This is the standard for setting up vlans
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
One bridge,
Define vlans and their interface is the bridge.
Each vlan gets an IP address, ip pool, dhcp server, dhcp server network./
Interface bridge ports.
- Where you assign ports to the bridge (typically 1 is WAN, eth2 in your case to the switch.
- Where you detail which ones are trunk, access or hybrid ports (trunk carry one or more vlans tagged, access untag packets to the dumb device and tag packets coming from the dumb device).
- each port should have ingress filtering assigned, trunk ports frames allowed - only tagged, access ports frames allowed - only priority and untagged.
- In addition the interface access ports also require pvid setting = vlan number.
Interface bridge vlans.
- where each line refers to a vlan-id(vlan).
- All trunk ports should be tagged for a vlan they are carrying
- Bridge should be tagged on every line
- All access ports are dynamically tagged by the router (if they have a pvid ID assigned on the bridge port) and do not require to show as being untagged **
- The exception is if the vlan has no tagged ports, the vlan-ids still requires a line with at least the bridge tagged.
****** I personally prefer to show all the untagged ports in the config (manually inserted) and that way I can more easily cross check my config.
- getting interface lists right is important
- getting firewall rules right is important.