There are a few ways to do a Management-VLAN for MT devices, and you could just add a VLAN against your trunk interface(not a great recommendation, but will get you out of a tough spot ).
OR do it the better way for MT/RouterOS
https://wiki.mikrotik.com/wiki/Manual:B ... _switching
The info below is the basics(**NOTE where it said /interface bridge
set bridge1 vlan-filtering=yes at the BOTTOM ** You can hack yourself off if you don't put that last !! **)
Also add the WLAN interface to the bridge!! And adjust the code as requried for your setup.
I would paste it into a text editor and edit(remove/add bits) prior to applying to your given device.
** Also this concept of using the bridge/vlan in this way, is ideal for AP's if you go down the later path of using CAPsMAN to control Ap's especially where you stack multiple SSID's and VLANs together*
Other devices without a built-in switch chip
It is possible to do VLAN filtering using the CPU, there are multiple ways to do it, but it is highly recommended by using bridge VLAN filtering.
/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether1 hw=no
add bridge=bridge1 interface=ether2 hw=no pvid=20
add bridge=bridge1 interface=ether3 hw=no pvid=30
/interface bridge vlan
add bridge=bridge1 tagged=ether1 untagged=ether2 vlan-ids=20
add bridge=bridge1 tagged=ether1 untagged=ether3 vlan-ids=30
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=99
/interface vlan
add interface=bridge1 vlan-id=99 name=MGMT
/ip address
add address=192.168.99.1/24 interface=MGMT
/interface bridge
set bridge1 vlan-filtering=yes
