Thank you for taking time to share your configuration. However, it reminded me of something I saw in RouterOS documentation. Isn’t it very similar to configuration shown here?:
https://help.mikrotik.com/docs/display/ROS/Layer2+misconfiguration#Layer2misconfiguration-VLANonabridgeinabridge
Either way, it is ugly indeed like you said.
After making my last post, I decided to run some more tests. I tested two ways of configuring guest WiFi.
All tests were done within LAN, nothing going over the firewall, just L2.
Running iperf3 on iPhone to a wired server, a single stream.
Baseline: ~600Mbps
Scenario 1: bridge filters for guest WiFi, no VLANs
WiFi: 419Mbps, one core is 100%
Multiple iperf streams can reach the baseline throughput since more cores are involved
Scenario 2: bridge VLAN filtering
WiFi: 622Mbps, one core is 90%, CPU is not the bottleneck
It turns out merely have those 4 bridge rules affects max throughput over WiFi much worse than VLAN filtering. The rules don’t even have anything to do with the wireless interface I was connected to, but the bridge still has to process them.
However, in real world WiFi throughput will be less (I tested 3 meters away from the router), so I would say either approach should work well for my case.