1 - assign vlans for EVERY SUBNET
2 - make it clear which is your management subnet
a. where all smart devices will have their IP on, (typically set manually on both the smart device and the mT dhcp leases for that vlan).
b. where admin will normally access the router for config purposes, could be a normal trusted lan for example.
c. create an interface list item for MANAGE and assign the trusted vlan to this interface list as a member
d. ensure neighbours discovery and mac winbox setting use this interface list (MANAGE)
3. assign interface of each vlan upon creation to the single bridge.
4. each vlan gets 4 items, ip address, ip pool, dhcp server and dhcp server network
5. Create /interface bridge ports
6. Create /interface bridge vlans to match
7. Adjust firewall rules to ensure needed traffic is allowed.
8. Make Changes to LAN Interface List ( remove bridge and add all vlans typically)
9 . Enable vlan filtering on the bridge itself.
10. view /export to see if any errors crop up…
Help for firewall rules.
https://forum.mikrotik.com/viewtopic.php?t=180838
Suggest the easiest thing to do when configuring a bridge is to use one port on the router to do the configuration and to keep in your back pocket to access the router in an emerg where router bridge hickups…
https://forum.mikrotik.com/viewtopic.php?t=181718
Guidance on vlans using this method…
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1