na1m, Thanks it always helps us when we get the why behind the experiment.
Let's talk about VLANs from a RouterBoard perspective. We specify the VLAN ID when we use the VLAN interface command and only then. We also leverage bridges to perform loop prevention with technologies like RSTP and to be able to combine multiple ports. That said let's focus on the bridges as the foundation of your VLANs even though we don't put the VLAN ID there.
/interface bridge add name=br1
/interface bridge add name=br8
/interface bridge add name=br10
/interface bridge add name=br100
Great, we have 4 bridges. These represent the separate broadcast domains I desire br1 for VLAN1, br8 for VLAN8, br10 for VLAN10 and br100 for VLAN100. Now how do we make these stinkers work? Bridge ports. We'll want to add ports to our bridges. What ports say you? We can add physical interfaces like Ethernet interfaces for untagged (native VLAN) traffic. We can add VLAN interfaces for tagged traffic.
So, my router has 4 Ethernet interfaces. I've named them eth1, eth2, eth3 and eth4.
eth1, is plugged into a computer that needs to be untagged for VLAN1
eth2, is plugged into a UniFi AP that needs untagged VLAN1, tagged VLAN8 and tagged VLAN100
How do we make it so? Tagged ports need to VLAN interfaces, those VLAN interfaces need to be added to the respective bridge and the Ethernet interfaces where we want untagged traffic to go has to be on the Ethernet interface directly.
/interface bridge port add bridge=br1 interface=eth1
/interface vlan add name=eth2-vlan8 vlan-id=8 interface=eth2
/interface vlan add name=eth2-vlan100 vlan-id=100 interface=eth2
/interface bridge port add bridge=br1 interface=eth2
/interface bridge port add bridge=br8 interface=eth2-vlan8
/interface bridge port add bridge=br100 interface=eth2-vlan100
I've got a series of Ubiquiti UniFi AP. These AP use a dedicated management network (vlan 8 ) and cast two SSID: one for hotspot users (traffic on vlan 100) and one for private network.
The private network is on the default vlan (vlan 1).
I need to bridge the collision domain from the private SSID to the private network, and I need a vlan (in my case vlan10) to transport to the routerboard. Otherwise the wireless client will be connected to the AP management network and not the private.
^^ You're confusing me here but after you've read the above post if you have questions still we can sort it out. What's confusing is what purpose does VLAN10 serve?
