In routerOS, creating a bridge interface is roughly analgous to
config t
vlan 10
name TestVLAN
int vlan 10
no ip address
no shut
end
The bridge interface is both the “vlan” entity itself AND the vif.
You connect ports to the bridge - it simply forwards the frames as a dumb switch would. If you connect ether1 and ether2 to bridge1, then bridge1 will forward untagged and tagged frames alike.
If you want ONLY tagged frames on the interfaces, what you do is create vlan interfaces (as they’re called in ROS).
Naming them properly helps, because in other parts of the system, when you pick an interface from a drop-down selector, having 12 interfaces called “vlan10” is not going to be helpful.
I name them E3.10 → Vlan10 subinterface on physical interface ether3.
E4.10 → ether4, vlan 10.
E4.20 → ether4, vlan 20.
Once you create all of these interfaces (cisco would call them subinterfaces) you add these to the appropriate bridges.
So for bridge10, add ports E3.10 and E4.10
This will give you exactly what you want. You can then make “vlan 10” appear untagged on ether5 by adding ether5 to bridge10 as well. Since you’re connecting the vlan subinterfaces, only the vlan traffic you want will go through. Other tags won’t go onto the wrong bridge.
If you want tagged AND untagged traffic on a trunk interface, then you’re going to have to connect the physical interfaces to the bridge, have no vlan subinterfaces, and then create filter rules in the “forward” chain of the bridge firewall configuration. (action=drop, vlan tag=10, out-interface = ether4 would take vlan 10 off of ether4, for instance)
In RouterOS, the way to add an IP interface to the vlan is easy - just go into IP > Addresses, and add a new IP address (using CIDR notation) and the interface should be the bridge, e.g. bridge10. This would be analogous to:
int vlan10
ip address x.x.x.x 255.255.255.0
no shut
end
The switch menu is how the hardware switching is configured. I’ve never personally used this - I tend not to make bridges out of Mikrotiks very often, and when I do, it’s usually over some form of encapsulated bridge anyway, so hardware switching doesn’t much come into play. If I just want a switch, I use Cisco, Adtran, or HP.