Let's get this staight ... for @Gombeen666
When devices treat VLAN tags correctly (read: configuration is correct), then on layer2 (ethernet switches) VLANs are properly separated and no frame carrying VLAN tag X should leave port which is not member of said VLAN. Likewise frames tagged with IDs different than port VLAN membership shall enter switch/router.
Bridges in RouterOS are separate L2 entities and don't interchange L2 frames between themselves. Interfaces of type vlan are selective and don't bleed frames with wrong VLAN ID to their untagged side.
Bridge with vlan-filtering=yes in RouterOS is proper VLAN-aware L2 switch and will treat VLAN-tagged frames properly. (On the other hand, bridge with vlan-filtering=no should be considered as dumb switch which doesn't honour VLAN tags).
So, down to here, we can conclude that VLANs are properly separated from each other on L2 within Routerboard device if configured correctly.
Now here comes L3 (IP) layer. RouterOS, being routing OS
, will happily forward IP packets between its IP interfaces
(this is important) according to route rules. IP interface
is any interface with IP address attached. If packet forwarding is not desired, it should be prohibited by firewall filters. If some interface doesn't have IP address, then such interface effectively doesn't exist for the routing personality
All those bridge filters and VRF and what not ... are advanced stuff to control frame forwarding
on L2 within same L2 subnet
... while L2 unlimited forwarding is usually desired (because we want to make whole L2 domain single network) it is sometimes good to limit some communication without segmentation of the network. But honestly I don't think this is the case of OP, he implied that ether1 is actually a trunk port, carrying different VLANs.
It is always important to build the network from lower layers upwards ... and always make sure lower layers are properly built/configured before moving to upper layers. Upper layers can not fix mistakes made in lower layers no matter how hard we try.