I need to setup inter-vlan routing with a CRS125, I'm following this guide : https://wiki.mikrotik.com/wiki/Manual:C ... AN_Routing

Well , eth1 and eth2 are VLAN100 and VLAN200 tagged (trunk) connecting to other switches
eth3 to eth4 are VLAN100 untagged (access) for PC use
I need interVLAN routing

What I have done :

/interface bridge port
add bridge=bridge1 interface=ether1 hw=yes
add bridge=bridge1 interface=ether2 hw=yes
add bridge=bridge1 interface=(ether3to24) hw=yes

/interface ethernet switch egress-vlan-tag
add tagged-ports=switch1-cpu,ether1,ether2 vlan-id=100
add tagged-ports=switch1-cpu,ether1,ether2 vlan-id=200

interface ethernet switch ingress-vlan-translation
add ports=(ether3to24) customer-vid=0 new-customer-vid=100 sa-learning=yes

/interface vlan
add name=vlan100 interface=bridge1 vlan-id=100
add name=vlan200 interface=bridge1 vlan-id=200

/ip address
add address=192.168.100.1/24 interface=vlan100 network=192.168.100.0
add address=192.168.200.1/24 interface=vlan200 network=192.168.200.0


All seems to work correctly , my doubts :

Is it right to assign bridge1 as interface when creating /interface vlan ?
When and why i must create VLANs also in /interface ethernet switch vlan ?? (what is the purpose of declare vlans into switch configuration ?

Thank you

It is required to create the VLAN interface on the bridge interface, you have done that correctly.

If you are intending to filter invalid VLANs on your switch (which you should), then you must specify which VLANs are allowed on each port, otherwise all VLANs will be dropped. Before you enable invalid VLAN filtering, make sure a management port is set up.
Also, make sure you add the switch1-cpu port in /interface ethernet switch vlan, otherwise interVLAN routing will not be possible (if invalid VLAN filtering is used).

Thank you for reply,

What could it happen if invalid VLAN filtering is not applied ?

You said " Before you enable invalid VLAN filtering, make sure a management port is set up."

I'm managing CRS from one of untagged ports (3-24) (pc is not aware of any tagging)
As I created switch vlans, I was locked out immediately

How should it be done ?

Thanks