You have mixed together two approaches and I have missed that in your original config export.
One approach: attach the tagged side of ****
/interface vlan
to
ether1
and make its tagless side one member of a bridge such as
bridge-vlan-100
, the second member of the same bridge would be
ether2
.
This way, you need one ****
/interface vlan
for each ethernet interface on which you want the VLAN to be accessible tagged. If you want an IP address of the router in that VLAN, the IP configuration should be attached to
bridge-vlan-100
. And when a packet is forwarded between two tagged interfaces of that VLAN, it comes in tagged via the first interface, gets untagged by the
/interface vlan
, bridged tagless to the other
/interface vlan
, and tagged by it before getting sent out via the other interface. All that is done in software. And you need one bridge per VLAN.
With this approach, ****
vlan-filtering
makes no sense because there is just a single vlan per bridge, i.e. you define the membership of an interface in a VLAN using
/interface vlan
attached to that interface.
Example for ****
ether1
and
ether3
as trunk ports for vlan IDs 100 and 200,
ether2
as access port for vlan ID 100 and local IP address in vlan ID 200:
/interface bridge
add name=b100
add name=b200
/interface vlan
add name=v100-e1 interface=ether1 vlan-id=100
add name=v200-e1 interface=ether1 vlan-id=200
add name=v100-e3 interface=ether3 vlan-id=100
add name=v200-e3 interface=ether3 vlan-id=200
/interface bridge port
add bridge=b100 interface=v100-e1
add bridge=b100 interface=v100-e3
add bridge=b100 interface=ether2
add bridge=b200 interface=v100-e1
add bridge=b200 interface=v100-e3
/ip address
add address=192.168.33.34/24 interface=b200
The other approach: you make a single common bridge for all VLANs. For each member Ethernet interface you define up to one VLAN ID (the
pvid
) for which it will act as access port (i.e. tagging packets on ingress with that VLAN ID and untagging packets with that VLAN id on egress). If you want to have an IP address of the router in that VLAN, you create a single
/interface vlan
, attach its tagged side to that single bridge, and attach the IP configuration to its tagless side.
In that case,
- tagged packet with any VLAN ID gets in tagged and is bridged to the egress interface still tagged;
- untagged packets from outside get tagged with the ****
pvid
of the ingress interface;
- tagged packets from inside get untagged if their VLAN ID matches the ****
pvid
of the egress interface.
If you plan to activate ****
vlan-filtering=yes
on the common bridge, you have to first specify member trunk ports for each vlan (or a list of vlans if all ports are in trunk mode) in
/interface bridge vlan
list; the
pvid
values from
/interface bridge port
configuration cause the corresponding ports to be placed to the list of access ports for the VLAN ID in this table automatically, but it only happens when you switch
vlan-filtering
to
yes
. What is totally confusing is that if you have created an
/interface vlan
for a VLAN ID because you want an IP address in that VLAN, it doesn’t get access to the VLAN on the bridge automatically and you must add the bridge itself to the list of trunk ports.
Example for ****
ether1
and
ether3
as trunk ports for vlan IDs 100 and 200,
ether2
as access port for vlan ID 100 and local IP address in vlan ID 200 (the same resulting functionality as the example above):
/interface bridge
add name=ball vlan-filtering=no
/interface vlan
add name=v200 interface=ball vlan-id=200
/interface bridge port
add bridge=ball interface=ether1
add bridge=ball interface=ether3
add bridge=ball interface=ether2 pvid=100
/ip address
add address=192.168.33.34/24 interface=v200
With ****
vlan-filtering=no
, packets tagged with any vlan ID will flow freely between
ether1
,
ether2
,
ether3
, only packets with VLAN-ID 100 will be untagged when egress via
ether2
. If you want to set ****
vlan-filtering
on bridge
ball
to
yes
to restrict which VLANs may be forwarded and which not and you are connected via one of the ports of the bridge, you first have to configure the membership of ports in VLANs, otherwise you lose access to the router.
/interface bridge vlan
add bridge=ball vlan-ids=100 tagged=ether1,ether3
add bridge=ball vlan-ids=200 tagged=ether1,ether3,ball
You can combine these two approaches together in some cases if you know well what you are doing, but you cannot simultaneously make the same interface a member of a bridge and a carrier interface for an ****
/interface vlan
; if you do that, weird things happen.
Yet another approach is to use vlan filtering at switch chip level, but that’s one more can of worms and it is too late down here. There are other topics on this forum explaining that approach. It gives you hardware switching but in more complex L2 networks it can cause trouble so you have to think twice before taking that way.