Redirecting tagged traffic from wan to lan port on mikrotik?

Question

Mikrotik

Good day!
There is a piece of iron CRS109-8G with RouterOS v 6.47.4.
Both untagged and tagged frames (for example, vid=10) come to the input port (for example, ether1). It is
necessary to redirect tagged traffic to one port (for example, ehter2), and untagged traffic to others (ether3, ..., ether8).

In theory, how it should work I imagine as follows.
ether1 is a trunk, namely a tagged port labeled vlan 10 and 1 (not tagged traffic).
ether2 is also a trunk, but only for vlan 10, the rest of the ports remain as they are by default.

The problem arose in the implementation. This can be done in 2 ways via bridge or switch (software and hardware, respectively). I'm not sure if method 2 is suitable for my piece of iron, since

/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether1 hw=yes
add bridge=bridge1 interface=ether2 hw=yes

/interface ethernet switch vlan
add ports=ether1 switch=switch1 vlan-id=1
add ports=ether1 switch=switch1 vlan-id=10
add ports=ether2 switch=switch1 vlan-id=10

/interface ethernet switch port
set ether1 vlan-mode=secure vlan-header=add-if-missing
set ether2 vlan-mode=secure vlan-header=always-strip default-vlan-id=10

did not work. Possibly due to the firmware version.
I have a bad idea of ​​how to set up vlan via bridge, since there are a lot of instructions and they are all different.

Questions:
1) Are my assumptions about redirecting tagged traffic correct?
2) What should I read to configure vlan for the current firmware version?

Answer 1

1 tagged port. 2 port untagged pvid=10. 3...8 ports untagged pvid=1

Answer 2

https://wiki.mikrotik.com/wiki/Manual:CRS1xx/2xx_s...