What MikroTik device is this?
Is the intervlan routing happening on the OPNsense device?
And are devices connected to ether1 (vlan 10) getting a different dhcp address than for ether3 (vlan 20) or ether5 (vlan 30)?
The reason I ask is that once you add the vlans to the BR1 device, then you have connected the vlans to the MikroTik router.
If intervlan routing is occurring on the MikroTik, then yes, you need to add the vlans to BR1 (since that is the “connection” to the MicroTik router). And the excellent explanation by @sindy is well worth reading in any case.
I haven’t used a vlan-aware (vlan-filtering) bridge on a MikroTik device without a hardware switch ASIC built in (I only have a hEX S RB760iGS and a RB5009, which both have built in switch ASICs. But I would at least expect a non-hardward assisted bridge to “behave” the same when using the “new” method.
Here is something to test.
If you disconnect the trunk connection to ether7 of the MikroTik device, then connect PC’s to the MikroTik device’s ether1 and ether2, do they still get an ip address via dhcp (if they do, they aren’t getting them from the OPNsense device). But even without a trunk connection, they will probably get an APIPA (169.254.x.x) address.
and change
add bridge=BR1 tagged=ether7**,BR1** untagged=ether1,ether2 vlan-ids=10
to
add bridge=BR1 tagged=ether7 untagged=ether1,ether2 vlan-ids=10
i would expect that the two PCs connected to ether1 and ether2 would be able to communicate at layer 2. i.e. if a PC based firewall doesn’t prevent it, you should be able to ping the other PC (get the ip address with ipconfig from a cmd prompt).
If you go back to your original config where BR1 didn’t have a tagged connection to the vlans, then move one of the PC’s to ether3, you shouldn’t be able to have any communication between the PC’s on vlan 10 and vlan 20 because they are on different vlans, and there is no connection to the router in the MikroTik device. And even if you remove the tagged BR1 from all the vlans, as long as you still have ether7 as tagged, it should allow the tagged traffic to reach the trunk port on the OPNsense device (when the connection between ether7 and the OPNsense box is restored).
What are the symptoms you are seeing?