What can one expect by using bridge vlan filtering with all ports used for switching purposes only.
No routing, no fw rules, no queues, no mangle etc…
(same or better than a consumer managed switch for example)
It can’t handle vlan’s in hardware at all.
So the answer is worse than any other decent managed switch.
Search for official test results and look at bridging. I guess the row for “none” configuration applies to HW-offloaded case and the row for “25 bridge filtering rules” somehow corelates to non-offloaded case. I expect that “simple” task of tagging/untagging wouldn’t drop the speed into abyss, but on hEX it could peak somewhere just north of 1Gbps … hAP ac2 could do bridge vlan-filtered 1Gbps port-to-port at around 50% CPU utilization.
Isn’t it supposed to do it wirespeed without hitting CPU at all?
Or these figures represent routing between two vlans?
Upd: nevermind, I forgot that hAP ac2 also can’t hw-offload bridge vlan filtering 
The difference is on hAP ac2 you can configure vlans in switch menu, and make it work as a normal managed switch, on hEX you can’t.
Okay, so basically I would be better off putting in the Netgear GSS108e, then. Its the most minimalistic managed switch I have dealt with, doesnt even have an https login method LOL
Basically, yes
Just don’t use the password anywhere else - Netgear use ‘XOR password with a fixed string’ for security obsfucation.
The original hEX (750Gr2) is much better than the current hEX (750Gr3) as you can use the switch chip to handle VLANs.