I'm trying to find some info about switch chip used in hEX S (in partucular its support for hardware VLANs) but from what I see it does not support VLANs on switch level at all right? So the only way to use VLANs on this thing is to use software VLANs and bridge?

hEX S has MT7621 switch chip onboard. And according to Mikrotik's wiki it does not support VLAN table in hardware. Check this page out.

hEX S has MT7621 switch chip onboard. And according to Mikrotik's wiki it does not support VLAN table in hardware. Check this page out.

Yeah I hoped there's more to that. It's quite miserable. I mean hES S is half that bad since only 5 ports. But RB4011? 10 ethernet ports without VLANs? What the hell are people gonna do with that without VLANs?...

Keep on living.

You are seeking hardware vlan and Mikrotik does support vlan in software.

So no need to jump of the cliff.

Keep on living.

You are seeking hardware vlan and Mikrotik does support vlan in software.

So no need to jump of the cliff.

I probably would complain less if I didn't find crapload of issues with NAT and connection tracking when using software VLANs and bridges when connection goes through router more than once. So it's not just about performance but about working or not.

Apparently NAT decisions are taken only the first time connection enters device so if you want to push traffic through inline L2 IDS/IPS after it enters router, it won't perform masquerade on egress properly. Because MikroTik takes decision when it notices connection for the first time - on bridge. Where out-interface is not actual uplink.