VLAN segmentation in an ISP access network serves two distinct purposes: it isolates subscribers from each other so one subscriber cannot sniff another's traffic, and it separates operational traffic planes (management, subscriber data, uplink) so a compromise in one plane does not immediately expose the others. Both purposes matter for security and both are implicit in CTDISR-2025's network segmentation requirements.

MikroTik RouterOS implements VLANs through bridge VLAN filtering, which replaced the older software bridge and vlan-on-interface approach in recent RouterOS versions. Bridge VLAN filtering is the correct implementation for any new deployment.

The Traffic Planes to Separate

An ISP access network has at minimum three traffic planes that should be isolated from each other: subscriber data traffic, management traffic for network equipment, and uplink or transit traffic.

Subscriber data traffic is the default-untrusted plane: subscribers may attempt to reach equipment management interfaces, scan adjacent subscribers, or generate traffic that should not appear on the management network. This plane gets the most restrictive firewall treatment.

Management traffic covers SSH, Winbox, SNMP, and syslog access to network equipment. This plane should be reachable only from your NOC or management network, not from subscriber or uplink interfaces. Keeping management traffic on a dedicated VLAN means that even if a subscriber-facing interface is compromised, management access requires traversing a VLAN boundary with firewall rules enforcing the crossing.

Uplink traffic is the transit plane between your access layer and your core or upstream. Keeping it on a dedicated VLAN simplifies routing policy and prevents subscriber traffic from inadvertently appearing on the uplink interface without going through your CGNAT and QoS processing.

Bridge VLAN Filtering Configuration

RouterOS bridge VLAN filtering is configured on the bridge interface, not on individual ports. Enable VLAN filtering on the bridge:

/interface bridge
add name=bridge1 vlan-filtering=yes frame-types=admit-only-untagged-and-priority-tagged

Add ports to the bridge with their VLAN membership. A subscriber-facing port on VLAN 100 with the bridge port as trunk:

/interface bridge port
add bridge=bridge1 interface=<subscriber-port> pvid=100 \
    frame-types=admit-only-untagged-and-priority-tagged

add bridge=bridge1 interface=<uplink-port> frame-types=admit-all

Define the VLAN table, specifying which ports are tagged (trunk) and untagged (access) for each VLAN:

/interface bridge vlan
add bridge=bridge1 vlan-ids=100 tagged=<uplink-port> untagged=<subscriber-port>
add bridge=bridge1 vlan-ids=200 tagged=<uplink-port> comment="Management VLAN"
add bridge=bridge1 vlan-ids=300 tagged=<uplink-port> comment="Uplink VLAN"

Subscriber Isolation

Subscriber isolation prevents traffic from one subscriber reaching another subscriber on the same access device without passing through the router (and your firewall). Without isolation, a subscriber on VLAN 100 can potentially ARP or broadcast-probe adjacent subscribers on the same bridge.

Implement subscriber isolation using the private-vlan or horizon feature in RouterOS bridge ports. Setting the same horizon value on all subscriber ports prevents traffic from being forwarded between ports with the same horizon value:

/interface bridge port
add bridge=bridge1 interface=<subscriber-port-1> pvid=100 horizon=1
add bridge=bridge1 interface=<subscriber-port-2> pvid=100 horizon=1

With horizon set to the same value on both subscriber ports, traffic from subscriber-port-1 will not be forwarded to subscriber-port-2 at the bridge layer: it must travel up to the router, through your firewall and routing policy, before it can reach any other subscriber.

Management VLAN Security

The management VLAN should be configured such that no subscriber-facing port is a member of it, only the management workstation, NOC access ports, and the router's own management interface. Configure the router's IP address on the management VLAN interface rather than on the bridge directly:

/interface vlan
add interface=bridge1 vlan-id=200 name=vlan-management
/ip address
add address=<management-ip>/24 interface=vlan-management

Combine this with the firewall filter rules from the MikroTik hardening article: input chain rules restricting SSH and Winbox access to source IPs within the management VLAN range only.

VLAN Trunking to Distribution Switches

For networks with distribution switches below the MikroTik aggregation layer, configure the uplink port as a trunk carrying all VLANs, and configure the distribution switch to pass the appropriate VLANs to each access port. The principle is the same regardless of the distribution switch vendor: each subscriber-facing port on the distribution switch is an untagged access port on a subscriber VLAN, and the uplink to the MikroTik is a tagged trunk.

Where the distribution switches are also MikroTik devices, the same bridge VLAN filtering approach applies consistently from aggregation through access layer. This consistency simplifies troubleshooting: the same set of commands and concepts applies at every layer.

For the security design principles behind VLAN segmentation including the firewall policy that enforces boundaries between planes, our Cybersecurity for ISPs practice covers the full access network hardening scope. For VLAN design as part of a broader access network topology, Network Design & Optimization covers the full design engagement.