VLAN Configuration in MikroTik: Trunk and Access Ports

VLANs on MikroTik: Trunk and Access Ports

VLANs (Virtual Local Area Networks) let you segment a single physical network into multiple isolated logical networks. This is essential for separating office departments, guest networks, IoT devices, and management traffic.

VLAN Basics

• VLAN ID (VID) — a number (1–4094) that tags traffic as belonging to a specific VLAN
• Tagged port (trunk) — carries traffic for multiple VLANs, each packet has a VLAN tag
• Untagged port (access) — connects to end devices (PCs, printers), traffic for one VLAN only, no tag added
• Trunk link — a connection between switches (or switch and router) carrying multiple VLANs

VLAN Implementation on MikroTik (Bridge Method)

Modern MikroTik devices (RouterOS v7) use the bridge VLAN filtering method, which is the recommended approach.

Topology Example

Internet
   |
[MikroTik Router]
   |
 ether1 (WAN)
 ether2 (trunk to switch/other devices)
 ether3 (access port — VLAN 10, Office)
 ether4 (access port — VLAN 20, Guest)

We will set up:

• VLAN 10: Office network (192.168.10.0/24)
• VLAN 20: Guest network (192.168.20.0/24)

Step 1: Create a Bridge

/interface bridge add name=br-main vlan-filtering=no

We start with vlan-filtering=no — enable it at the end to avoid locking yourself out.

Step 2: Add Ports to the Bridge

/interface bridge port add bridge=br-main interface=ether2
/interface bridge port add bridge=br-main interface=ether3
/interface bridge port add bridge=br-main interface=ether4

Step 3: Configure VLAN Membership

Set ether2 as a trunk (tagged for VLANs 10 and 20):

/interface bridge vlan add bridge=br-main vlan-ids=10 tagged=ether2
/interface bridge vlan add bridge=br-main vlan-ids=20 tagged=ether2

Set ether3 as access for VLAN 10 (untagged):

/interface bridge vlan set [find vlan-ids=10] untagged=ether3

Set ether4 as access for VLAN 20 (untagged):

/interface bridge vlan set [find vlan-ids=20] untagged=ether4

Step 4: Set PVID on Access Ports

PVID is the default VLAN assigned to untagged incoming traffic on a port:

/interface bridge port set [find interface=ether3] pvid=10
/interface bridge port set [find interface=ether4] pvid=20

Step 5: Create VLAN Interfaces on the Bridge

These are used for routing between VLANs and assigning IP addresses:

/interface vlan add name=vlan10 vlan-id=10 interface=br-main
/interface vlan add name=vlan20 vlan-id=20 interface=br-main

Step 6: Assign IP Addresses

/ip address add address=192.168.10.1/24 interface=vlan10
/ip address add address=192.168.20.1/24 interface=vlan20

Step 7: Set Up DHCP for Each VLAN

/ip pool add name=pool10 ranges=192.168.10.10-192.168.10.254
/ip pool add name=pool20 ranges=192.168.20.10-192.168.20.254

/ip dhcp-server add name=dhcp10 interface=vlan10 address-pool=pool10
/ip dhcp-server add name=dhcp20 interface=vlan20 address-pool=pool20

/ip dhcp-server network add address=192.168.10.0/24 gateway=192.168.10.1 dns-server=8.8.8.8
/ip dhcp-server network add address=192.168.20.0/24 gateway=192.168.20.1 dns-server=8.8.8.8

Step 8: Enable VLAN Filtering on the Bridge

/interface bridge set br-main vlan-filtering=yes

This activates VLAN enforcement. Do this last — after all VLAN settings are in place — to avoid losing access to the router.

Firewall Rules Between VLANs

By default, traffic can route between VLANs through the router. To isolate the guest network:

/ip firewall filter add chain=forward in-interface=vlan20 out-interface=vlan10 action=drop comment="Block Guest to Office"
/ip firewall filter add chain=forward in-interface=vlan20 out-interface=vlan20 action=accept
/ip firewall filter add chain=forward in-interface=vlan20 action=accept out-interface=!vlan10

Or simpler — block guest to all internal:

/ip firewall filter add chain=forward in-interface=vlan20 dst-address=192.168.10.0/24 action=drop

Verifying VLAN Configuration

/interface bridge vlan print

Output:

# BRIDGE   VLAN-IDS  CURRENT-TAGGED  CURRENT-UNTAGGED
0 br-main  10        ether2          ether3
1 br-main  20        ether2          ether4

Classic VLAN Interface Method (Alternative)

On older setups or for simpler use cases, you can create VLAN interfaces directly on physical interfaces:

/interface vlan add name=vlan10-on-ether2 vlan-id=10 interface=ether2
/ip address add address=192.168.10.1/24 interface=vlan10-on-ether2

This works but the bridge method is preferred for modern deployments.

Summary

• VLANs segment your network into isolated logical groups
• Use bridge VLAN filtering in RouterOS v7 for proper VLAN support
• Tagged ports (trunks) carry multiple VLANs; untagged ports (access) carry one
• Create VLAN interfaces on the bridge for routing and DHCP
• Always enable vlan-filtering=yes last to avoid losing router access
• Use firewall rules to control inter-VLAN traffic