pfSense » pfSense Docs

When you add an interface to a bridge you can no longer use VLANs on that interface. This is the expected behaviour since a bridge on the parent interface carries the tagged traffic before it can be untagged and passed to the VLAN interface. However it requires further documentation since it's not clear in many situations, such as OpenVPN TAP, and resulting failure can be difficult to diagnose.

If you need to bridge an interface that is carrying VLANs the untagged traffic must be moved to an additional VLAN on it and bridged to that instead. That does then require a managed switch between that interface and any hosts but that is almost always the case since it's already carrying VLANs.

Another good reason to avoid tagged and untagged traffic on the same interface where possible.