MikroTik RouterOS bridge VLAN filtering provides Layer 2 VLAN segmentation similar to a switch. The configuration relies on PVID, tagged/untagged ports and the bridge VLAN table.

Inspection commands

/interface bridge print
/interface bridge port print
/interface bridge vlan print

Conceptual example

/interface bridge add name=bridge1 vlan-filtering=no
/interface bridge port add bridge=bridge1 interface=ether2 pvid=10
/interface bridge port add bridge=bridge1 interface=ether3 pvid=20
/interface bridge vlan add bridge=bridge1 vlan-ids=10 untagged=ether2 tagged=bridge1
/interface bridge vlan add bridge=bridge1 vlan-ids=20 untagged=ether3 tagged=bridge1

Before enabling vlan-filtering=yes, verify the bridge VLAN table, tagged trunk ports and management VLAN. An incorrectly ordered change can interrupt remote access.

Practice

In CHR or a suitable lab, create separate access ports for VLAN 10 and VLAN 20 plus one tagged trunk, then inspect the bridge VLAN table.