Which vlan did you want the RB4011 CPU (routing engine) to see? You stated one, but you have two vlan interfaces defined.
For each /interface vlan that is “under” the bridge (that’s what creates the interface for the router engine to associate an ip address with, and an associated tagged connection to the internal trunk link to the bridge/switch), you also need a corresponding /interface bridge vlan statement (this configures the vlan membership and tagging of the layer 2 ports on the layer 2 bridge/switch, including the layer 2 port connected to the “internal trunk link” between the routing engine and the layer 2 bridge/switch)
See RouterOS bridge mysteries explained for more info about what the bridge is in a MikroTik device.
That’s why, as @anav pointed out, that the following lines are in conflict:
/interface bridge vlan
add bridge=bridge1 tagged=bridge1 untagged=ether2 vlan-ids=10
add bridge=bridge1 tagged=bridge1 untagged=ether3 vlan-ids=20
add bridge=bridge1 tagged=bridge1 untagged=ether2,ether3 vlan-ids=1
Each bridge “port” (e.g. ether2, or bridge1) should only have a single vlan untagged. Otherwise it would be ambiguous what vlan an untagged frame belongs to. Also both ends of a hybrid trunk link need to agree on what vlan untagged ethernet frames should be classified into. Otherwise you will get unintentional vlan hopping (what cisco routers with cdp enabled will report as Native VLAN mismatch). See this for more info.