RouterOS bridge mysteries discussed - incl. diagrams

[Buckeye]

@DocPneumo

/interface bridge set [ find bridge=BR1 ] vlan-filtering=yes

That is essentially converting the bridge from vlan-transparent (aka dumb switch) to a vlan-aware switch.

Because this is done last, if you are configuring from a device that is not vlan-aware, only ether2 can be used for configuration unless you still have an ip address configured on the base bridge device (which is the only thing that can send untagged frames).

There are ways to configure without pulling a port from the bridge for configuration. See for example these posts:

Once and for all COMPLETE Offbridge Port setup

Also my personal opinion, but with the current version von RouterOS 7, I don’t really see the appeal of moving a port out of the bridge for management anymore. It’s not more complicated or error prone to keep the management port in the bridge at all. Let’s look at the starting point of the defconf configuration where most the ports are in the default bridge bridge and some other port are WAN port. Instead of moving a port out of the bridge, my “guide” would be the following, based on your guide…

and Once and for all COMPLETE Offbridge Port setup - #31 by Amm0

The procedure outlined in those posts allow a user to start with the defconf, and immediately switch to vlan-aware mode. No need to move the cable, etc. If you want all the data on the trunk between the router and switch to uses tagged frames, you can delay that until you have other access ports configured on the switch.

Pulling a port out of the bridge will work, and may provide a more failsafe situation, i.e. you can even delete the bridge and still have access, but it isn't necessary, and most users just want to get vlans setup, and won't be messing with things once they get them working. If you have a spare port that can be dedicated just for "recovery", then thats fine.