I am unsure but... what if you enable "use-ip-firewall" for those bridges? Thing is, that Simple queue is applied in input/postrouting, which is L3 (see packet flow diagram ). However, when you bridge two interfaces, it will be pure L2 connection. I haven't try that but maybe, maybe... it...