How to make 2 isolated networks on 2 different PPPoE interfaces?

Question

Computer networks

Hello. There was a rather difficult (for me) task. I will try to describe in detail what is available and what needs to be done. Device - Mikrotik RB3011UiAS-RM
There are 2 provider cables (one provider, but on different lines and different PPPoE accounts). One comes to the SFP port with the Mikrotik S-RJ01 transceiver (essentially an additional ethernet RJ45 port), the second one comes to the Ethernet1 port. For convenience, we will call PPPoE-sfp and PPPoE-eth1.
The device is already fully configured to work with one cable (via eth1), it contains all the necessary settings (dhcp, firewall, fully configured CAPsMAN, etc.). It is important that when setting up network in the previous nothing has changed. Subnet 192.168.88.1, currently used ports - eth1 (PPPoE), eth2, eth3, eth4, eth5, eth10.
I need to create a new network based on this device (in fact, it already exists on RB951, I need to transfer it to RB3011) with subnet 192.168. (PPPoE), eth6, eth7, eth8, eth9.
Networks should not touch each other (you need to prohibit access from one to another and vice versa), have their own autonomous settings, etc. But access to the router settings should be from both networks (from one at 192.168.88.1, on the other at 192.168.10.1)
I tried to do it through the setting of two Bridges, but when adding ports to it, on which PPPoE clients hang, PPPoE is cut off. For a long time and a lot I tried to shaman according to various articles, but in the end nothing came of it.
I would be immensely grateful for the help, tk. I'm pretty weak in Mikrotik.

Answer 1

I don’t see a problem either, it’s just that all settings will be repeated with a change in interfaces and addresses
1) Create another LAN2 bridge and assign IP 192.168.10.1 to it
2) Create a second DHCP server
3) Create all the same firewall rules, only change 192.168 .88.0 on 192.168.10.0 and PPPoE1 on PPPoE2
4) NAT separately for each network with src-address=192.168.88.0/24 and src-address=192.168.10.0/24 respectively
5) Block traffic between networks:
/ip route rule
src-address=192.168.10.0/24
add action=unreachable dst-address=192.168.10.0/24 src-address=192.168.88.0/24
/ip firewall filter
add action=drop chain=forward dst-address=192.168.88.0/24 src-address=192.168.10.0/24
add action=drop chain=forward dst-address=192.168.10.0/24 src-address=192.168.88.0/24

Answer 2

And what exactly is the problem?
1. Create bridge 1 from 1-5,10 and assign routes from it to PPPoE-eth1
2. Create bridge 2 from 6-9 and assign routes from it to PPPoE-sfp
Here you have 2 routers in one piece of hardware. Kapsman also fits into interfaces / bridges, management - also routing of incoming / outgoing traffic.
PS: But I don't understand why bother with such a configuration at a price of 951 $40? If only then to build routing between LANs or redundant WANs, and two completely isolated networks on one piece of iron - it is possible, but nafik is needed.

Answer 3

/ip route rule

add src-address=192.168.0.0/24 dst-address=192.168.33.0/24 action=unreachable

add src-address=192.168.33.0/24 dst-address=192.168.0.0/24 action=unreachable