• as you say you have configured "another" bridge for the IPTV VLAN, it is likely that this particular bridge doesn't enjoy the "hardware support" which means that the frames between the two Ethernet ports have to pass through CPU instead of being switched by the switch chip, which theoretically means that if your CPU load is high, some frames may get seriously delayed or lost.
• prioritization consists in sorting packets into different queues on output, so that the more important ones could overtake the less important ones when choosing the next one to be sent out over a limited bandwidth link. But as you are sending the IPTV packets to your STB via a dedicated Ethernet port, the output bandwidth should not be an issue (because it is not shared with any other traffic). So either the CPU load is the reason, and in such case, using a common bridge for all VLANs (which would mean that the switch chip would take care of all L2 processing) should be enough, or there is something wrong with prioritization of the traffic already at your ISP, and in such case, your only possibility is to throttle the speed of the download by limiting the output bandwidth of the other-than-IPTV traffic to the value of your total downlink bandwidth minus the bandwidth required for the IPTV traffic.

Would probably be best to make Ether1 part of the switch group with all other ports (default the untagged internet to something like vlan 40 and make that your new WAN interface) and let the switch do the work of passing the multicast at wire speed.

Then the router just has to work on the routing for your internet and not the IPTV multicast.

I will show you my config I'm using but with this solution all the IPTV traffic goes through CPU instead of a switch, right?

When someone is downloading the TV image gets shuttered.

Are you sure this is caused by the router?

How is the VLAN50 to ISP connection? Is ether1 directly connected to the ISP? Is VLAN50 prioritized by the ISP?

What is the total datarate of the connection and the rate used by TV? Is the CPU load of the router at or near 100% when you download?

the new "vlan aware bridge" which does not support hardware-accel, no idea why.

I'll send you back a modified version.

1. backup the existing configuration in order to be able to restore it if something doesn't work as expected
2. check in the configuration of the upstream router that VLAN 40 is not permitted at the port to which your mikrotik's ether1 is connected; if it is, choose a VLAN ID not permitted at that port for use instead of the 40 for the steps below
3. add the following to the configuration:
   Code: Select all

   /interface vlan
   add interface=bridge name=vlan40 vlan-id=40
   

4. change the interface to which your static uplink IP address is attached from "ether1" to "vlan40", or move the dhcp client from "ether1" to "vlan40" if you don't use a static address
5. replace "ether1" by "vlan40" in "/interface list member" for list=WAN
6. check all your firewall rules (filter, NAT, mangle, raw) and if any of them checks for in-interface or out-interface "ether1", replace that respectively by in-interface-list or out-interface-list "WAN"
7. remove the following items from the configuration:
   Code: Select all

   /interface vlan
   add interface=ether1 name=eth1-vlan50 vlan-id=50
   /interface bridge port
   add bridge=bridge-vlan50 comment=defconf interface=ether4
   add bridge=bridge-vlan50 interface=eth1-vlan50
   

8. add the following items:
   Code: Select all

   /interface bridge port
   add bridge=bridge interface=ether1 pvid=40
   add bridge=bridge interface=ether4 pvid=50
   

9. inform us about the result (whether it works at all and whether it has removed the issue with the IPTV performance)

Once you enter VLANs into the new bridge the hardware-access is turned off except in CRS3xx switches.
See this: https://wiki.mikrotik.com/wiki/Manual:S ... Offloading

This is really a big pity, because before this new bridge was introduced the natural way was to configure
the VLANs in the switch config and it was hardware accelerated on almost all models.
(there are some problems with hybrid ports in that method)

And in fact I don't understand why the old situation of having a configured switch chip with a couple of VLANs and some tagged/untagged
ports plus VLAN interfaces on the master-port (cpu port) to attach them to the router, cannot be translated into the new VLAN-aware bridge configuration
with all VLANs in a single bridge and the same VLAN interfaces on the bridge instead of the master-port, without losing the hardware
accelleration between the ports.

Similarly, the need to explicitly indicate that the bridge is a tagged member of itself in the vlan-filtering rules under "/interface bridge vlan" if you want to open the path to CPU (and thus wlan and vlan interfaces) will I hope disappear later on.

sindy the internet part works - but when plugged to port 4 still getting internet not into vlan 50

Is this really the way to configure it (with dummy vlan40?)

1. internet uplink tagless together with IPTV tagged on the same physical interface (ether1)
2. tagless IPTV alone on another physical interface (ether4)
3. if required, tagless LAN on the remaining physical interfaces (ether2, ether3) still with "hardware acceleration" (forwarding by the switch chip) between these two interfaces.

• keep the currently existing bridge (referred to as "bridge-lan"), with member ports ether2 and ether3 and the current LAN IP configuration attached to it, except that you would change the "hw" setting to "no" in "/interface bridge port" settings. Detach ether4 from that bridge.
• create another bridge (named e.g. "bridge-wan" or just "bridge" if the final goal is to implement point 3 above as well), with "protocol=none"
• attach the WAN IP configuration (static, dhcp client, pppoe client - whatever) directly to "bridge-wan" itself, and make ether1 a member port of "bridge-wan" with "hw=yes"; if anything in your firewall refers to "ether1", make it refer to "bridge-wan".

/interface ethernet switch vlan
add switch=switch1 vlan-id=0  ports=switch1-cpu,ether1 
add switch=switch1 vlan-id=50 ports=ether1,ether4
add switch=switch1 vlan-id=33 ports=switch1-cpu,ether2,ether3

/interface ethernet switch port
set switch1-cpu default-vlan-id=0 vlan-mode=secure
set ether1 default-vlan-id=0 vlan-mode=secure
set ether4 default-vlan-id=50 vlan-mode=secure vlan-header=always-strip

• create a new "interface vlan" with "vlan-id=33" and "interface=bridge-wan" and e.g. "name=vlan33"
• attach to it a new IP subnet (a temporary one, so do not configure a DHCP server on it if you can set up the address of your PC manually)
• modify your firewall so that it handles packets to/from "vlan33" the same way like packets to/from "bridge-lan"
• depending on to which port out of (ether2, ether3) you are connected, change the other one's VLAN handling:
  Code: Select all

  /interface ethernet switch port set etherX default-vlan-id=33 vlan-mode=secure vlan-header=always-strip
  /interface bridge port set [find interface=etherX] bridge=bridge-wan hw=yes
  

• log out, reconnect your PC to etherX (and configure manually its IP settings if you haven't configured a DHCP server for VLAN 33), and log in again to Mikrotik's address in VLAN 33
• repeat the setting above for the other LAN port
• move the original LAN IP configuration from "bridge-lan" to "vlan33" in parallel to the temporary one. You can have several IP subnets on the same interface but you can only attach a single DHCP server to an interface, so if you had to configure a DHCP server on vlan33, you now have to remove it before you can attach the one serving the original LAN subnet to it.
• log out and either change your PC's IP configuration back to DHCP client or just disconnect and reconnect the cable if you haven't changed the IP configuration to static
• log back in with the original IP address of your LAN.
• remove references to bridge-lan and bridge-lan itself