How to pass public IP downstream over VLAN?

Hi,
I have an ISP router with several ETH ports.

One of this ports is connected to Mikrotik CCR1036 eth1 port.
I’ve added the standard bridge interface named br_pfSense to CCR.
Also i added

  • eth1 as part of the br_pfSense bridge
  • vlan201 interface with VID=201 as part of the br_pfSense bridge. leave ARP: enabled, STP as none. VLAN filtering disabled.

I would like to assigned the public IP address to the VM attached to VLAN101.

Just for test: If i run the the DHCP server on br_pfSense bridge the my pfSense VM gets the IP (some foo network 192.168.91.0/24 just to verify that vlan and trunking works ok). The VM gets the Ip from DHCP server just fine. So it seams that everything is correctly configured.
Then i do another test: Add public IP address to br_pfSense bridge - i can access the mikrotik web gui over the public IP (over the internet)

But if i assign public IP to my pfSense VM - it does not work. No traffic. Any ideas why?
How do i “bridge” the eth1 interface and pass the traffic to VM over VLAN101?
In general i need to pass the public IP to the pfSense VM. As this is a VM - no physical interface - only vlan-s.

Just tag ether ports with this interface vlan and add these two vlan interfaces in a bridge. That’s all.

Logic here:

https://wiki.mikrotik.com/wiki/Manual%3AInterface/VLAN#Port_based_VLAN_tagging_.232_.28Trunk_and_Hybrid_ports.29

See how tagged traffic flows from one port to another.