Packet flow when VLAN interface is over bridge

RouterOS General
1

I have a couple of questions related to this that I could not figure out from the docs.

This diagram describes packet flow when VLAN interfaces are created over physical interfaces and then those VLAN interfaces are put in a bridge.
https://wiki.mikrotik.com/wiki/Manual:Packet_Flow#Vlan_Untagging.2FTagging_in_the_bridge_interface

  1. Does the packet flow differ, and how, when a VLAN interface is created over a bridge, and the members of the bridge are physical interfaces?
  2. Configuraton-wise, it is possible to create a VLAN interface on a bridge and at the same time put that VLAN interface in the same bridge. What purpose would that serve, if any?

thanks

2

On which version are you?
If 6.x then look here https://wiki.mikrotik.com/wiki/Manual:Packet_Flow_v6

When vlan is in play, packets are processed a “second” time.

3
  1. when a VLAN interface is created on the bridge, then untagging of ingress packets only happens if packets are “consumed” by router itself. Likewise tagging is only performed for packets “produced” by router itself.
    Example: similar to the packet flow example, but both physical ports carrying same VLAN. When VLANs are created over physical interfaces, tagged frames get untagged on ingress, then are forwarded by respective bridge (spanning VLAN interfaces), and on egress tagged again (possibly with another VID). If VLAN interfaces are created over bridge, then frames pass from physical ports to bridge on ingress unaltered, then are forwarded tagged over bridge and transmitted through egress physical port unaltered again.
    Hence only single bridge is needed in most cases.
  2. It is possible but doesn’t make any sense whatsoever. VLAN interfaces are kind of bi-directional tunnels with tagged and untagged side. Their lone task is to strip VLAN tag (when frame travelling from tagged side towards untagged side) or to add VLAN tag (when travelling from untagged towards tagged side). When creating a VLAN interface, one “anchors” the tagged side. When such interface is added to the bridge, the untagged side gets “tied”. If both sides are connected to the same bridge, then such interface would tag (or untag) frames and push them back to bridge.
    I can’t see any purpose of having such config.
4

Thank you both!

I’m on 6.43.11, the v6 diagram, at least related to VLAN tagging/untagging seems to be the same.

@mkx Thanks for the explanation. The “anchoring” concept helped visualize the different setups.
I’m changing my configuration on an RB951G-2HnD and got a bit lost in what happens where.