Guest WiFi - access restriction?

Question

linux

Hello. Here the question is a little noobish, but my head doesn’t want to work anymore, I decided to seek advice.
There is a network - Internet - > Mikrotik with the address 10.0.5.1/28 -> dlink-615 router with openwrt with the address 10.0.5.14/28, configured just as an access point. Server (AD, Samba, XBMC, etc...) with address 10.0.5.10/28 (for example). Also, Mikrotik keeps several tunnels for work, a total of about 15 routes to different subnets, set it up on sick leave, and left it.
Out of kindness, I decided to raise a guest network for friends' neighbors, who come to visit very often and in large quantities, there are not enough addresses for everyone, and I'm sick of adding poppies to DHCP.
Created wifi - interface without password "Guest_51", assigned address 172.14.1.1/24, DHCP server, natified interface on lan,
The problem is that from this network there should not be access either to my network or to working subnets, only access to the Internet.
I see 2 solutions:
1) Create a vlan on Mikrotik, vlan on a long one, a wifi interface in a bridge with a vlan
2) Destroy a firewall
Advise how this can be done?
UPD: I am attaching a clumsy network map

Answer 1

In pictures on openwrt in 5 minutes wiki.openwrt.org/doc/recipes/guest-wlan-webinterface
via configs wiki.openwrt.org/doc/recipes/guest-wlan
in pictures in Russian https://docs.google.com /document/d/1HGJqoD4zdtkk-C...

Answer 2

Mikrotik initially routes networks between themselves .... something like this to do if? suit?

Answer 3

The rule needs to be created only on dlink. Above the level, you no longer have the same addressing that is used in your guest network and Mikrotik will not see it.
Alas, I do not know the possibilities of wrt'shki to offer an alternative.

Answer 4

it's called wifi isolation
wiki.openwrt.org/doc/uci/wireless
Name Type Required Default Description
isolate boolean no 0 Isolate wireless clients from each other, only applicable in ap mode. May not be supported in the original Backfire release for mac80211