PHThis guide covers the modern and recommended way to configure VLANs in MikroTik RouterOS using Bridge VLAN Filtering. This method takes advantage of the hardware switch chip on modern RouterBoards, providing line-rate performance, and is the standard for RouterOS v6.41 and v7+.
The Scenario
We will create a simple network with two VLANs to separate traffic:
Port Assignments:
Step 1: Create a Single Bridge
In the modern RouterOS approach, you only need one bridge. Do not create multiple bridges for different VLANs.
Step 2: Add Ports to the Bridge
Add your local interfaces to bridge1. For Access Ports (ether3 and ether4), you must specify the pvid (Port VLAN ID) so untagged traffic from standard PCs is assigned to the correct VLAN.
Step 3: Configure the Bridge VLAN Table
This table dictates which ports are allowed to carry tagged (Trunk) or untagged (Access) traffic for specific VLAN IDs.
Step 4: Create VLAN Interfaces for Routing
To give these VLANs internet access and their own DHCP servers, the router needs an IP address on each VLAN. We do this by creating virtual VLAN interfaces attached to bridge1.
Step 5: Assign IP Addresses
Assign the gateway IP addresses to the virtual VLAN interfaces you just created.
Step 6: Setup DHCP Servers
Set up a DHCP pool, network, and server for both VLANs so connected devices get IP addresses automatically. Run this setup command twice. Select VLAN10-Staff the first time, and VLAN20-Guest the second time.
Step 7: Enable Bridge VLAN Filtering
CRITICAL WARNING: Do not enable this until all previous steps are complete. If you apply this while connected via MAC address on a port that is about to become a tagged/VLAN-restricted port, you will be disconnected. It is highly recommended to configure this via Safe Mode.
Verifying Your Configuration
To ensure your VLANs are working correctly, you can check the active Bridge VLAN table. This will show you exactly how RouterOS is handling tagged and untagged traffic dynamically.
Plug a PC into ether3. It should receive a 192.168.10.x IP address. Plug it into ether4, and it should receive a 192.168.20.x IP address. Traffic on ether2 will require a VLAN-aware switch or access point to decipher the tagged frames.
Note: If you want to lab this out before trying it on physical hardware, MikroTik's CHR (Cloud Hosted Router) is completely free to run on hypervisors like Proxmox for testing!
The Scenario
We will create a simple network with two VLANs to separate traffic:
- VLAN 10 (Staff): 192.168.10.0/24
- VLAN 20 (Guest): 192.168.20.0/24
Port Assignments:
- ether1: WAN (Internet)
- ether2: Trunk Port (Passes both VLAN 10 & 20 tagged to a smart switch or AP)
- ether3: Access Port for VLAN 10 (Direct connection for a Staff PC)
- ether4: Access Port for VLAN 20 (Direct connection for a Guest PC)
Step 1: Create a Single Bridge
In the modern RouterOS approach, you only need one bridge. Do not create multiple bridges for different VLANs.
Code:
/interface bridge
add name=bridge1Step 2: Add Ports to the Bridge
Add your local interfaces to bridge1. For Access Ports (ether3 and ether4), you must specify the pvid (Port VLAN ID) so untagged traffic from standard PCs is assigned to the correct VLAN.
Code:
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3 pvid=10
add bridge=bridge1 interface=ether4 pvid=20Step 3: Configure the Bridge VLAN Table
This table dictates which ports are allowed to carry tagged (Trunk) or untagged (Access) traffic for specific VLAN IDs.
- bridge1 itself needs to be added as a tagged port if you plan to route traffic (assign IP addresses/DHCP) between the VLANs and the internet.
- ether2 is our Trunk port, so it carries tagged traffic.
- ether3 and ether4 are Access ports, so they are added automatically as untagged ports based on their pvid from Step 2. You do not need to manually list them here.
Code:
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether2 vlan-ids=10
add bridge=bridge1 tagged=bridge1,ether2 vlan-ids=20Step 4: Create VLAN Interfaces for Routing
To give these VLANs internet access and their own DHCP servers, the router needs an IP address on each VLAN. We do this by creating virtual VLAN interfaces attached to bridge1.
Code:
/interface vlan
add interface=bridge1 name=VLAN10-Staff vlan-id=10
add interface=bridge1 name=VLAN20-Guest vlan-id=20Step 5: Assign IP Addresses
Assign the gateway IP addresses to the virtual VLAN interfaces you just created.
Code:
/ip address
add address=192.168.10.1/24 interface=VLAN10-Staff
add address=192.168.20.1/24 interface=VLAN20-GuestStep 6: Setup DHCP Servers
Set up a DHCP pool, network, and server for both VLANs so connected devices get IP addresses automatically. Run this setup command twice. Select VLAN10-Staff the first time, and VLAN20-Guest the second time.
Code:
/ip dhcp-server setupStep 7: Enable Bridge VLAN Filtering
CRITICAL WARNING: Do not enable this until all previous steps are complete. If you apply this while connected via MAC address on a port that is about to become a tagged/VLAN-restricted port, you will be disconnected. It is highly recommended to configure this via Safe Mode.
Code:
/interface bridge set bridge1 vlan-filtering=yesVerifying Your Configuration
To ensure your VLANs are working correctly, you can check the active Bridge VLAN table. This will show you exactly how RouterOS is handling tagged and untagged traffic dynamically.
Code:
/interface bridge vlan printPlug a PC into ether3. It should receive a 192.168.10.x IP address. Plug it into ether4, and it should receive a 192.168.20.x IP address. Traffic on ether2 will require a VLAN-aware switch or access point to decipher the tagged frames.
Note: If you want to lab this out before trying it on physical hardware, MikroTik's CHR (Cloud Hosted Router) is completely free to run on hypervisors like Proxmox for testing!