diff --git a/iopsys-brcm63xx-arm/base-files/sbin/vlanconf b/iopsys-brcm63xx-arm/base-files/sbin/vlanconf
index 2ba68bcba8d76ec88fdd12156036bcc9c3f725ce..b20681b08a9226a32e6648158aa7ab722e01b24a 100755
--- a/iopsys-brcm63xx-arm/base-files/sbin/vlanconf
+++ b/iopsys-brcm63xx-arm/base-files/sbin/vlanconf
@@ -167,6 +167,13 @@ vlanCtl_cmdConfigDscp2PbitMap()
 	vlanctl --if $1 --cfg-dscp2pbits $2 $3
 }
 
+vlanCtl_filterOnEtherType()
+{
+#	_v "vlanctl --filter-ethertype $ETHERTYPE"
+#	vlanctl --filter-ethertype $ETHERTYPE"
+	TAGRULE="$TAGRULE --filter-ethertype $1"
+}
+
 vlanCtl_filterOnPbit()
 {
 #	_v "vlanctl --filter-pbits $PRIORITY $TAGINDEX"
@@ -504,6 +511,32 @@ create_vlan() {
 		vlanCtl_setReceiveVlanDevice $NAME
 
 		if [ $BRIDGED -eq 1 ]; then
+			# filter tagged and double tagged packets on untagged interface,
+			# else the bridge is as good as transparent
+			vlanCtl_filterOnEtherType "0x8100"
+			vlanCtl_cmdDropFrame
+
+			# Set rule to the top of rx tag rule table-1 to drop tagged packets
+			DIRECTION="rx"
+			TAGS=1
+			POSITION="rule-insert-before"
+			TAGRULEID="-1"
+			vlanCtl_insertTagRule $IFNAME $DIRECTION $TAGS $POSITION $TAGRULEID
+
+			vlanCtl_initTagRule
+			vlanCtl_setReceiveVlanDevice $NAME
+			vlanCtl_filterOnEtherType "0x88A8"
+			vlanCtl_cmdDropFrame
+
+			# Set rule to the top of rx tag rule table-2 to drop double tagged packets
+			DIRECTION="rx"
+			TAGS=2
+			POSITION="rule-insert-before"
+			TAGRULEID="-1"
+			vlanCtl_insertTagRule $IFNAME $DIRECTION $TAGS $POSITION $TAGRULEID
+
+			vlanCtl_initTagRule
+			vlanCtl_setReceiveVlanDevice $NAME
 			# Insert the vlan header into the frame and forward if its
 			# a L2 bridge else, unconditionally forward to the rx vlan
 			# interface