See inline comments:
# Add vlan bridge /interface bridge add name=bridge_vlan5 # add security profile for wifi /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=iot supplicant-identity="" # add virtual wifi to 2.4G and 5G APs /interface wireless set [ find default-name=wlan2 ] band=2ghz-g/n country=netherlands disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge security-profile=xxxxxxxxxxx ssid=MYSSID station-roaming=enabled wireless-protocol=802.11 wps-mode=\ disabled set [ find default-name=wlan1 ] band=5ghz-a/n/ac channel-width=20/40mhz-Ce country=netherlands disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge name=wlan5 security-profile=xxxxxxxxxxxxx skip-dfs-channels=all ssid=\ MYSSID station-roaming=enabled wireless-protocol=802.11 wps-mode=disabled add disabled=no keepalive-frames=disabled mac-address=4A:8F:5A:48:A4:69 master-interface=wlan2 multicast-buffering=disabled name=wlan_iot2 security-profile=iot ssid=IOT vlan-id=5 vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 \ wps-mode=disabled add disabled=no keepalive-frames=disabled mac-address=4A:8F:5A:80:CE:1D master-interface=wlan5 multicast-buffering=disabled name=wlan_iot5 security-profile=iot ssid=IOT vlan-id=5 vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 \ wps-mode=disabled # Add vlans to virtual Wifi /interface vlan add interface=wlan_iot2 name=vlan5_iot-2 vlan-id=5 add interface=wlan_iot5 name=vlan5_iot-5 vlan-id=5 # add ip range for dhcp /ip pool add name=dhcp_pool5_iot ranges=10.5.0.2-10.5.0.200 # add dhcp server with above range /ip dhcp-server add address-pool=dhcp_pool5_iot interface=bridge_vlan5 name=dhcpiot # add vlans and interfaces to vlan bridge /interface bridge port add bridge=bridge interface=wlan_iot2 add bridge=bridge interface=wlan_iot5 add bridge=bridge_vlan5 interface=vlan5_iot-5 add bridge=bridge_vlan5 interface=vlan5_iot-2 # add vlan to existing bridge (Not really needed) is for inter vlan traffic /interface bridge vlan add bridge=bridge_vlan5 vlan-ids=5 # add interfaces to LAN list (firewall needs this) /interface list member add interface=vlan5_iot-2 list=LAN add interface=bridge_vlan5 list=LAN add interface=vlan5_iot-5 list=LAN # Add gateway/dhcpserver ip address /ip address add address=10.5.0.254/24 comment="IOT (vlan5)" interface=bridge_vlan5 network=10.5.0.0 # dhcp server network /ip dhcp-server network add address=10.5.0.0/24 dns-server=1.1.1.1 gateway=10.5.0.254 netmask=24 # generic NAT rule /ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN