You are welcome.
The thing is, that the whole approach on vlan filtering on the bridge is quite recent, and not very much is written on the topic yet.
Even the info on official wiki is a little mixed.
There was a rather informative thread here on the forum, but it didn’t involve wireless and capsman, just the general concept:
http://forum.mikrotik.com/t/sofware-vlan-bridge-on-ruteros-explained/122534/1
You are right about tagging - it was done on the cap interface, so the traffic got to the bridge already tagged and the PVID setting in /interface bridge port for cap interface was ignored and as the filtering was disabled for that port the frames were just admitted as is. That is why the request got to DHCP server in the first place.
The reason why the answer didn’t get back is not tagging, but untagging.
The frames were untagged too early - when leaving the bridge and entering the cap interface.
But the cap interface was to admit only tagged frames, so the untagged frames were discarded.
As a matter of fact there is a big difference between ethernet port and wlan (or cap) interface in this aspect:
you can think of ethernet interface like a hole in the bridge - the frame leaves unchanged the same time it enters.
All modifications or filters are done before.
On contrary wlan interface have both in and out sides, and it can modify and filter what passes through it.
That is strange.
“client-to-client-forwarding” should affect only traffic between two clients connected to the same radio.
Even the traffic between two different radios on the same AP should not be affected.
Are you sure that the problem is still persistent after you’ve solved the problem with vlan tagging?