I have a CRS125-24G-1S on 6.45.7 with RouterOS that I use as a Smart Switch and DHCP server.
This CRS has 5 bridges on it for separation of networks.
It is not a gateway. The main gateway is a 2011.
1 bridge is mostly untagged traffic for management of network devices, cameras, servers, and access control stuff.
1 bridge is just for VOIP, also untagged.
1 bridge is a mix of tagged and untagged interfaces.
The other 2 are strictly tagged interfaces for wireless only. Kids networks.
I have a toughswitch that passes the vlans to my unifi APs.
In the past, I have been able to disable the bridge and it would kill all traffic to the corresponding network. Wireless devices would still show that they were connected to the wireless AP, but the internet would stop for these devices. I would use the bridges as an easy way to disable the kids networks to either get their attention or if they were not doing stuff they were supposed to (chores, homework, etc) or just being an a-hole.
I have noticed lately that disabling those bridges have no effect on tagged interfaces, I would have to reboot for it to take effect and kill the traffic. It only does this for the interfaces that are tagged. If the bridge has untagged interfaces in it, the untagged devices will get kicked of right away, while the tagged ones still work just fine. I have also tried disabling the tagged interface itself going to the toughswitch, everything still works. If I disable the untagged (main) interface it drops both the untagged and tagged like I would expect.
All networks get to the main router via 1 cable with 1 network untagged and 4 networks tagged so there can’t be another path out. After the bridges and vlans are disabled, I can still ping the device IPs from the main router with 0 hops as long as the 2 interfaces they rely on are vlans, so it’s a layer 2 not a reroute somewhere. If 1 of the interfaces the connection relies on is not a vlan, it severs the connection right away.
I have even deleted a vlan interface and it still worked as if it was there until a reboot.
Enabling and disabling a bridge in RouterOS is way faster and easier than setting firewall rules or disabling the wireless networks in Unifi. It also lets me do it without breaking other networks while the change is happening. Especially since I normally do this with the app on my phone.
It used to work just fine. Now it seems like changes to vlans interfaces do not take effect instantly like everything else does in RouterOS.
Why the change? Was this intentional or a side product of another change in an update?
It’s not like you can easily lock yourself out of a local Mikrotik messing with vlans like you can do on other devices since you can usually fall back on MAC winbox or MAC telnet.