HowTo: http://support.clouditsp.com/index.php?/Knowledgebase/Article/View/102/0/how-to-setup-a-guest-wifi-network-on-a-mikrotik

Additional Info: http://forum.mikrotik.com/viewtopic.php?t=81061

If you need any wired ports to be part of the guest network, you'll need to create a bridge (like br-guest) and bridge the guest vAP to the desired Ethernet ports and adjust the howto steps as necessary.

The existing NAT (masquerade) rule may be sufficient to NAT both the LAN and the Guest networks. For example, if the existing NAT rule masquerades all traffic going out ether1, that is probably sufficient for both networks.

To block traffic between guest and private networks, we must use “forward” chain, not “input”.