The subtleties of setting up a bridge on RouterOS, how to do it right?

Question

WiFi

I have a wifi bridge for several km, it works well, but I want to clarify some incomprehensible points for myself.
Bridge configuration: the
first AP connected to the provider switch operates in the mode mode=bridge, the second AP (acting as a router) has the mode mode=station-bridge.
Now the questions:
1. Both APs are configured to operate at the same frequency frequency=5650 frequency-mode=superchannel, why does the first AP that is connected to the provider switch need to be configured at all scan-list? She just broadcasts at the frequency set for her, she doesn’t seem to need to scan anything.
2. The second AP indicates scan-list=5630-5670,defaultwhether this is correct or whether it is necessary to indicate exactly the frequency at which the first AP broadcasts to it, for example like this: scan-list=5650? It is also not very clear why it is needed here, and whetherdefault(since it's hardly necessary to scan all base frequencies from 5ghz-a/n)?
3. In the logs I see the following:

wlan1-gateway: must select network

<-- Далее ТД находит несколько сетей на частотах 5300, 5200, 5700, 5785 -->

wlan1-gateway: no network that satisfies connect-list,  by default choose with strongest signal
wlan1-gateway: failed to select network

On both APs I have the setting default-authentication=yes. If I change it to noand add the second AP's MAC to access-list, will that solve the problem? I don’t want the AP to try to connect to some left AP every 6 seconds, especially choosing the one with the better signal.
Also, I don’t really understand default-authentication=nowhat should be done only on the second AP (which has mode=station-bridge), or on both?

Answer 1

1. The frequency specified in Frequency must fall within the range of the scanlist.
2. Better leave scan-list=default everywhere (this means that your Mikrotik will see any hardware-accessible frequency specified in Frequency).
3. default-authentication=no + access-list is the solution to your problem (it will help prevent attempts to connect to other people's points). It's best to sign up for both.

Answer 2

1. Access list is used on the master point, connect-list is used on the client point. When using the connection list, you must make the SSID field in the interface settings inactive. Then the dot will look for a match with the connect list. When adding an entry to the connection list, you must have a security profile already created.
2. The scan list on the master point is used only for wireless utilities. And the point broadcasts at a given frequency (if not auto). On the client point, it is also used to discover the master point.
3. As an option to protect against connection to left points, set up a bridge, for example, in nstreme. This protocol has the advantage of stable transmission of a large stream of RX or TX traffic. And besides, he's arrogant. Hardcode the wireless protocol on both points.