VLAN Bridge Filtering ALternative

The Realtek and MediaTek switch chips are fully-featured devices and include VLAN support - the issue here is the Mikrotik approach to network architecture which stems from originally using Atheros switch chips.

Looking at Winbox and seeing ether1-5 interfaces you are fooled into thinking that the CPU has five ethernet interfaces, each connected to the corresponding physical port. In reality the CPU has one or two ethernet interfaces wired to a switch chip (either within a single system-on-chip package or separate CPU and switch chips), which in turn is wired to the physical ports. Network traffic is always passing through the switch chip irrespective of if you are using the interfaces individually or in a bridge (with or without VLAN filtering).

Atheros implement a proprietary extension to the data flowing between the CPU and switch which specifies which physical port the traffic is associated with so the driver can multiplex/demultiplex the traffic to the logical interfaces. Not having this in the other manufacturers chips you have to resort to using VLANs to handle this multiplexing/demuliplexing which would impose restrictions - making five VLAN IDs reserved, no VLAN trunks. Internally Mikrotik will be using VLANs to perform this multiplexing/demuliplexing with the Realtek and MediaTek switch chips, and don’t provide any user access to VLAN functionality.

If you look at OpenWrt you get a better idea of how the hardware is arranged, e.g. https://openwrt.org/toh/mikrotik/mikrotik_rb750gr3