It isn't ether set pvid or untag the port. Both are required, although the second may be done automatically for you (creating dynamic entries in the vlan table). You must set the pvid (if you want it to be other than the default 1). With at least 7.15 forward the dynamic untagged entries were reworked to make it work better (I assume in cases where a single /interface/bridge/vlan line had multiple vlans in the vlan-ids list).
See release notes for 7.15 What’s new in 7.15 (2024-May-29 15:44) where you will see this:
*) bridge - reworked dynamic VLAN creation;
In 7.16 dynamic entries for the bridge as tagged are added when a vlan interface is created. See release notes for What’s new in 7.16 (2024-Sep-20 16:00): where you will see
*) bridge - added dynamic tagged entry when VLAN interface is created on vlan-filtering bridge;
*) bridge - added message about who created a dynamic VLAN entry;
There are three things that have to be configured when using vlans on the vlan-aware bridge (vlan-filtering=yes), and that does not include the firewall and address lists. vlan table, port configurations (two parts, ingress and egress), and vlan interfaces (for vlans that will be connected to the router engine/CPU)
Two of the three affect the "switch" part of the bridge.
- vlan table - defines the vlans, and what bridge-ports have access to the vlans. The vlan table is a property of the "virtual vlan-aware switch" part of the bridge, and it can either be dynamically created for you by ROS (by setting pvid or by creating a vlan interface) or explicitly created with a line in /interfaces/bridge/vlan that has the vlan-ids with one or more vlan number. I prefer to have a speparate line for each vlan instead of putting a list of vlan ids on one line, although it is not a requirement; however, there are cases where having more than one vlan id will cause problems (access ports). This can happen behind the scenes without explicit commands in recent versions of ROS 7.16+ will also configure the tagged connection to the bridge (interface) when a vlan interface is created. This also defines what what ports will transmit traffic for the vlan with or without a tag (egress traffic for the vlan from the bridge-port)
- port configuration - the egress part of this is done above. The ingress (to virtual switch) is done with the command /interface/bridge/port and it allows you to specify the pvid as well as what will be accepted by the bridge port. You can filter by frame type (tagged/untagged/all) as well as blocking invalid vlans at the door (ingress-filtering).
- If you want the router to have access to a vlan, you must create a vlan-interface; it is the "connection" from the the specified vlan on the virtual switch to an interface on the router.
You can view the vlan table with the cli command: /interface/bridge/vlan/print
More links in this post and those following it.