To use vlans, is dependent upon the use of your router ports more than anything, but since you want to use them please read this reference…
to understand the config!!
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
/interface ethernet
set [ find default-name=ether1 ] name=ether1-ISP
/interface vlan
add interface=bridge name=home_users10 vlan-id=10
add interface=bridge name=work_office20 vlan-id=20
/interface bridge
add name=bridge vlan-filtering=no {until config is complete and then enable}
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1-ISP name=pppoe1-home profile=\
MyhomePPPoE user=xxxxx@xxxxx.xxx
/interface pptp-client
add add-default-route=yes disabled=no interface=ether1-ISp name=pppoe2-work profile=\
MyworkPPPoE user=yyyyy@xxxxx.xxx
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=pool-home ranges=192.168.10.2-192.168.10.150
add name=pool-work ranges=192.168.20.2-192.168.20.150
/ip dhcp-server
add address-pool=pool-home disabled=no interface=home_users10
add address-pool=pool-work disabled=no interface=work_office20
/interface bridge port {settings depend upon the purpose of each port --> what devices traffic on port is going to}
add bridge=bridge comment=defconf interface=ether2 ingress-filtering=yes frame-type=only allow tagged frames {goes to a smart switch for both vlans}
add bridge=bridge comment=defconf interface=ether3 ingress-filtering=yes frame-type=only allow untagged and priority frames pvid=10 {goes to a home device}
add bridge=bridge comment=defconf interface=ether4 ingress-filtering=yes frame-type=only allow untagged and priority frames pvid=10
add bridge=bridge comment=defconf interface=ether5 ingress-filtering=yes frame-type=only allow untagged and priority frames pvid=20
/interface bridge vlan {depend on bridge port settings}
add bridge=bridge tagged=bridge,ether2 untagged=ether5 vlan-ids=20
add bridge=bridge tagged=bridge,ether2, untagged=ether3,ether4 vlan-ids=10
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=NONE
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf disabled=yes interface=ether1 list=WAN
add interface=pppoe1-home list=WAN
add interface=pppoe2-work list=WAN
/ip address
add address=192.168.10.1/24 interface=home_users10 network=192.168.10.0
add address=192.168.20.1/24 interface=work_office20 network=192.168.20.0
/ip dhcp-server network
add address=192.168.10.0/24 comment=defconf dns-server=192.168.10.1 gateway=192.168.10.1
add address=192.168.20.0/24 comment=defconf dns-server=192.168.20.1 gateway=192.168.20.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface=pppoe1-home
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface=pppoe2-work
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=LAN
You will note that there is one important piece missing in the config and that is ip routes and it should be discussed separately.
You need two routes, they will be created by the config pppoe client setup in the config.
Not sure of their view but will call them generically.
router created pppoe1-home route
router created pppoe2-work route
Next create two identical copies and
add a “Routing Mark” entry of home-network for the ppoe1-home copy
add a “Routing Mark” entry of work-network for the ppoe2-work copy
Then you will need two create two route rules.
In the first one make the selections:
“interface” = home-users10
“Table” = home-network
“Action” lookup
In the second one,
“interface” = work-office20
“Table” = work-network
“Action” lookup
What this should do is tell the router, to use the specified table based on which vlan is being utilized and thus routing.
If the table is unavailable, lets say you had a different ISP, then the router would divert the traffic to any other available route in the main table.
IN this case they are the same ISP so makes not difference.
The other option for 'Action" is Lookup ONLY in TABLE. My understanding here is that if you do that and the table you created is unavailable (the ISP is offline), the router will NOT route the traffic at all (it will not then look for the next available route in the main table.
So in this case there is no difference between LOOKUP and LOOKUP ONLY IN< because its the same ISP.
If you do find that LOOKUP does not work then use LOOKUP ONLY IN and this should only be the case where I have misunderstood how the router uses these special route rules.