MikroTik VLAN Configuration: A Step-by-Step Guide to Bridge VLAN Filtering
MikroTik VLAN Configuration: A Step-by-Step Guide to Bridge VLAN Filtering
Configure access ports, a tagged trunk, and a dedicated management VLAN in RouterOS.
A dependable network starts with clear boundaries. Office devices, guest equipment, and infrastructure management should have deliberate paths through your switching environment.
This guide builds an example configuration for a MikroTik device running RouterOS v7. An upstream router provides gateways and DHCP services; the MikroTik switches client traffic and uses a separate address for management.
At Link Technologies, Inc., configuration planning begins with the intended topology. Use the example below as a reference for your own port assignments, addressing, and operational requirements.
Understand the VLAN Configuration
VLANs separate Layer 2 broadcast domains. An access port connects an untagged endpoint to one VLAN; a trunk carries tagged traffic for multiple VLANs.
Bridge VLAN filtering uses port settings and VLAN membership together. The PVID assigns incoming untagged traffic to a VLAN. The bridge VLAN table controls which ports participate and whether traffic leaves tagged or untagged.
Reserve 192.168.99.2/24 for switch management. The example upstream gateway is 192.168.99.1.
Deployment scope: These commands create a new bridge and assume ether1, ether2, and ether3 are available. Inspect an existing configuration before adapting them. The example does not create upstream DHCP, routing, or firewall policies.
Step 2: Prepare Management Access and Recovery
Export the existing configuration, identify occupied bridge ports, and arrange console or independent management access. Use RouterOS Safe Mode during the change.
Prepare tagged VLANs 10, 20, and 99 on the upstream connection. Ensure its management network and the MikroTik input firewall permit the intended administrator access before enabling filtering.
Step 3: Create the Bridge and Add Ports
Leave VLAN filtering disabled while constructing the configuration.
Frame admission restricts the trunk to tagged traffic and the access ports to untagged or priority-tagged frames. Ingress filtering checks incoming VLAN membership.
Staging consideration: VLAN enforcement is inactive until filtering is enabled. Keep this preparation isolated from production client traffic.
Each access VLAN has its own row. VLAN 99 includes the bridge interface so management traffic can reach the switch CPU.
Newer RouterOS releases can create CPU membership dynamically when a VLAN interface is added to a filtering bridge. This example specifies management membership explicitly for clarity.
A VLAN interface provides IP participation on that VLAN. Client VLANs only being switched do not need local VLAN interfaces.
If administrators connect from other subnets, configure an appropriate return route. For an isolated switch without an existing default route, the example is:
Adapt existing firewall rules and interface lists to allow approved management access. Review MAC WinBox, MAC server, and neighbor discovery settings separately.
Step 6: Enable Filtering and Verify
With the upstream trunk and management path prepared, enable filtering:
/interface bridge
set [find name=bridge-vlan] vlan-filtering=yes
Test office and guest endpoints through their intended upstream gateways. Confirm management access from an approved administrator and verify that upstream policy blocks prohibited communication.
Hardware offloading depends on the device, switch chip, and configuration. Check the H flag on eligible bridge ports and validate performance under representative load. Consult MikroTik’s model-specific switching guide, especially for older CRS1xx and CRS2xx devices.
Troubleshooting the Deployment
Follow the traffic path from the endpoint through the assigned access port, trunk, and upstream service. Compare the actual configuration with the port plan.
Wrong client network: Compare the access-port PVID with its intended VLAN.
Missing DHCP response: Inspect trunk membership and upstream DHCP service configuration.
Unexpected communication: Examine the upstream gateway’s routing and firewall policy.
Reduced performance: Investigate hardware offloading, CPU utilization, link negotiation, and the device’s supported switching method.
Record what succeeds and where the path fails before making changes. Keep a working recovery connection until verification is complete.
Frequently Asked Questions
Does VLAN filtering configure DHCP?
No. Provide DHCP separately on the gateway or another server reachable within each client VLAN.
Can office and guest devices communicate?
Communication between VLANs requires routing. Configure gateway firewall policy to permit only the traffic your network needs.
Should every VLAN include the bridge as a tagged member?
Include CPU participation where the MikroTik needs an IP service, such as management or routing. Purely switched client VLANs do not require it.
Can this guide be used on SwOS?
These commands apply to RouterOS. A device running SwOS requires configuration through its own management interface.
Plan Your MikroTik VLAN Deployment
Link Technologies, Inc. can help review your switching design, select MikroTik equipment, and plan configuration and deployment. Bring your topology, port requirements, and current configuration to start the conversation.
About the Author:Dennis Burgess, Chief Technical Officer of Link Technologies, Inc., MikroTik Certified Trainer, and author of Learn RouterOS – Second Edition.
Leave your comment