MikroTik VLAN Configuration: Segmentation with Bridge VLAN Filtering
Setting up VLANs with the RouterOS 7 bridge VLAN filtering method. 802.1Q, trunk/access ports, inter-VLAN routing and switch chip performance. Factory scenario: management, production, guest VLANs.
Setting up VLANs with the RouterOS 7 bridge VLAN filtering method. 802.1Q, trunk/access ports, inter-VLAN routing and switch chip performance. Factory scenario: management, production, guest VLANs.
İçindekiler▾
- What Is a VLAN, and Why Do You Need One?
- 802.1Q Trunk/Access Ports
- Scenario: Factory Network
- Bridge VLAN Filtering with RouterOS 7
- Step 1: Create the Bridge
- Step 2: Add Ports to the Bridge
- Step 3: Configure the VLAN Table
- Step 4: VLAN Interfaces and IP Addresses
- Step 5: DHCP Server (One per VLAN)
- Inter-VLAN Routing and Security
- CRS326 Switch Configuration
- Switch Chip vs. CPU Bridge
- Common Mistakes
- “The VLANs can’t see each other, but they should”
- “The device on an access port can’t get an IP”
- “The trunk port isn’t working”
- “Management access dropped after enabling VLAN filtering”
- Testing and Verification
VLAN segmentation contains the risks on a network. Guest WiFi and production systems should not share the same broadcast domain. A factory’s machine network and staff computers should be kept apart. This article shows how to segment correctly and with good performance using RouterOS 7’s bridge VLAN filtering method.
What Is a VLAN, and Why Do You Need One?
A VLAN (Virtual Local Area Network) divides a single physical network into multiple logical networks. Even when different ports or devices are connected to the same physical switch, devices on different VLANs are prevented from seeing each other.
Scenario without segmentation: In a factory, every device (PLCs, the ERP server, employee computers, guest WiFi) sits on the same network. Malware that lands on one employee’s computer can reach the production PLCs. A single breach affects the entire network.
With segmentation: Each group lives in its own VLAN, and traffic between them is inspected through the firewall.
802.1Q Trunk/Access Ports
| Concept | Description |
|---|---|
| Access port | Connected to a single VLAN. The device is unaware of VLANs (PC, printer). Traffic is forwarded with the tag removed. |
| Trunk port | Carries multiple VLANs. The tag is preserved. Used for switch-to-switch or switch-to-router links. |
| VLAN tag | The 802.1Q header: a 12-bit VLAN ID (1-4094). |
| Native VLAN | The VLAN that passes untagged on a trunk port. Usually kept separate for management traffic. |
Scenario: Factory Network
A small factory with 3 VLANs:
- VLAN 10 (Management): Network equipment, router access
- VLAN 20 (Production): PLCs, industrial devices (no internet access)
- VLAN 30 (Staff): Employee computers, printers
- VLAN 40 (Guest): Visitor WiFi (internet only, no LAN access)
Hardware: MikroTik RB4011 (router) + CRS326 (switch)
Bridge VLAN Filtering with RouterOS 7
Step 1: Create the Bridge
/interface bridge
add name=bridge-main vlan-filtering=yes comment="Main bridge, VLAN filtering active"Caution: Set
vlan-filtering=yesbefore adding ports to the bridge. Enabling it afterward can drop your connection (open safe mode first).
Step 2: Add Ports to the Bridge
/interface bridge port
# Trunk ports (switch link)
add bridge=bridge-main interface=ether2 comment="Trunk to CRS326"
# Access ports (for locally connected devices)
add bridge=bridge-main interface=ether3 pvid=10 comment="Access, VLAN 10 (Management PC)"
add bridge=bridge-main interface=ether4 pvid=20 comment="Access, VLAN 20 (Production)"
add bridge=bridge-main interface=ether5 pvid=30 comment="Access, VLAN 30 (Staff)"pvid = Port VLAN ID. Untagged traffic arriving on an access port is assigned to this VLAN.
Step 3: Configure the VLAN Table
/interface bridge vlan
# VLAN 10 (Management)
# Tagged: bridge (router) and trunk port
# Untagged: ether3 (access port)
add bridge=bridge-main vlan-ids=10 tagged=bridge-main,ether2 untagged=ether3
# VLAN 20 (Production)
add bridge=bridge-main vlan-ids=20 tagged=bridge-main,ether2 untagged=ether4
# VLAN 30 (Staff)
add bridge=bridge-main vlan-ids=30 tagged=bridge-main,ether2 untagged=ether5
# VLAN 40, Guest (arrives only from the WiFi AP)
add bridge=bridge-main vlan-ids=40 tagged=bridge-main,ether2Step 4: VLAN Interfaces and IP Addresses
/interface vlan
add name=vlan10-mgmt interface=bridge-main vlan-id=10
add name=vlan20-prod interface=bridge-main vlan-id=20
add name=vlan30-staff interface=bridge-main vlan-id=30
add name=vlan40-guest interface=bridge-main vlan-id=40
/ip address
add address=10.10.10.1/24 interface=vlan10-mgmt comment="Management GW"
add address=10.20.20.1/24 interface=vlan20-prod comment="Production GW"
add address=10.30.30.1/24 interface=vlan30-staff comment="Staff GW"
add address=10.40.40.1/24 interface=vlan40-guest comment="Guest GW"Step 5: DHCP Server (One per VLAN)
/ip pool
add name=pool-vlan10 ranges=10.10.10.10-10.10.10.50
add name=pool-vlan20 ranges=10.20.20.10-10.20.20.100
add name=pool-vlan30 ranges=10.30.30.10-10.30.30.200
add name=pool-vlan40 ranges=10.40.40.10-10.40.40.100
/ip dhcp-server
add name=dhcp-vlan10 interface=vlan10-mgmt address-pool=pool-vlan10 lease-time=8h
add name=dhcp-vlan20 interface=vlan20-prod address-pool=pool-vlan20 lease-time=12h
add name=dhcp-vlan30 interface=vlan30-staff address-pool=pool-vlan30 lease-time=8h
add name=dhcp-vlan40 interface=vlan40-guest address-pool=pool-vlan40 lease-time=1h
/ip dhcp-server network
add address=10.10.10.0/24 gateway=10.10.10.1 dns-server=1.1.1.1
add address=10.20.20.0/24 gateway=10.20.20.1 dns-server=10.20.20.1
add address=10.30.30.0/24 gateway=10.30.30.1 dns-server=1.1.1.1
add address=10.40.40.0/24 gateway=10.40.40.1 dns-server=1.1.1.1Inter-VLAN Routing and Security
The VLANs are created; now control the traffic between them with the firewall:
/ip firewall filter
# Isolate the guest VLAN completely
add chain=forward action=drop in-interface=vlan40-guest \
out-interface!=WAN comment="Guest: internet only, LAN denied"
# Isolate the production VLAN: no inbound access
add chain=forward action=drop out-interface=vlan20-prod \
in-interface!=vlan10-mgmt \
comment="Production: access only from the management VLAN"
# Deny staff to production access
add chain=forward action=drop in-interface=vlan30-staff \
out-interface=vlan20-prod \
comment="Staff to Production: denied"
# Management to all VLANs
add chain=forward action=accept in-interface=vlan10-mgmt \
comment="Management: access to all VLANs"
# Normal internet access
add chain=forward action=accept out-interface-list=WAN \
comment="Internet egress"CRS326 Switch Configuration
The trunk and access ports have to be configured on the switch side as well:
# On the CRS326 (SwOS or RouterOS)
/interface bridge port
# Uplink (trunk to the router)
add bridge=bridge interface=ether1 comment="Trunk to RB4011"
# Access ports
add bridge=bridge interface=ether2 pvid=10 comment="Management PC"
add bridge=bridge interface=ether3 pvid=20 comment="PLC 1"
add bridge=bridge interface=ether4 pvid=20 comment="PLC 2"
add bridge=bridge interface=ether5 pvid=30 comment="Staff 1"
# ... and so on
# WiFi AP (trunk, carrying the guest and staff VLANs)
add bridge=bridge interface=ether24 comment="Trunk to WiFi AP"
/interface bridge vlan
add bridge=bridge vlan-ids=10 tagged=ether1 untagged=ether2
add bridge=bridge vlan-ids=20 tagged=ether1 untagged=ether3,ether4
add bridge=bridge vlan-ids=30 tagged=ether1,ether24 untagged=ether5
add bridge=bridge vlan-ids=40 tagged=ether1,ether24Switch Chip vs. CPU Bridge
| Method | How It Works | Performance | Constraint |
|---|---|---|---|
| Bridge VLAN filtering (new) | Uses the switch chip | Line rate | Supported devices only |
| Separate VLAN interfaces (old) | Through the CPU | Limited (~100-200 Mbps) | Works on any device |
| SwOS (CRS switches) | Hardware switching | Line rate | L2 only, no routing |
To check for switch chip support:
/interface ethernet print
# If it shows "Switch: switch1", the switch chip is supportedThe RB4011, the CCR series and the vast majority of CRS switches include a switch chip.
Common Mistakes
“The VLANs can’t see each other, but they should”
For inter-VLAN routing, VLAN interfaces must exist on the bridge. The bridge itself must be in the tagged list:
/interface bridge vlan print
# Does bridge-main appear in the bridge column?
# Is bridge-main in the tagged list?“The device on an access port can’t get an IP”
The PVID setting and the untagged port in the VLAN table must be consistent:
/interface bridge port print
# Is it pvid=10?
/interface bridge vlan print
# Is this port untagged in VLAN 10?“The trunk port isn’t working”
A trunk port should have no PVID set (or it should be 1) in the bridge port list. Trunk ports belong in the tagged list:
/interface bridge port print where interface=ether2
# Should be pvid=1 (or unset)“Management access dropped after enabling VLAN filtering”
Once vlan-filtering=yes takes effect, the VLAN of the port you use to reach the management interface must also be defined. You may need the console port or physical access:
# Add the management VLAN first, then enable filtering
/interface bridge vlan add bridge=bridge-main vlan-ids=10 tagged=bridge-main,ether2 untagged=ether3
# Then:
/interface bridge set bridge-main vlan-filtering=yesTesting and Verification
# Check the VLAN table
/interface bridge vlan print
# See the MAC table: which MAC is on which VLAN
/interface bridge host print
# Connectivity test with ping (through the router)
/ping 10.30.30.5 interface=vlan30-staff
# Test VLAN isolation without bypassing the firewall
# From a staff PC (VLAN 30), ping a production IP -> should time out
# From a staff PC (VLAN 30), ping the internet -> should workPractical tip: As the VLAN configuration grows more complex, draw a diagram. Which port is on which VLAN, and with which tag it passes; once it’s clear on paper, start on the configuration. On complex networks, it’s hard to keep track without a visual.
Kaynaklar
- Bridge VLAN filtering uses the switch chip to process VLANs at line rate — MikroTik RouterOS Documentation: Bridge VLAN Table (2025)
- The 802.1Q VLAN standard: frame tagging and the trunk protocol — IEEE 802.1Q: Virtual Bridged Local Area Networks (2022)
- Network segmentation shrinks the attack surface and limits lateral movement — NIST SP 800-125B: Secure Virtual Network Configuration (2019)
Sıkça Sorulan Sorular
Why are there two different ways to set up VLANs on MikroTik?+
The old method: creating separate VLAN interfaces on the bridge. The new method (RouterOS 6.41+): bridge VLAN filtering. The new method uses the switch chip to deliver far higher performance and doesn't load the CPU.
What is the performance difference between bridge VLAN filtering and the old method?+
On switch-chip-capable devices, VLAN traffic is handled at the hardware level, so CPU load is minimal. In the old software-based method, VLAN traffic passes through the CPU and becomes a bottleneck at high bandwidth.
Why should VLAN ID 1 not be used?+
VLAN 1 is the default and management VLAN on most switches. Unconfigured ports usually stay in VLAN 1. From a security standpoint, keeping management traffic off VLAN 1 is good practice.
How do you make inter-VLAN routing secure?+
Deny traffic between VLANs by default and allow only the required services. Write rules in the firewall forward chain between VLAN interfaces. Isolate the guest VLAN completely from the other VLANs.
Profesyonel Destek mi Lazım?
Bu konuda yardıma ihtiyacın varsa yanındayız. Kurulum, konfigürasyon ve sorun giderme için ulaş.
