How much correctly/incorrectly are mikrotik VLANs configured?

Question

network hardware

Good evening, can you please tell me if this is possible?
There are rb4011 and crs328, ROUTER-ON-A-STICK LAN scheme is used. That is, the provider's optics enters the switch, from it VLAN 10 goes to the router, there is also Vlan 20 - the guest subnet and the main subnet on the Main Bridge. The switch and the router are connected by an SFP+ patch cord, that is, the SFP+ ports on both devices are Trunks and they are located in the main bridge (main Bridge) in the main subnet. Is it possible to do so? or still exclude SFP+ ports from the bridge, and drive the main subnet through VLAN too?

Answer 1

In this scheme, there will be a flow of traffic from the guest to the main and vice versa. Make it a separate bridge and prohibit routing traffic from one network to another at the firewall level.