The bridge is the LAN. Every port in it shares the same network: what arrives on ether2 can leave on ether3 without the router routing anything. Ports you assigned under WAN are kept out automatically, because putting a WAN port in your LAN means letting your ISP's network in.
Where it sits
In the wizard this is the Ports step, with two questions: what the bridge is called and which ports go in it. Everything below lives in advanced under Bridge and ports. The section does not appear on a device without wired ports.
Which ports join the bridge
By default every wired port goes in except the WAN ports. For an ordinary router or switch that is right and you need do nothing. Only take a port out when you want something specific from it: a second uplink, a separate cable to one device with an address of its own, or the emergency port below.
Ports that are part of a bond are kept out too; the bond itself becomes the bridge member instead. The same goes for the offbridge port. If you do list a port that already has a role elsewhere, the tool says so and leaves it out.
If nothing is left, you get a warning that the bridge has no ports. That is nearly always a mistake.
Spanning tree
Defaults to RSTP. This is the setting that saves you when someone patches two switch ports together: instead of a broadcast storm that flattens the whole network, one of the two paths is blocked. The cost is a few seconds when a port comes up, the return is a network that survives a cabling mistake. STP is the older variant for equipment that does not speak RSTP, and MSTP is for those who want a separate tree per VLAN.
IGMP and DHCP snooping
IGMP snooping makes sure multicast only goes to the ports that asked for it. Turn it on as soon as IPTV or anything else multicast crosses your switch, or every port has to deal with that stream. See also IPTV from your provider.
DHCP snooping lets only trusted ports pass DHCP offers. You pick those ports below: the port towards your router, and possibly a trunk to a switch that has a DHCP server behind it. Every other port is then no longer allowed to be a DHCP server. That catches the classic mistake where someone plugs a small router in backwards and half the office gets an address from the wrong range.
Hardware offloading
On by default. The switch chip then forwards frames itself, without the CPU. That is the difference between a device that saturates its ports and a device that saturates its CPU. Only switch it off if you have a reason; the script then writes hw=no on every bridge port.
Not everything can be offloaded. If you pick a model whose switch chip keeps its VLAN table in /interface ethernet switch (the Atheros8327 and QCA8337 family, the hEX series for example) and you enable VLANs, the tool tells you: bridge VLAN filtering works there, but it takes the traffic off the switch chip and hands it to the CPU. For full throughput on such a board the switch chip configuration is the right route, and the configurator does not write that.
Disabling unused ports
Disable unused ports has the script switch off every port that has no role anywhere: not in the bridge, not WAN, not in a bond, not the emergency port. They get the comment unused. A port that is off does nothing when somebody plugs a cable into it, which in a meter cupboard or a public space is exactly the point.
Separately, disabled ports lets you name ports yourself. Those are switched off even when they are in the bridge. If you accidentally disable a WAN port, the tool warns that no internet comes in there any more.
Port comments
One line of text per port, written as the comment on the interface. "Patch panel 1.14, meeting room" saves you half an hour of hunting a year from now. If you use the network board and draw the cables, the configurator already adds comments saying what is on the other end; what you enter here wins over those.
The bridge MAC address
RouterOS borrows the MAC address of the first port in the bridge by default. That address therefore changes if that port ever leaves the bridge, which can surprise DHCP reservations, monitoring and licences. You have four choices:
- Automatic: the RouterOS default, follows the first port.
- Pin to the MAC of the first LAN port: the script has RouterOS read that address when you paste it and fix it in place. It cannot change afterwards. Usually the best choice.
- Generate a locally administered address: takes the last five octets of the first LAN port and puts
EEin front. Unique per device and never in collision with a factory address, but it is no longer a MikroTik OUI: inventory tools that recognise hardware by its OUI will stop seeing this bridge as a MikroTik. - Enter a MAC address myself: only if you have a scheme. Do not invent an address right next to an existing one, because MikroTik gives the ports of one unit consecutive addresses and "highest plus one" may belong to another unit from the same batch. Use something with the locally administered bit set, for example
02:…; the tool warns you if you do not.
What the script makes of it
First /interface bridge add name=… with the spanning tree mode and the snooping options, then any interface comments and disabled ports under /interface ethernet, and after that /interface bridge port add per port. With VLANs on, the /interface bridge vlan table follows, and only right at the end is vlan-filtering=yes set, because that switch may only flip once the ports and the table exist.
Check afterwards with /interface bridge port print that the ports are in and that the H column (hardware offload) is on.
What goes wrong
- The router is gone after applying. With VLANs on that happens when no VLAN has an address and no port is untagged on the bridge. The tool raises a real error about this and will not let the script pass; fix it under VLANs.
- One port does nothing. Check whether it is in the disabled ports list, or whether "disable unused ports" swept it up.
- The network stalls when a cable is plugged in. Spanning tree is off, or the device at the other end does not take part in it.
- Throughput disappoints. Check that hardware offloading is on and read the note about your model's switch chip.
Read on: VLANs for access and trunk ports, Bonding and LACP for two cables acting as one, and MTU and jumbo frames for the frame size on those same ports.