Oh, no. I love bandcamp. I don’t want it to go down the drain. :c

What’s up with bandcamp?

You’re welcome. I’m glad that I could help you :)

I’m fairly new to MikroTik and no expert either, but I don’t think you need a second bridge. You can add your VLANs to the default bridge and handle internet access through firewall rules. Depending on your existing firewall logic, you may have to drop/reject all traffic from the IoT subnet to the internet and all other subnets. Make sure that you add the bridge also as a tagged interface to the VLAN! Else, the DHCP server and all services on the router can not reach the IoT subnet.

I would also recommend to segregate all traffic into different VLANs (WAN, LAN, IoT, …). This makes it easy to manage firewall rules because you can then use either VLAN interfaces or interface lists containing multiple VLAN interfaces for similiar firewall rules. You can simply untag outgoing traffic on specific ports if you want and add a specific tag for incoming traffic.

I have a similiar setup running. Everything is separated into VLANs and these VLANs are configured on the default bridge. Routing/allowing and denying traffic to/from the internet is handled by firewall rules. And I have defined interface lists like NO_INTERNET_ACCESS, NO_LAN_ACCESS, etc. These lists are then used by the firewall rules. If you later want to add another VLAN that should not get access to the internet you can simply add it to the NO_INTERNET_ACCESS list and you do not have to alter your firewall rules for that specific VLAN.

Take this advice with a grain of salt. If possible, do not test this on your production network but on a separate, isolated router.