I had broken down and used the quickset to just have an okay working router, but my intentions are to segment my lan and personal WiFi networks from roommates and guests WiFi network. I have the winbox64 ver. 7.17.2 but could not find ap bridge mode as described and shown in the tutorials I watched. I have tried winbox 4 beta, but I have found no difference in options available, only a graphical difference in the UI. I am also attempting to have a RPi4 running pihole and unbound. My plan was to have a bridge on 172.x.x.x for my lan1 and wifi2, a second bridge on 10.x.x.x for the RPi4, and a third bridge on 192.x.x.x for roommates and guests for wifi1. I was trying to use vlans, but that got me close to puking. I believe the bridges are where I am messing up, as my pc has an internet connection but my WiFi2 connects to my phone with no internet. I just tried placing eth1wan on bridge1, to no avail so I have broken down making another hapax3 post here hoping for some guidance. I hope my explanation is okay, as trying to make a network topology diagram in draw.io did not go very well either! I have been at this for longer than I would like to admit. I do not know if my ISP forcing their DNS is part of the issue, as it is greyed out under the settings and adding cloud flare only broke things more. Following the advice of placing eth1wan on bridge1 has broken the internet on my PC, so I am posting from my tablet before I wipe my messed up config and do another quickset. Please let me know what details or other info I need to bring for some help. Thank you for reading.
Hi Yepa,
Read this article for vlans: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/310
For configuring vlans the easy approach is to take one of the ports lets say ether5, at least temporarily OFF the single bridge. Give it an IP address and add to LAN interface list, assuming you are starting from defaults.
set [ find default-name=ether5 ] name=OffBridge5
add address=192.168.77.1/30 interface=OffBridge5 network=192.168.77.09
add interface=OffBridge5 list=LAN
Plug your laptop into ether5 and change laptop ipv4 settings to 192.168.77.2 and then you should have access to the config.
This is a safe spot to conduct vlan filtering setup.
Take your time, once you get back to the default setup and have applied the above, have read the article and have attempted a vlan setup according to your needs,
then post your config for review and assistance ( most use notepad++ ) to open the downloaded rsc file to copy and paste here with some changes.
/export file=anynameyouwish ( minus router serial number, any public WANIP information, keys )
Adding:
-
Start again from scratch
-
Don’t use quickset
-
ONE bridge is all you need
-
Read and digest that thread anav linked to
-
and please PLEASE use proper spacing and paragraphs when writing something. It’s pretty hard to read such a wall of text.
That post thread is what had me close to puking from self frustration. I will keep trying in the meantime.
I was able to follow your directions and moved to ether5 to set up a management vlan but reached a point where I locked myself out after trying to enable vlan filtering. I exported my config and reset to defaults so I could post it here.
I believe I need to set DHCP for each vlan, I have given each an address pool but was not getting an IP for my PC nor for my phone when I enabled wifi2.
I will try to do better with my formatting, thank you again.
# 2025-02-08 03:21:45 by RouterOS 7.17.2
# software id = LLH5-YFT8
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = xxxxxxxxxxx
/interface bridge
add admin-mac=xx:xx:xx:xx:xx:xx auto-mac=no comment=defconf name=bridge \
vlan-filtering=yes
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=\
10min-cac .width=20/40/80mhz configuration.mode=ap .ssid=MikroTik-445F71 \
security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.band=2ghz-ax .skip-dfs-channels=\
10min-cac .width=20/40mhz configuration.country="United States" \
.hide-ssid=yes .mode=ap .ssid=TpLinkax8 disabled=no \
security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
/interface vlan
add interface=bridge name=vlan05 vlan-id=5
add interface=bridge name=vlan10 vlan-id=10
add interface=bridge name=vlan15 vlan-id=15
add interface=bridge name=vlan99 vlan-id=99
add interface=bridge name=vlang20 vlan-id=20
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 pvid=10
add bridge=bridge comment=defconf interface=ether3 pvid=5
add bridge=bridge comment=defconf interface=ether4 pvid=15
add bridge=bridge comment=defconf interface=wifi2 pvid=10
add bridge=bridge interface=wifi1 pvid=20
/ip neighbor discovery-settings
# ipv6 neighbor configuration has changed, please restart the device in order to apply the new settings
set discover-interface-list=LAN
/ipv6 settings
# ipv6 neighbor configuration has changed, please restart the device in order to apply the new settings
set disable-ipv6=yes
/interface bridge vlan
# ether5 not a bridge port
add bridge=bridge tagged=ether2,wifi2,bridge untagged=ether5 vlan-ids=10
# ether5 not a bridge port
add bridge=bridge tagged=ether3,bridge untagged=ether5 vlan-ids=5
# ether5 not a bridge port
add bridge=bridge tagged=ether4,bridge untagged=ether5 vlan-ids=15
add bridge=bridge tagged=wifi1,bridge vlan-ids=20
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether5 list=LAN
add interface=vlan99 list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=172.16.92.0/24 interface=vlan99 network=172.16.92.0
add address=10.0.2.0/24 interface=vlan05 network=10.0.2.0
add address=172.16.95.0/24 interface=vlan15 network=172.16.95.0
add address=192.168.66.0/24 interface=vlang20 network=192.168.66.0
add address=172.16.77.3/24 interface=vlan10 network=172.16.77.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.pool.ntp.org
add address=1.pool.ntp.org
add address=2.pool.ntp.org
add address=3.pool.ntp.org
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system routerboard wps-button
set enabled=yes on-event=wps-accept
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source="\r\
\n :if ([system leds settings get all-leds-off] = \"never\") do={\r\
\n /system leds settings set all-leds-off=immediate \r\
\n } else={\r\
\n /system leds settings set all-leds-off=never \r\
\n }\r\
\n "
add comment=defconf dont-require-permissions=no name=wps-accept owner=*sys \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
source="\r\
\n :foreach iface in=[/interface/wifi find where (configuration.mode=\"a\
p\" && disabled=no)] do={\r\
\n /interface/wifi wps-push-button \$iface;}\r\
\n "
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
While vlan-filtering is set to no on a bridge, no stripping or adding a VLAN tag happens on the bridge ports. So when a tagless frame gets in, through a physical interface, it stays tagless until it hits the IP stack listening at the internal port of the bridge (the "switch-facing interface of the router as outlined here).
Once you set vlan-filtering to yes, frames that get in through a physical interface get tagged with the VLAN ID that is set as the pvid of that port on the corresponding /interface/bridge/port row. But your configuration has no pvid specified for the “router-facing port of the switch”, which means its value is the default - 1. Hence the frame that came in e.g. via ether2 and thus got tagged with VLAN ID 10 passes through that “router-facing port of the switch” to the “switch-facing port of the router” still tagged, hence the IP stack attached to the “switch-facing port of the bridge”, which only handles tagless frames, ignores it. And so does mac-telnet or mac-winbox - they only listen for tagless traffic and only on interfaces that they are told to listen at in the configuration:
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
So if you want to switch vlan-filtering from no to yes without locking yourself out, the pvid value of the “router-facing port of the switch” (a.k.a. “the bridge itself”) must be the same like the value of the pvid on the /interface/bridge/port row matching the physical interface your laptop is connected to. Or you must create in advance an /interface/vlan attached to the “switch-facing interface of the router” (again a.k.a. “the bridge itself”) whose vlan-id value matches the pvid of the laptop-facing physical interface, and attach an IP address and subnet to it; the subnet must differ from the one attached to the bridge directly so you have to change the IP address of the laptop after setting vlan-filtering to yes. Or you may add that /interface vlan to the interface list LAN to allow mac-winbox/mac-telnet access.
With truly super-tremendous respect for @sindy, for anyone who is not conversant in VLAN-speak to comprehend this should immediately be awarded a PhD. (And, @sindy the Nobel prize in education.) 
I have read this 3 times so far, after years of trying hard to understand and work with VLANS, and am hovering at about 15% comprehension (and I promise you, it’s been decades since anyone has (reasonably) considered me an idiot). This might not apply to the population of people reading this forum, but I learned many decades ago that if I’m feeling confused and lost on a topic, plenty of other people are also.
Would it be too much to ask for more clear, more dumbed-down (but still complete and accurate), expanded translation of this?
Along the lines of ELI5 (explain it like I’m 5).
I truly have have no doubt it is ultra-dense in wisdom and knowledge – and would really love to master it.
Something like:
In a small town, there lived an MT router (sitting on a shelf with some MT and non-MT friends, getting along reasonably nicely). He had a bridge and this bridge was his only bridge (as the wise people of MT-Town kept repeating to the new residents, over and over again). All the roads into town had a ramp into and out of the this bridge. Sometimes the frames took the same ramp back out; some frames took a different ramp. (And, yes, there was one secrete way into the router that did not include the bridge, but that’s not important right now.)
The router has a bridge setting (one of 1,000,000,000 settings) called “vlan-filtering.”
When vlan-filtering is set to “no,” the bridge looks at every frame arriving at the bridge from all ramps (we can call them ethernet ports or physical interfaces) but does not make any changes to them.
When vlan-filters is set to “yes,” the bridge does such funny things! (And only the wise leaders of the town fully understood exactly what those funny things are.)
One thing the router (with vlan-filtering set to “yes” on the bridge) does is, when a frame arrives, it would remove (or strip) a special tiny piece of information that a frame might carry called the “VLAN tag.” This tag indicated the VLAN ID – could be any number (well, there are limits, and ranges, and traditions to what those numbers are). And then, depending on the value of that VLAN ID, it does something to the frames [ADD WHAT IT DOES HERE]
Another thing that router does (with vlan-filtering set to “yes” on the bridge was, was a frame arrives, it would add the “VLAN tag” and send that frame on it’s way [ADD ANY DETAILS OF WHERE IT GOES].
The router had rules that it follows for when to strip and when to add VLAN tags.
[INSERT EXPLANATION OF THESE RULES – ABOVE THE CURRENT AUTHOR’S PAY GRADE]
[INSERT SIMILARLY DUMBED-DOWN EXPLANATION OF “IP STACK,” “SWITCH-FACING” and “ROUTER-FACING” AND “PVID”]
All analogies suck. What if I go along the lines “a bridge is a system of roads where no pedestrians are allowed; the only way for a person can travel across the bridge is to board a car at an entry point and let the car bring it to the destination exit point. The cars are of different colors, and each entry/exit port only permits cars of a particular color to stop by and let passengers board or leave.” Does this explain VLANs and access ports better than just computer terms? To describe trunk ports, you need to introduce borders between countries you can still only pass while travelling by car, but only cars of multiple listed colors are permitted to pass each border.
And then we get to hybrid ports (both pedestrians and car passengers allowed) and we’re doomed again.
The problem is that everyone comes here with a different initial knowledge and previous experience, so even if you eventually find this car analogy useful, someone else may not.
I have read very many of yours (and others) posts on the topics and concepts of bridges and vlans, and one thing I’ve surely learned is that it is enormously complex.
I have no doubt you are right that all analogies suck – that is, all attempts at explaining these concepts in more familiar terms and frameworks will fail.
I’m just still trying to understand…
So what about the colored cars - are they helpful or not? Instead of cars, you can be given a flower at an entry, you can only carry a single flower at a time, etc., but it is still a matter of obtaining some attribute when entering the maze and being stripped of it as you exit, or keeping that attribute.
I do find that helpful – and others might. But, I personally don’t have a problem comprehending the adding or stripping of a tag to a frame, the presence or absense of which guides devices to make routing (or availability) decisions.
My understanding of VLANS fails after that.
I provided the solution of doing the config from an off bridge port… I mean the complaint was no sleep right 
But VLANs are nothing more than that… Each VLAN is a collection of bridge ports. Whether a port belongs to a particular VLAN depends on whether frames with that VLAN ID are allowed to pass through that port. While passing, they may retain the tag (trunk mode) lose it on egress and obtain it on ingress (access mode). Full stop.
I am making a tremendous effort with this. And perhaps my mind is simply working against me.
I understand (I think) what you write: Any specific VLAN (1, 10, 20, 100, etc.) is a collection of physical ports (eth1, eth3, etc.). If a port is a member of the VLAN, then frames will pass; if the port is not a member of the VLAN, frames will not pass.
This is where I lose you – no idea what this means: “While passing, they may retain the tag (trunk mode) lose it on egress and obtain it on ingress (access mode)”
What does that mean?
Just want to say, you all are awesome, thank you.
I am going back to the start, again again. I have to read the docs several times to even get a tingle of what they are telling me.
I have learned to start with the default config, adding my ntp client and changing the user and the services, and then saving this as my default config so I can save myself these steps when I inevitably break things.
I think I understand what Sindy described. At least the barest surface level.
I would like to know, for my clarity, if multiple PVIDs can be placed on a single frame? I have seen videos where the untagging is not selected and I am hoping to understand that better once I work my way back up to it. I have to face the fact that I have jumped in way out of my depth here in regards to what I hope to achieve.
My goal today is to get a better config I can show here for critique, I believe scrapping the one I have shown already and restarting once I get through more docs and videos will be best.
A PVID is not a property of a frame. It is a property of a bridge port that says “if a frame without any VLAN tag arrives through the cable, attach a tag with this VID (Virtual LAN IDentifier) to it while letting it in” and, except very specific cases, “if you are about to let a frame out to a cable, and it is tagged with this VID, remove the tag before sending the frame out to the cable”.
Not to hide anything from you, in general multiple VLAN tags can be stacked on a frame, but a normal bridge only cares about the first one and ignores the rest as thoroughly as any other part of the frame contents.
Sorry, the bold words went missing as I was editing the sentence multiple times to make it clearer 
A single port may be a member of multiple VLANs simultaneously. The purpose of retaining the tag is to be able to interconnect such ports of two bridges using a single cable and preserve the information about the VLAN the frame belongs to while it passes through the cable.
Egress is the direction from inside the bridge to the cable; ingress is the direction from the cable into the bridge.
Missed this post until just now.
Thank you for the clarification. I do understand that a single port can pass multiple VLAN’s traffic (e.g., 10, 20, 100, but not 200, 300, 99).
I get stuck on the wording. What is the correct way to describe a port that passes 10, 20, 100 but not 200, 300, 99? Something like ‘Ether1 is a member of 10, 20, 100’? Somehow the word ‘tagged’ should be used?
On a side (but I think important note), I have been for years now puzzled by the use of bolded and colored words in posts. I have found it a distraction at best, but more often simply confusing.
That is, I don’t think bold or larger size or different color helps with clarity.
I think the fuller, clearer sentences, with proper grammer and punctuation, is the key to effective communication.
That said, I understand that many people here are not native English speakers, and I am in total awe of those people who can post here, in English, on complex topics. That is, it would be a dream come true if I could communicate in a language other than English half as well as those non-native-English speakers communicate here.
I’m only saying as a point of reference that the colorization, enbolding, and typeface size changes are not a good solution to the inherent challenges of communicating about our topics.
Concerning terminology, my simplified view (and the experts will surely comment):
Untagged = access port - used for connecting devices all belonging to the same VLAN but they will not know about it. No VLAN info passed across the network segment connecting to this port.
Tagged (1 or multiple) = trunk port - dedicated VLAN tags on frames passing such a port. Devices connecting here should be VLAN aware themselves.
Both tagged and untagged = hybrid port. Mix of both previous situations.
That VLAN bible which gets referenced around here so often, really explains it quite well with color coding the various situations (except for hybrid).
Personally I really find such presentations extremely useful. It provides tons of info just with 1 picture.
But it seems that info is lost on you given your last statement ?
In what other way are you able to digest complex info like this if not only textual ?
I’m slowly getting it. Untagged (aka access) port essentially assigns the vlan number identified in the PVID, right?
Textual is the best way I have found.
I have been refraining from implementing a VLAN for years, and I’m concerned that my aversion is leaving my networks vulnerable to attack.
I am stuck on conceptualizing or identifying my needs.
I have multiple sites connected via wireguard and each site has wifi-connected users as well as iOt devices, cameras, etc. I can envision a VLAN where the iOT devices are on VLAN 100, the cameras on 200, the wifi users coming in on SSID guestwifi on 300, and none of those having access to the the infrastructure (router/AP) except for essential services (DNS, DHCP, etc.).
But then it gets complicated (for me): I will need to be able to connect via wifi and have full access (I know, different wifi that puts me on the management VLAN), and, those devices on 100 and 200 need access to the various servers at different locations (video server, Home Assistant Server, possibly others).
So I’ve been unable to even identify how it should work – which means I am no where near ready to deal with the config to make this happen.
Your problem stems from using NY state maple syrup on your pancakes. Use that Canadian syrup and it will all become clear.
Make it fast though, prices will go up.