Let's start with the main router...
The lan interface above is not configured to use a bridge-vlan. As a result, it's effectively disconnected from wifi and ethernet. To fix this, simply change the device to br-lan.1.
Next, I highly recommend that you remove all 802.11r related items from this (last 3 lines) and from every SSID on every AP. It can actually cause more harm than good with respect to roaming performance and should only be used if there is an actual demonstrated need for it after otherwise optimizing the wifi performance.
Remove masquerading from the guest zone:
Delete this rule -- you already have a forwarding statement that allows this same thing.
Remove masquerading from management:
Delete this:
Replace these:
with this:
config forwarding
option src 'management'
option dest 'lan'
config forwarding
option src 'management'
option dest 'iot'
Delete this (it's not needed):
Replace this:
with this:
config forwarding
option src 'lan'
option dest 'management'
And delete this, it's not necessary:
In the case of both your guest and iot networks, they do not allow input, so you need two rules (each) to allow DHCP and DNS:
config rule
option name 'Guest DHCP'
option src 'guest'
option proto 'udp'
option dest_port '67'
option target 'ACCEPT'
config rule
option name 'Guest DNS'
option src 'guest'
option dest_port '53'
option target 'ACCEPT'
config rule
option name 'IoT DHCP'
option src 'iot'
option proto 'udp'
option dest_port '67'
option target 'ACCEPT'
config rule
option name 'IoT DNS'
option src 'iot'
option dest_port '53'
option target 'ACCEPT'
Now we can move on and look at AP1:
Here, you're missing your bridge-VLANs entirely....
Add:
config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'eth1:u*'
config bridge-vlan
option device 'br-lan'
option vlan '60'
list ports 'eth1:t'
config bridge-vlan
option device 'br-lan'
option vlan '70'
list ports 'eth1:t'
config bridge-vlan
option device 'br-lan'
option vlan '80'
list ports 'eth1:t'
Next, modify the lan to use br-lan.1 and make it unmanaged (I'm assuming you'll manage the devices using the management network:
config interface 'lan'
option device 'br-lan.1'
option proto 'none'
The guest and iot networks should also be unmanaged:
config interface 'guest'
option proto 'none'
option device 'br-lan.70'
config interface 'iot'
option proto 'none'
option device 'br-lan.80'
Now onto AP2...
The same things apply -- add the bridge-VLANs (although it's not clear which port -- eth1 or eth2 -- is in use on this device).
Make the lan, iot, and guest networks unmanaged and don't forget to use br-lan.1 for the lan device.
The managed switch has VLAN 1 tagged on ports 1-4. If that's the case, you'll actually change the bridge-VLANs for VLAN 1 on each of your devices to look like this, instead:
config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'eth1:t'
Or, you can make VLAN 1 untagged + PVID on all ports of the switch.
You didn't post the wifi, dhcp, and firewall files from the APs... we can review those if you continue to have issues. Otherwise, these things should hopefully resolve the problems you were experiencing.
