Thanks for your replies.
@anav: I came across this thread from almost every direction I tried to approach the vlan problem, so I read it multiple times. I think I understand the first part (sort-of tutorial) and found it a great resource. The second part sometimes confuses me (individual problems, contradicting opinions) so it can easily be that I still miss the obvious hidden in there.
@mkx: I checked the switch chip story. My numbering is different (0 is the sfp1, 5 is ether5 and switch1-cpu is 11), and the latter was set to disabled, leave-as-is.
But anyway, I came to the conclusion that my set-up was too complex for debugging. I decided to go for the vlan filtering option and drop the switch chip for the time being. So now I made a HW factory reset and a bare minimum config. Made ether3 the only port for the bridge, set its pvid to 33. Made one vlan (vlan33) with its interface to the bridge and a new dhcp server to work on vlan33 (and the necessary address, network). On "interface bridge lan" I made vlan33 as an untagged element, but did not add ether3 explicitly since as I noticed the system does it automatically, based on the bridge port value. Instead of using my hybrid trunk AP, I simply attached a PC to ether3 (on the AP the tagged traffic seemed to work, the problem was always with the untagged).
What I expected is that the PC communicates untagged, the pvid of ether3 adds a tag 33 and it gets into the bridge, the bridge sends to vlan33 (as untagged) and it gets an IP there, sends back to the bridge (with a tag) and from the bridge (again removing the tag based on the fact that ether3 is on the list of Current untagged) to ether3 and onto the PC. From this list I see everything explicitly set, except when vlan33 sends back an untagged packet who adds back the tag 33. I hope it is done because vlan33 is a vlan, so it should know, but it is not as explicit as on ether3 the PVID.
What I see in real life: under "bridge hosts" there is a dummy MAC (the bridge's MAC I guess) is on VID 33 and an empty VID (untagged I guess) and the real MAC of the PC is on VID 33 (i.e. it gets the 33 tag from ether3 ingress). I do not see vlan33 as a host (maybe I should not even do). I also see on the "interfaces interface" list that ether3 has many times data of about 400-500 bytes (guess the DHCP requests). Still the PC does not get an IP. I also checked the firewall stats and see nothing special (well, I am not sure what I should see anyway).
What I also tried is to change the bridge's PVID to a different number (111), but the only difference is that under "bridge hosts" the dummy MAC of the bridge is 3 times, under VID empty, 33 and also 111
Could you have a look at this minimal configuration and help me with some ideas what is wrong. That would probably solve the original problem as well.
Thanks again,
apr/15/2021 11:46:52 by RouterOS 6.47.4
software id = E0K7-FZPC
model = RB2011UiAS-2HnD
/interface bridge
add name=bridge pvid=33 vlan-filtering=yes
/interface vlan
add interface=bridge name=vlan33 vlan-id=33
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp_pool33 ranges=192.168.33.2-192.168.33.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
add address-pool=dhcp_pool33 disabled=no interface=vlan33 name=dhcp33
/interface bridge port
add bridge=bridge interface=ether3 pvid=33
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge untagged=vlan33 vlan-ids=33
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=ether1 list=LAN
add interface=vlan33 list=LAN
/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
add address=192.168.33.1/24 interface=vlan33 network=192.168.33.0
/ip dhcp-client
add disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.33.0/24 gateway=192.168.33.1
add address=192.168.88.0/24 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN