Relatively new to RouterOS but very familiar with (15c0. What I am wondering is my RB with Ros 6.42.3. I have a Hex AP. I notice that when I configure the 5 ports are all in the “Bridge” and likewise “in the switch.”
It seems to me that the packets could flow through the bridge/switch, and bypass the ip router/firewall.
Should there be “two bridges” or “two Vlans” or “two switches” defined seperated by the router? What keeps packets from flowing across the Wan to LAN switch?
If the bridge works the way it should, it does allow the packets to bypass IP firewall because to get from one subnet to another, the packets have to be routed. Normally, VLAN filtering is sufficient to separate the networks to prevent two devices connected to ports of the same bridge from bypassing routing and talking to each other directly. But yes, you can also define separate bridges rather than use VLANs on a single bridge.
The point is that the ports to which the two devices you want to prevent from talking to each other directly must be members of different VLANs or different bridges, so that even if one of the devices puts up the same IP subnet like the other one on its interface, there will be no L2 transparency.
The ability to create several independent bridges makes Mikrotik devices (and other Linux-based devices) more flexible than those manufactured by Cisco and other manufacturers, the question is what practical benefits this brings as compared to the traditional VLAN model.