The only thing I would add is found below.......
...................
/interface vlan
add name=bridge1.10 interface=bridge1 vlan-id=10
add name=bridge1.20 interface=bridge1 vlan-id=20
/interface bridge vlan
add bridge=bridge1 vlan-ids=10 tagged=bridge1,ether2,ether3 untagged=ether4
add bridge=bridge1 vlan-ids=20 tagged=bridge1,ether2,ether3 untagged=ether5
/interface bridge port
add bridge=bridge1 interface=ether2 ingress-filtering=yes frame-types=admit-only-vlan-tagged
add bridge=bridge1 interface=ether3 ingress-filtering=yes frame-types=admit-only-vlan-tagged
add bridge=bridge1 interface=ether4 pvid=10 ingress-filtering=yes frame-types=admit-priority-and-untagged
add bridge=bridge1 interface=ether5 pvid=20 ingress-filtering=yes frame-types=admit-priority-and-untagged
/interface bridge set bridge1 vlan-filtering=yes
..................................
None of the changes are necessary but also do no harm.
In terms of the untagging on
/interface bridge vlans, it is unnecessary because the router will dynamically untag the port due to the pvid entry on the bridge port.
However, I like to put it there manually for two reasons.
a. if you print your config.export, the untagging will not show up as its only applied when in use.
b. I like to cross check my bridge ports and bridge vlan settings and thus I can be sure that my config or any config I am reading is clear.
Often, it is easier to see an error or a misunderstanding of the OPs config when there is a mismatch. When the info is 'missing' one can start to go down the assumption path vice the evidence based path. Not my cup of tea if I can avoid it.
Another common mistake seen when not putting in the untagging is that users forget to put in a line altogether for the vlan.
Lets say one has vlan15, its only used on port 2 and the bridge port is thus.
/interface bridge ports
add bridge=bridge1 interface=ether2 pvid=15
Often the user
will forget they need the following entry, even though the port will be untagged on the fly,
because there are no other ports requiring tagging for that vlan!!
In your config, both ports are tagged elsewhere (other ports) so its not obvious.
add bridge=bridge1 tagged=bridge 1 vlan-ids=15.
Much clearer at least for me when its done the manual way and one always ensures the entry is there written as:
add bridge=bridge1 tagged=bridge1 untagged=ether2 vlan-ids=15.