Mikrotik rb951g 2hnd (не пускает в гостевой WIFI и режет скорость) — что делать?

mikrotik rb951g 2hnd

создано 2 WIFI точки.
1- для работы персонала в сети с паролем
2- для гостей с доступом в интернет но без доступа к сети
1-я работает
2-я подключается но интернета нет (если запихнуть ее в бридж то все работает, но видит сеть)

по LAN портам режет скорость жутко в пределах 2-3Мбит(мерялось спидтестом и ip2ru) хотя с другим роутером работает на уровне 40-50Мбит. Сам микротик при пинге внутренней утилитой на 8.8.8.8 выдает 70-100Мбит.

КОФИГУРАЦИЯ ВОТ:
# jan/02/1970 11:55:17 by RouterOS 6.19
# software id = 25QJ-WQBP
#
/interface bridge
add l2mtu=1598 name=bridge1-local

/interface ethernet
set [ find default-name=ether1 ] comment=WAN name=ether1-gateway
set [ find default-name=ether2 ] comment=LAN name=ether2-master-local
set [ find default-name=ether3 ] master-port=ether2-master-local
set [ find default-name=ether4 ] master-port=ether2-master-local
set [ find default-name=ether5 ] master-port=ether2-master-local

/ip neighbor discovery
set ether1-gateway comment=WAN
set ether2-master-local comment=LAN

/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" \
wpa2-pre-shared-key=*******

add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=wifi_pass supplicant-identity="" \
wpa2-pre-shared-key=*******

add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=free-wifi wpa2-pre-shared-key=*******

/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n default-authentication=no \
disabled=no distance=indoors hw-protection-mode=rts-cts l2mtu=2290 mode=\
ap-bridge periodic-calibration=enabled periodic-calibration-interval=10 \
security-profile=wifi_pass ssid=Eliziya tx-power=18 tx-power-mode=\
all-rates-fixed wds-default-bridge=bridge1-local wds-mode=dynamic \
wireless-protocol=802.11

add disabled=no l2mtu=2290 mac-address=4E:5E:0C:39:D3:63 master-interface=\
wlan1 name=wlan2 ssid=test_use wds-cost-range=0 wds-default-cost=0

/ip pool
add name=dhcp_pool1 ranges=192.168.88.2-192.168.88.254
add name=dhcp_pool2 ranges=192.168.85.2-192.168.85.254

/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=bridge1-local name=dhcp1
add address-pool=dhcp_pool2 disabled=no interface=wlan2 name=dhcp2

/queue simple
add max-limit=2M/2M name=queue1 target=192.168.85.0/24

/interface bridge port
add bridge=bridge1-local interface=ether2-master-local
add bridge=bridge1-local interface=wlan1

/ip address
add address=192.168.88.1/24 interface=bridge1-local network=192.168.88.0
add address=192.168.85.1/24 interface=wlan2 network=192.168.85.0

/ip dhcp-client
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no \
interface=ether1-gateway

/ip dhcp-server network
add address=192.168.85.0/24 dns-server=192.168.88.1,8.8.8.8 gateway=\
192.168.85.1
add address=192.168.88.0/24 dns-server=192.168.88.1,8.8.8.8 gateway=\
192.168.88.1 netmask=24

/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall address-list
add address=192.168.88.0/24 list=inet
add address=192.168.85.0/24 list=inet

/ip firewall filter
add chain=input comment=icmp protocol=icmp
add chain=input comment=established connection-state=established
add chain=input comment=related connection-state=related
add chain=input comment=manage in-interface=bridge1-local
add action=drop chain=input comment="all other drop" in-interface=\
ether1-gateway
add action=drop chain=forward comment="Drop invalid connection packets" \
connection-state=invalid
add chain=forward comment="Allow established connections" connection-state=\
established
add chain=forward comment="Allow related connections" connection-state=\
related
add chain=forward comment="Allow acess to internet" in-interface=\
bridge1-local out-interface=ether1-gateway src-address-list=inet
add action=drop chain=forward comment="All other drop"

/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-gateway

/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes

/ip upnp interfaces
add interface=ether1-gateway type=external
add interface=ether2-master-local type=internal
add interface=ether3 type=internal
add interface=ether4 type=internal
add interface=ether5 type=internal
add interface=wlan1 type=internal
add interface=bridge1-local type=internal
add interface=wlan2 type=internal
/system leds
set 0 interface=wlan1

Умоляю ПОМОГИТЕ....вторые сутки и так и сяк и эдак и никак