Sat May 01, 2021 12:18 am
vlan interface (created under /interface vlan) is kind of a pipe with two ends. One end is anchored to underlying interface, accepts tagged frames (the ones tagged with aporopriate VID that is) and transmits tagged frames. The other end can be used as untagged interface (e.g. set IP address to it), accepts unragged frames and transmits untagged frames.
The think to keep in mind is that ROS can only use untagged (parts of) interfaces to communicate with the rest of the world. If tagged frames are expected, then some entity has to tag (snd untag the return frames) it for ROS (and that's what vlan interfaces are for).
The thing about bridge is that it has two personalities: 1) it's a switch-like entity passing frames between member ports, and 2) it's an interface allowing ROS to interact with that L2 network. This interface is a member port of bridge.
When bridge has vlan-filtering=yes set, it becomes a smart (VLAN enabled) switch and member ports can tag/untag/filter frames. But when one creates vlan interfaces anchored to bridge, these are anchored to bridge interface and thus don't affect how bridge passes frames between member ports.
@sindy wrote a nice post which explains nicely different bridge personalities, I just can't find it right now (I don't know how to ask google to find it for me ;-) )