MikroTik RouterOS 7 Bridge VLAN Filtering

Keep a recovery path. Use a local cable or console and RouterOS Safe Mode (Ctrl+X in the terminal). Confirm management is permitted before any final drop rule. Open a second session to test new access before committing. These examples assume the named objects do not already exist; inspect an existing configuration instead of pasting a second baseline over it.

Plan the ports before the commands

This example uses a new bridge on ether2–ether4. ether5 stays outside the bridge as an existing, tested recovery port, or use a hardware console. Do not continue if your only connection is through a port being changed. Do not apply this as a patch to the single-LAN guide without a migration plan.

Port / interface	Membership	Purpose
ether2	Tagged 30 and 99	Trunk to a VLAN-aware switch
ether3	Untagged VLAN 30; PVID 30	Access device
ether4	Untagged VLAN 99; PVID 99	Local management computer
br-vlan (CPU)	Tagged 99 only	Router management interface
ether5 / console	Outside this bridge	Recovery path

The PVID classifies incoming untagged traffic. The bridge VLAN table determines permitted egress membership and whether a tag is kept or removed. A trunk carries tagged VLANs; an access device normally sends untagged frames.

Stage with filtering off

RouterOS 7

/interface/bridge/add name=br-vlan vlan-filtering=no frame-types=admit-only-vlan-tagged
/interface/bridge/port
add bridge=br-vlan interface=ether2 ingress-filtering=yes frame-types=admit-only-vlan-tagged
add bridge=br-vlan interface=ether3 pvid=30 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged
add bridge=br-vlan interface=ether4 pvid=99 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged
/interface/bridge/vlan
add bridge=br-vlan vlan-ids=30 tagged=ether2 untagged=ether3
add bridge=br-vlan vlan-ids=99 tagged=br-vlan,ether2 untagged=ether4
/interface/vlan/add name=mgmt99 interface=br-vlan vlan-id=99
/ip/address/add address=10.42.99.1/24 interface=mgmt99

Filtering-off is a staging state, not an isolation state. Keep untrusted equipment disconnected during staging. Before enabling filtering, permit your management host through the input firewall on mgmt99. For example, scope SSH/WinBox to 10.42.99.10/32 and place that permit before any input drop. Preserve the recovery-port permit too.

Why the bridge appears as a tagged member

The bridge interface represents the CPU’s participation. VLAN 99 must reach it because the router owns the management IP on mgmt99. VLAN 30 is switched only in this example: omitting br-vlan there keeps it from that routed CPU interface. If the router must route VLAN 30, deliberately add its VLAN interface, CPU membership, address and firewall policy. An interface list entry for br-vlan does not automatically replace an explicit policy for mgmt99.

Enable only after checking access

RouterOS 7

/interface/bridge/port/print detail
/interface/bridge/vlan/print detail
/interface/bridge/set br-vlan vlan-filtering=yes

From the recovery session, enable filtering in Safe Mode. Set a management PC on ether4 to 10.42.99.10/24, then verify a second IP management session to 10.42.99.1. Test tagged VLAN 99 through the switch trunk as well. Confirm ether3 cannot reach management. Commit only after those checks; if access fails, disable filtering from the recovery path and inspect memberships.

Avoid a multi-VLAN row for different untagged access ports: it can unintentionally place each access port in every listed VLAN. Inspect dynamically added PVID memberships too. Hardware offload depends on the switch chip and RouterOS support, so check actual offload flags and load rather than assuming wire-speed performance.

Matching VLANs on a UniFi switch/AP · Count tagged frame overhead · Protect routed VLAN traffic

Kernaali Tools is not affiliated with MikroTik.

Technical references

Found an issue? Send a correction with a reproducible example.