Need help with VLAN config

RouterOS Beginner Basics
1 
# oct/02/2023 17:04:37 by RouterOS 6.49.7
# software id =
# model = CCR1036-8G-2S+
# serial number =

/interface bridge
add name=bridge1

/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] disable-running-check=no
set [ find default-name=ether3 ] disable-running-check=no
set [ find default-name=ether4 ] disable-running-check=no
set [ find default-name=ether5 ] disable-running-check=no
set [ find default-name=ether6 ] disable-running-check=no
set [ find default-name=ether7 ] disable-running-check=no
set [ find default-name=ether8 ] disable-running-check=no
set [ find default-name=ether9 ] disable-running-check=no name=sfp1
set [ find default-name=ether10 ] disable-running-check=no name=sfp2

/interface bridge port
add bridge=bridge1 interface=sfp1
add bridge=bridge1 interface=ether5 pvid=100
add bridge=bridge1 interface=ether6 pvid=200

/interface bridge vlan
add bridge=bridge1 tagged=sfp1 untagged=ether5 vlan-ids=100
add bridge=bridge1 tagged=sfp1 untagged=ether6 vlan-ids=200

/ip address
add address=192.168.254.30/24 interface=ether1 network=192.168.254.0
add address=A.A.A.A/28 interface=ether5 network=A.A.A.0
add address=B.B.B.B/28 interface=ether6 network=B.B.B.0
add address=192.168.0.2/24 interface=sfp1 network=192.168.0.0
add address=10.0.0.1/24 interface=bridge1 network=10.0.0.0

Sorry I am new to this all. I’m trying to route from gateway (192.168.0.1) to vlans with public IPs on four seperate ports. So any packets coming in from SFP1 would be routed out through the correct ethernet port and tagged with the correct vlan. We are needing the 4 clients unable talk to each other or access the mikrotik configuration but still be addressable from the public internet.
router.PNG

2

And what exactly is your problem here ? Why are you not showing whole configuration ? If using VLANs you will block L2 communication between clients but for L3 you need to create firewall rules to do that.

3

My first thoughts are that this MT device is not acting as a router but merely a switch…
THus you have one bridge where all ports are associated with the bridge save the off bridge access for config/access.
Also assuming that the upstream device has already tagged the public stream of data with vlan tags, lets say for discussion, 101,102,103,104

Thus attach vlans 101,102,103,104 to the common bridge and one MORE, vlan 68 for the management network 192.168.0.0
Only the management vlan need be identified on the device.
The only IP address assigned on the MT is the IP address of the device on the upstream routers LAN, and this is assigned to the vlan68.

As you have done untag the public vlans to the appropriate ports.
Only vlanid requiring tagged also to the bridge (not just sffplus port) is the managment vlan,

I am not sure if the MT requires any firewall rules because its not involved in routing only switching and thus it would have no way to connect the different entities.
In other words, the concern of layer3 routing should be the concern of the upstream device…