MikroTik RouterOS Bridge VLAN Filtering Configuration

MikroTik RouterOS 7 handles VLANs through the bridge: every physical port joins one bridge, and the bridge VLAN table decides which VLANs each port may carry and whether frames egress tagged or untagged. The single setting that turns VLAN-awareness on is vlan-filtering=yes — everything else is port PVIDs plus table entries. This guide explains the model and walks through a typical trunk/access setup on a CRS or CCR router.

How Bridge VLAN Filtering Works

• Tagged port: egress frames keep their VLAN tag (your trunk port).
• Untagged port: egress frames have the tag stripped (your access port); ingress untagged frames are assigned to the port's PVID.
• Bridge VLAN table: lists which VLAN IDs are allowed on which ports. A frame whose VLAN is not in the table for the egress port is dropped — a misconfigured table either leaks VLANs to the wrong access port or black-holes traffic.

Configuration Example: Two Access VLANs and One Trunk

Goal: ether1 is a trunk carrying VLANs 20 and 30; ether2 is an access port in VLAN 20; ether3 is an access port in VLAN 30.

/interface bridge add name=bridge1 vlan-filtering=no
/interface bridge port add bridge=bridge1 interface=ether1
/interface bridge port add bridge=bridge1 interface=ether2 pvid=20
/interface bridge port add bridge=bridge1 interface=ether3 pvid=30
/interface bridge vlan add bridge=bridge1 tagged=ether1 vlan-ids=20
/interface bridge vlan add bridge=bridge1 tagged=ether1 untagged=ether2 vlan-ids=20
/interface bridge vlan add bridge=bridge1 tagged=ether1 untagged=ether3 vlan-ids=30
/interface bridge set bridge1 vlan-filtering=yes

Note the common trap: with vlan-filtering=no (default) the bridge ignores tags entirely and both VLANs leak everywhere. Enable filtering last, after the table is correct, or you can lock yourself out of the router. The untagged ports with the same PVID are grouped into the same table entry automatically.

Management Access Over a Specific VLAN

Many deployments restrict router management to one VLAN. Put the bridge itself in the table as a tagged port and give the VLAN interface the management address:

/interface vlan add name=vlan99 interface=bridge1 vlan-id=99
/ip address add address=10.0.99.1/24 interface=vlan99
/interface bridge vlan add bridge=bridge1 tagged=bridge1,ether1 vlan-ids=99

With the bridge listed as tagged, only frames tagged 99 reach the CPU path of the router — a cheap and effective management-plane filter for devices that support hardware offloaded filtering.

Verification and Inter-VLAN Routing

/interface bridge vlan print
/interface bridge port print
/interface bridge print
/ip address print

The VLAN table printout shows CURRENT-TAGGED and CURRENT-UNTAGGED columns so you can spot accidental leakage: an access port appearing under the wrong VLAN ID means its PVID or the table entry is wrong. To route between VLANs, create a VLAN interface on the bridge for each VLAN and address them — the bridge itself stays Layer 2 and RouterOS routes between the VLAN interfaces.

VLAN design concepts transfer across vendors; compare the access/trunk model in our ArubaOS-CX access vs trunk comparison and the Linux-side tagging in Linux 802.1Q sub-interfaces.

原文链接：https://help.mikrotik.com/docs/spaces/ROS/pages/28606465/Bridge+VLAN+Table