VPN and VLANs · Topic 4 of 7

VLANs and Their Usage in RouterOS

Learn what a VLAN is, how 802.1Q tagging works, how to create VLAN interfaces and bridge VLAN filtering in RouterOS, and where each approach fits.

5 min

In a nutshell

A VLAN is a separate Layer 2 broadcast domain, identified by an 802.1Q tag.
The tag adds 4 bytes and holds a 12 bit VLAN ID.
Access ports are untagged, and trunk ports are tagged.

What it is

A VLAN splits one physical network into several separate Layer 2 networks, each with its own broadcast domain.

Hosts in different VLANs cannot talk to each other directly. Traffic between them must pass through a router, where you can apply routing and firewall rules.

VLANs are defined by IEEE 802.1Q. A tag in the Ethernet frame carries the VLAN ID.

How it works

A frame is tagged with a VLAN ID, and each device decides how to treat tagged and untagged frames.

The 802.1Q tag

The tag is 4 bytes and sits inside the Ethernet header. It holds a 12 bit VLAN ID, so values from 1 to 4094 can be used in practice. It also holds a priority field.

Because the frame grows by 4 bytes, the interface must handle a slightly larger frame. Devices that cannot do so drop tagged frames at full size.

Tagged and untagged

A port can carry traffic in two ways.

Port role	Frames on the wire	Typical use
Access	Untagged, one VLAN	A host or a printer
Trunk	Tagged, many VLANs	Link between switches or to a router

An access port adds the tag when the frame enters the network and removes it when the frame leaves. The host never sees the tag.

Method 1: VLAN interface on a port

The simplest RouterOS approach is a VLAN interface on a physical interface. The router then routes between the VLANs.

/interface vlan add name=vlan10 vlan-id=10 interface=ether2
/interface vlan add name=vlan20 vlan-id=20 interface=ether2
/ip address add address=192.168.10.1/24 interface=vlan10
/ip address add address=192.168.20.1/24 interface=vlan20

Frames that arrive on ether2 with tag 10 appear on vlan10, and the same for tag 20. Frames sent out of vlan10 leave ether2 with tag 10. This design is known as router on a stick.

Frames on ether2 that have no tag still belong to ether2 itself. That untagged traffic is the native traffic of the link.

Method 2: VLANs on a bridge

When the router also acts as a switch, the ports go into a bridge. From RouterOS v6.41, the bridge can filter VLANs itself.

/interface bridge add name=bridge1 vlan-filtering=no
/interface bridge port add bridge=bridge1 interface=ether2 pvid=10
/interface bridge port add bridge=bridge1 interface=ether3
/interface bridge vlan add bridge=bridge1 tagged=ether3,bridge1 untagged=ether2 vlan-ids=10
/interface bridge set bridge1 vlan-filtering=yes

The pvid is the VLAN given to untagged frames that enter the port. The tagged list names ports that send the VLAN with a tag, and untagged names ports that remove it. The bridge itself must be tagged if the router needs a Layer 3 interface in that VLAN.

Turn on vlan-filtering last. If you enable it earlier, you can cut yourself off from the router.

Layer 3 on a bridge VLAN

To give the router an address in VLAN 10, create a VLAN interface on the bridge and add the bridge to the tagged list.

/interface vlan add name=vlan10 vlan-id=10 interface=bridge1
/ip address add address=192.168.10.1/24 interface=vlan10

Why use VLANs

VLANs reduce broadcast traffic, separate departments or customers, and allow many networks over one cable. They let you apply a firewall between networks that share the same switch.

Verifying

/interface vlan print
/interface bridge vlan print
/interface bridge port print

Exam tip

In version 6 the bridge VLAN filtering and the older switch chip methods are different features. Do not mix them on the same ports.

What to remember for the exam

Seven facts cover most questions on this topic.

A VLAN is a separate Layer 2 broadcast domain, identified by an 802.1Q tag.
The tag adds 4 bytes and holds a 12 bit VLAN ID.
Access ports are untagged, and trunk ports are tagged.
A VLAN interface is created on a parent interface with a vlan-id.
Traffic between VLANs must be routed.
Bridge VLAN filtering is available from RouterOS v6.41, and it uses pvid, tagged and untagged.
Enable vlan-filtering last, after the VLAN table is ready.

Watch out

Enabling VLAN filtering before the VLAN table includes your management port can lock you out. Configure from a console or a safe mode session.

Common mistakes

These four errors appear often.

Mismatched VLAN IDs between the router and the switch. Tagged frames then arrive in a VLAN that has no interface, and they are dropped.

Forgetting the bridge in the tagged list. The router cannot reach hosts in the VLAN through a VLAN interface on the bridge.

Expecting VLANs to talk to each other. They are separate networks, so you need a router and routes.

Enabling filtering too early. The management connection may drop before the VLAN table is complete.

Check yourself

Work through these three questions.

What does an 802.1Q tag contain, and how large is it?
The tag is 4 bytes and holds a 12 bit VLAN ID and a priority field. The receiving device uses the ID to choose the VLAN.
How do you create a VLAN interface for VLAN 10 on ether2?
Use /interface vlan add name=vlan10 vlan-id=10 interface=ether2. Then add an IP address to the new interface.
What do pvid, tagged and untagged do in bridge VLAN filtering?
pvid gives untagged incoming frames their VLAN. The tagged list sends the VLAN with a tag, and the untagged list removes the tag.

Topic 4 of 7 in VPN and VLANs

Test yourself on VPN and VLANs

The full MikroTik MTCRE question bank has 417 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.