MikroTik RouterOS Bridge VLAN Filtering and PVID Explained

RouterOS does VLANs in software-defined bridges rather than on a fixed switch ASIC model, and two settings decide everything: the bridge VLAN table entry (tagged or untagged) and the port's PVID. Get those wrong and you get the classic RouterOS symptom - the management IP disappears the moment you enable VLAN filtering.

The Two Rules to Internalise

• Egress. A port listed as tagged in a VLAN entry gets frames with that tag. A port listed as untagged has the tag stripped before the frame leaves.
• Ingress. An untagged frame arriving on a port is tagged with that port's PVID. A tagged frame is not rewritten - if it arrives with VLAN 40 and the port PVID is 20, it stays VLAN 40.

The second rule surprises most people. PVID is not 'the VLAN for this port', it is 'the tag added to untagged frames on this port'.

Bridge VLAN Table vs Port PVID

A Concrete Trunk/Access Build

ether1 is a trunk carrying VLAN 20 and 30; ether3 is an access port for VLAN 30; the CPU/bridge must stay reachable in VLAN 99.

/interface bridge
add name=bridge1 vlan-filtering=no

/interface bridge port
add bridge=bridge1 interface=ether1 pvid=1 frame-types=admit-only-vlan-tagged
add bridge=bridge1 interface=ether3 pvid=30
add bridge=bridge1 interface=ether4 pvid=99

/interface bridge vlan
add bridge=bridge1 vlan-ids=20 tagged=ether1
add bridge=bridge1 vlan-ids=30 tagged=ether1 untagged=ether3
add bridge=bridge1 vlan-ids=99 untagged=ether3,ether4,bridge1

# management on VLAN 99
/interface vlan
add interface=bridge1 name=vlan99 vlan-id=99
/ip address
add address=192.168.99.1/24 interface=vlan99

# only now enable filtering
/interface bridge
set [find name=bridge1] vlan-filtering=yes

Order matters. Build the VLAN table and the management access path before enabling vlan-filtering, and always include the bridge interface itself (bridge1) as a member of the VLAN you manage the device from. This is the step whose omission locks people out of their own router.

Tightening the Trunk Port

frame-types=admit-only-vlan-tagged plus ingress-filtering=yes turns a trunk port into a strict tagged-only port: untagged frames are dropped on ingress and any VLAN not present in the table is discarded. Do this after the basics work, not during the first build.

/interface bridge port
set [find interface=ether3] ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged
set [find interface=ether1] ingress-filtering=yes

Verification

/interface bridge vlan print
/interface bridge port print detail
/interface bridge host print
/ip address print
/ping 192.168.99.10

Two gotchas worth knowing: a dynamic VLAN entry appears automatically for every PVID in use, so do not create duplicates by hand; and if you rely on hardware offload for switching, check that the bridge is actually offloading - if hw-offload is disabled, all VLAN traffic is handled by the CPU and throughput collapses.

When It Breaks, It Breaks Loudly

• Lost management after enabling filtering - the bridge interface is not untagged in the management VLAN, or the management interface is on a port whose PVID was changed.
• Tagged frames silently dropped - the VLAN is not in the bridge VLAN table for that port.
• Untagged frames leaking - a port has a PVID for an access VLAN but is also listed untagged in another VLAN entry.

RouterOS is often the router behind a small site rather than the core switch; if VLAN tagging is only needed for a single uplink, NAT and dst-nat rules are usually the better tool, and for DHCP-heavy access networks DHCP option 82 is worth configuring at the same time.

原文链接：https://help.mikrotik.com/docs/spaces/ROS/pages/28606465/Bridge+VLAN+Table