=yes set tftp disabled=yes set irc disabled=yes set h323 disabled=yes set sip disabled=yes set pptp disabled=yes set udplite disabled=yes set dccp disabled=yes set sctp disabled=yes /ip route add distance=1 gateway=ххх /ip service set telnet disabled=yes set ftp disabled=yes set www address=10.100.10.0/24 set ssh disabled=yes set api disabled=yes set winbox address=10.100.10.0/24 set api-ssl disabled=yes /ip upnp set enabled=yes /ip upnp interfaces add interface=bridge1 type=internal add interface=ether1-WAN type=external /system clock set time-zone-name=Europe/Moscow /system identity set name=Office /system logging add topics=account add topics=firewall /system ntp client set enabled=yes primary-ntp=10.100.10.1 secondary-ntp=37.79.247.7 >.