RouterOS Bridge VLAN Filtering: Keep the Management CPU Reachable

RouterOS VLAN-filtering bridge; behavior depends on RouterOS version and bridge topology.

Applies to: RouterOS VLAN-filtering bridge; behavior depends on RouterOS version and bridge topology.

Before enabling filtering

Write down the authorized management VLAN, tagged uplink, untagged access ports, PVIDs and the interface carrying management traffic. Preserve a tested local access path and enter Safe Mode. Do not paste an example bridge configuration over a working router.

Check the complete path

1. Confirm that each intended VLAN is present on its required tagged/untagged ports. The PVID handles untagged ingress; it is not a replacement for the VLAN membership table.
2. Where the router's CPU must terminate a management/routed VLAN, verify that the bridge/CPU path participates appropriately.
3. Inspect dynamic entries before adding duplicates: the manual documents automatic bridge entries when VLAN interfaces are added from RouterOS 7.16, and additional switch-CPU behavior from 7.20.
4. Enable filtering only after the management path is accounted for. Keep firewall and service access limited to authorized management clients.

Verify / undo

Test management from the intended VLAN and denial from an unauthorized segment. Confirm DHCP and internet routing separately. On failure, use the Safe Mode recovery or the known local path to restore the previous table. Do not solve a lockout by exposing management to the WAN.

Official evidence

• RouterOS bridge VLAN filtering and management access — rf2-mikrotik-bridge
• RouterOS configuration management and Safe Mode — rf2-mikrotik-safe

Editorial boundary: No hands-on testing was performed. Confirm the device label, current firmware and live official instructions before making changes. Never send passwords, VPN keys or complete configuration backups to RouterFix.

Referenced models

Try the right tool