a. All vlans are automatically considered as PVID on the radio they are on and ingress filtering applied (key is in wireless line to have vlan-mode=use-tag).
Can one conclude that vlan-mode=use-tag is equivalent on a router to:
- add bridge=Bridge1 interface=ether2 untagged=eth3 pvid=10 ingress filtering=yes?? OR just
- add bridge=Bridge1 interface=ether2 untagged=eth3 pvid=10??
(assuming a router ethport attached on eth3 to a computer that you want on vlan10).
While all of VLAN logics for ether ports is configured on bridge, it's not for all other ports. When other ports are made members of a bridge, bridge only performs ingress and egress filtering but not tagging or untagging, that's up to that port to do (if it can). So, for wifi devices (ports), using
vlan-mode=use-tags vlan-id=XY is same as setting pvid on ether port (ingress tagging) and making that port untagged member of vlan (egress untagging).
A side note: for ether ports, on ingress, first port tags untagged frames if it has pvid set. Only after that bridge performs ingress filtering if configured for it, and it sees only tagged frames when port has pvid set. On egress bridge performs filtering and untagging (if port is configured as untagged member of that VLAN). pvid setting doesn't matter here.
Syntactically one could configure ingress-filtering on interfaces that can only carry untagged frames and are configured to do tagging on ingress, but that wouldn't bring any additional security (but could break things if whole configuration wouldn't match). It does make sense to perform ingress filtering on interface/port that can act as trunk ... so that remote side can not inject frames with VLAN tags that are not supposed to ingress through that particular interface/port. wifi interface can carry VLAN-tagged frames, so it does make sense to enable ingress filtering on it.
If a device/port doesn't know anything about VLANs (e.g. PPPoE or VPN or ...) and should become member of a vlan group, one has to play with vlan interfaces. Example of having pppoe interface member of VLAN ID=42:
/interface bridge
add name=bridge comment="Common bridge, all VLANs tagged"
add name=bridge42 comment="VLAN42 untagged"
/interface vlan
add interface=bridge name=vlan42 vlan-id=42 comment="VLAN42 on bridge"
/interface bridge port
add bridge=bridge42 interface=vlan42
add bridge=bridge42 interface=pppoe1-out
In this case vlan interface does tagging/untagging when packet traverses this kind of interface.
.
b. The bridge on a mickrotik AP does not required to be tagged on /interface bridge vlan rules as it is assumed that it already is???
Thus add bridge bridge=bridge1 tagged=eth2,RADIO vlan-id=20 on an AP device is equivalent to
bridge=bridge1 tagged=bridge1, eth2, vlan-id=20 on a router device??
Note that bridge in ROS has twin personallity:
- bridge in a sense of ethernet switch, but unlike ethernet switch it's capable of grouping interfaces of different L1 technologies
- L2 interface that can act as any other L2 interface, just like e.g. ether port
So when you configure bridge ports, bridge vlan-filtering, etc. you're configuring first personnality ... except when it's mentioned on the right side of equal sign of
tagged= or
untagged=, in that case you're configuring the second personnality. You're also configuring the second personnality when you're configuring vlan interfaces on top of it (e.g. with
/interface vlan add interface=bridge name=vlanX vlan-id=X) or when you're configuring L3 stuff on it (including DHCP which is somewhere between L2 and L3).
)