i have wireless bridge (setup by this manual http://wiki.mikrotik.com/wiki/Pseudobridge):

MyRouter -> AP1 (RB411) -> AP2 (rb433) -> clients
AP1: ether1 and wlan1 bridged to Bridge1
AP2: wlan1 and wlan2 bridged to Bridge1

i need pass 2 vlans from MyRouter to AP2.
i guess how to configure AP2. something like:

/interface vlan
add name=VLAN2 vlan-id=2 interface=Bridge1 disabled=no
add name=VLAN3 vlan-id=3 interface=Bridge1 disabled=no

it right?

but how should i set up AP1?
i need have remote access to AP1 from vlan2. how to set "managment vlan id"?
i think i need do this (on AP1):

/interface vlan add name=VLAN2 vlan-id=2 interface=Bridge1 disabled=no use-service-tag=yes

but i dont know will be vlan-id=2 passed on to AP2?

sorry for my bad english

it will be passed to AP2..
I think you do not need Use service tags..

Set IP address on VLan Interface which must be in different subnet as main Bridge (AP).
Then use IP / Firewall to filter Winbox access only to VLAN2

there is possible have one ip on bridge1 and vlan interface?