My ISP provides data on VLAN 10 for data and VLAN 20 for voice.

The data VLAN is working fine.

I've added the voice vlan and a spare ethernet port 4 into its own bridge, do I need to do anything to untag on ethernet 4?

The phone gets an IP address but won't register

:)

/export hide-sensitive file=anynameyouwish

Sorry, yes i should have attached :)

It is the old-style method of bridging ports and VLANs which can result in layer 2 misconfiguration problems https://wiki.mikrotik.com/wiki/Manual:L ... _interface - a quick fix is to disable spanning tree on the bridge, using a single VLAN-aware bridge for everything would be preferable.

Another possibility, depending on the RouterOS version, is the various Mikrotik discovery transmissions interfering with some VoIP devices - the workaround is to exclude the interfaces from discovery.

I hope the device isn't directly exposed to the internet given the almost complete lack of firewall rules.

This is the ref for vlans
viewtopic.php?f=23&t=143620

this shows you the default firewall rules that are safe but may need to be modified for ones scenario.
viewtopic.php?f=13&t=175129&p=856824&hi ... st#p856824

this shows you the default firewall rules that are safe but may need to be modified for ones scenario.
viewtopic.php?f=13&t=175129&p=856824&hi ... st#p856824

(reformatted rules for better reading)