Enterprise MikroTik VLAN Architecture & RouterOS v7 Bridge Filtering
Designing a resilient local area network requires strict isolation between management devices, corporate workstations, guest WiFi clients, and server subnets. In this guide, we walk through configuring hardware-accelerated VLAN filtering on MikroTik Cloud Router Switches and CCR routers using RouterOS v7.
Network Architecture
Our target topology separates broadcast domains into four distinct VLANs:
- VLAN 10 (Management):
10.0.10.0/24— Switches, APs, and PDU interfaces. - VLAN 20 (Workstations):
10.0.20.0/24— Internal office staff devices. - VLAN 30 (Servers):
10.0.30.0/24— Bare-metal hypervisors and LXC nodes. - VLAN 40 (Guests):
10.0.40.0/24— Isolated internet-only wireless network.
Subnet Allocation
| VLAN ID | Subnet Name | IP Range | Gateway | Purpose |
|---|---|---|---|---|
| 10 | Management | 10.0.10.0/24 | 10.0.10.1 | Network infrastructure equipment |
| 20 | Workstations | 10.0.20.0/24 | 10.0.20.1 | Corporate workstations & laptops |
| 30 | Servers | 10.0.30.0/24 | 10.0.30.1 | Virtualization & database hosts |
| 40 | Guests | 10.0.40.0/24 | 10.0.40.1 | Guest WiFi internet access |
Implementation Steps
1. Create the Bridge Interface
First, create a single unified software bridge. Keep vlan-filtering=no until all access and trunk ports are mapped to avoid locked-out administrative access.
/interface bridge
add name=bridge1 vlan-filtering=no pvid=1
2. Configure Trunk and Access Switchports
Assign physical Ethernet ports to the bridge and define their tagged (trunk) or untagged (access) PVID settings:
# Access Ports for Workstations (VLAN 20)
/interface bridge port
add bridge=bridge1 interface=ether2 pvid=20
add bridge=bridge1 interface=ether3 pvid=20
# Access Ports for Servers (VLAN 30)
add bridge=bridge1 interface=ether4 pvid=30
# Trunk Port to Distribution Switch (VLAN 10,20,30,40)
add bridge=bridge1 interface=ether5
3. Assign VLAN IDs to Bridge VLAN Table
Define ingress/egress rules in the /interface bridge vlan section:
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether5 untagged=ether2,ether3 vlan-ids=20
add bridge=bridge1 tagged=bridge1,ether5 untagged=ether4 vlan-ids=30
add bridge=bridge1 tagged=bridge1,ether5 vlan-ids=10,40
4. Enable Bridge VLAN Filtering
Once verified, turn on hardware-offloaded bridge VLAN filtering:
/interface bridge set bridge1 vlan-filtering=yes
[!TIP] Always maintain a dedicated out-of-band console cable connection or Safe Mode enabled (
Ctrl+Xin RouterOS terminal) when enabling bridge VLAN filtering on remote routers.
Testing & Verification
Verify active VLAN entries using print detail command:
/interface bridge vlan print detail
Lessons Learned
Using bridge VLAN filtering on RouterOS v7 yields massive hardware offloading performance gains compared to legacy multi-bridge topologies. Switches process packet tagging directly inside switch ASIC hardware chips without consuming main CPU cycles.
