Learn.GTArsenals
Search
beginner

Bridging and Switching in RouterOS 7

Learn how to configure bridges, hardware offloading, and VLAN filtering on MikroTik RouterOS 7.

45-60 min

Bridging and Switching in RouterOS 7

In RouterOS, a bridge is a software interface that connects multiple physical ports together so they act as a single network segment (like a physical switch). However, to achieve wire-speed performance, RouterOS must offload this bridging to the router’s physical switch chip.

This lesson covers how to create a bridge, ensure hardware offloading is active, and configure VLAN filtering using the unified bridge method introduced in RouterOS 7.

1. Creating a Bridge

When creating a bridge, you generally want a single bridge per router.

/interface bridge
add name=bridge1
  1. Go to Bridge → Bridge tab.
  2. Click [+].
  3. Set Name to bridge1.
  4. Click OK.

2. Adding Ports and Hardware Offloading

When adding ports to the bridge, RouterOS automatically attempts to enable hardware offloading if the switch chip supports it.

/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=sfp-sfpplus1

# Verify the 'H' flag is present
/interface bridge port print
  1. Go to Bridge → Ports tab.
  2. Click [+].
  3. Select Interface ether2 and Bridge bridge1.
  4. Ensure Hardware Offload is checked (it is by default).
  5. Click OK.
  6. Repeat for other interfaces. Verify the H column is visible in the list.

3. VLAN Filtering (RouterOS 7 Method)

RouterOS 7 unifies VLAN configuration under the bridge menu. To use VLANs, you define the VLAN IDs and their tagged/untagged ports in the bridge VLAN table, set the PVIDs for access ports, and finally enable VLAN filtering on the bridge itself.

Step A: Define Bridge VLANs

Let’s assume VLAN 10 is for Management and VLAN 20 is for Guests. sfp-sfpplus1 is our uplink (trunk), while ether2 and ether3 are access ports. Crucial: If the router itself needs an IP address on a VLAN (e.g., for management), you must add the bridge interface (bridge1) as a tagged port for that VLAN.

/interface bridge vlan
add bridge=bridge1 vlan-ids=10 tagged=bridge1,sfp-sfpplus1 untagged=ether2
add bridge=bridge1 vlan-ids=20 tagged=sfp-sfpplus1 untagged=ether3
  1. Go to Bridge → VLANs tab. Click [+].
  2. Bridge: bridge1, VLAN IDs: 10.
  3. Tagged: bridge1, sfp-sfpplus1. Untagged: ether2. Click OK.
  4. Click [+] again. Bridge: bridge1, VLAN IDs: 20.
  5. Tagged: sfp-sfpplus1. Untagged: ether3. Click OK.

Step B: Configure Access Ports (PVID)

Assign the appropriate default VLAN ID (PVID) to the access ports.

/interface bridge port
set [find interface=ether2] pvid=10 frame-types=admit-only-untagged-and-priority-tagged
set [find interface=ether3] pvid=20 frame-types=admit-only-untagged-and-priority-tagged
  1. Go to Bridge → Ports tab.
  2. Double-click ether2. Go to the VLAN tab.
  3. Set PVID to 10. Set Frame Types to admit only untagged and priority tagged. Click OK.
  4. Double-click ether3. Set PVID to 20 and Frame Types similarly. Click OK.

Step C: Enable VLAN Filtering

/interface bridge
set bridge1 vlan-filtering=yes
  1. Go to Bridge → Bridge tab.
  2. Double-click bridge1.
  3. Go to the VLAN tab.
  4. Check the box for VLAN Filtering.
  5. Click OK.