I'm using VLAN aware bridge. I have an interface that I need that only packets with VID 10 and 20 could pass through, any other VIDs should be dropped. I configured the interface like that:
bridge vlan add vid 10 dev wlan2.2
bridge vlan add vid 20 dev wlan2.2
My problem is that I want to allow untagged traffic to also pass through, without modifying/adding tag to the packet.
Can it be done?
You can configure the port to use a specific Port VLAN ID (pvid) for all received untagged frames and configure this same VLAN ID to be emitted as untagged frames (untagged). While it's possible to emit multiple VLANs as untagged, there's no real use, because the other VLANs that are not the PVID on this port will never see traffic replies in this case, since any possible untagged reply traffic goes only to the PVID: for a given bridge port, both flags are usually present for one VLAN ID only. Simply choose any random VLAN ID (it will never be seen on the wire), for example 42:
bridge vlan add vid 42 dev wlan2.2 pvid untagged
and configure any other port that should communicate with it in the same manner, PVID+untagged as above or tagged as needed (if tagged VLAN ID 42 will then be seen on this wire).
The last part does matter: without any other port (including the bridge interface) knowing about VLAN 42 frames will just be dropped. For example with a newly added bridge port foo0:
bridge vlan delete vid 1 dev foo0
bridge vlan add vid 42 dev foo0 pvid untagged
and the other tagged VLANs too:
bridge vlan add vid 10 dev foo0
bridge vlan add vid 20 dev foo0
Actually if you never deleted this default VLAN ID 1 as done above, then the behavior is already as you described using VLAN ID 1: all ports default to PVID 1 untagged. So if the bridge (that I'll name bridge0) and the port wlan2.2 were configured as you wrote, where VLAN ID 1 was never deleted then there's nothing to do to get this behavior. Here's a mockup:
ip link add name bridge0 up type bridge vlan_filtering 1
ip link add wlan2.2 up master bridge0 type dummy
bridge vlan add vid 10 dev wlan2.2
bridge vlan add vid 20 dev wlan2.2
# bridge vlan show
port vlan-id
bridge0 1 PVID Egress Untagged
wlan2.2 1 PVID Egress Untagged
10
20
All interfaces/ports already have PVID 1 untagged by default, thus working as intended without any change, including without the change I wrote above.
About the bridge itself and routing
Note that the bridge interface behaves slightly differently from the bridge ports since it participates in routing. Changing VLAN IDs for the bridge interface itself also requires the keyword self (this usage of self appears to lack unambiguous documentation in man page) in addition to other settings, and this will also affect routing connectivity of the bridge interface. Routing requires untagged frames, so only one VLAN is available for proper routing directly with the bridge interface (more could be made available either by using classic VLAN interfaces on top of the bridge interface, or else with veth interfaces with one side set as bridge port and the other side with an IP address). Like other ports, it's also defaulting to PVID 1 untagged as seen above. You can choose to switch it to VLAN 42 to route the untagged traffic received on port wlan2.2 (and lose any former traffic/connectivity from default VLAN 1 that could come from elsewhere):
bridge vlan delete vid 1 dev bridge0 self
bridge vlan add vid 42 dev bridge0 pvid untagged self
