On switch:
Port 1 - (CPE 5G), any, default vlanID 1000, member of vlan 1000
Port 2 - (Trunk), any, default vlanID 1000 only tagged, member of vlan 900 and 1000
Port 3 - only untagged, member of vlan 900
Port 4 - only untagged, member of vlan 900
Port 5 - only untagged, member of vlan 900

Router:
Vlan filterering active
Pvid 1000 1 (default) port 1 (wan port) frame-types=only-vlan-tagged
vlanID 1000, tagged=Bridge-all-vlan and eth1
pvid 900 eth 2-8
vlanID 900, tagged=Bridge-all-vlan and eth1, untagged eth2-8

Hi,
If I understand correctly, you want to get "Internet" on RB 4011, which you will get from CPE 5g via DHCP and it is to be forwarded via VLAN 1000.

In this case, you can no longer treat port 1 as WAN and you must instead assume that VLAN 1000 is your new "WAN"

So if I interpret it correctly, RB260 trunk port is port 2 and it is connected to RB4011 to port 1? Correct me if I'm wrong.

So set RB260 port 1 to VLAN -> Vlan mode -> strict (vlan receive ANY) Default Vlan ID 1000

RB 260 port 2 Vlan mode strict, Vlan Receive Only Tagged, Default ID 1 (def ID must match what you have on Bridge on RB4011)


---- RB4011 ----
Bridge -> click on your bridge -> VLAN -> Vlan filtering ENABLE, PVID 1 (same as on RB260), frames admit all

Bridge -> VLANs add 900 and 1000
Vlan 1000 and 900 add to port 1 as:

Bridge
VLAN ID: 1000
TAGGED: Bridge, eth1
Untagged null

Bridge
VLAN ID: 900
TAGGED: Bridge, eth1
Untaged e.g. port 2.3


Bridge -> ports -> ETH1 -> VLAN 1, Admit ALL.

And now on the RB 4011 set the DHCP client (if the CPE provides a DHCP address) to interface vlan 1000, Add Default Route yes

or IP -> Addresses, + new addresses and assign to VLAN 1000.

Interfaces -> InterfaceList -> vlan 1000 add to WAN list

You should then receive a communication IP address on VLAN 1000

I think that's a good point, but I haven't fully checked the other configuration. This is probably due to the fact that PVID 1 is the "default" vlan and many other devices communicate on it, which may cause some security problems. However, in the case of my networks, apart from TAG ports, there is no VLAN 1 anywhere (IPs are assigned to different Vlans, and the ports also always have a different vlan than 1)