1. Vlans:
Ok, because OpenWrt recently changed to DSA alot of older yt videos talk about the older linux implementation (swconfig), even though gl software compiles with the swconfig switch tab, this is more a remnant and it is advised to use DSA (Distributed Switch Architecture).
The difference between them, is that swconfig has menu item called switch inside the network menu tab, and that the cpu0 had to be tagged, DSA aims to simplify that so that you no longer have to tag cpu 
, to find the DSA settings this is under network -> interfaces and then you click on devices tab, you can also return to interfaces there via this tab menu.
now what you want is this I gonna make a mini tutorial in the hope all falls into pieces
so first we head back to the devices tab and then click edit on br-lan.
and then we click on the tab: Bridge VLAN Filtering.
You will see a checkbox: Enable VLAN Filtering, check it.
As you can see you already have vlan 1, U means untagged, untagged means also the final destination port, each port can only use one Untagged vlan, in OpenWrt this also means practically this is your PVID or better said your primary vlan, after this port this vlan stops to exist and does no longer exist.
You also have T for tagged traffic, this will not be the destination port or pvid, however tagged vlans can be multiple combined on one port, and keep exist also if it traversed after a port, to illustrate as example you could have untagged port 1 on lan1, and have a other vlan i.e 90 as tagged on the router, then if you had a vlan aware switch, in this switch you could then untag 90 to the desired port on the switch but the switch listens on vlan1 (this can be seen as native vlan / management network).
But there is a catch:
keep in mind that in alot of cases you need to make sure the switch knows where to tag 90 back so you get: port 1(even though there is no real wan, it makes it easier to see it that way): 90t, port 5: 90u, now the switch tags 90 back to your router on port 1 and on port 5 this network is default, sometimes you need to also set the pvid for port 5, just do so, network switches take this much more seriously than OpenWrt in that regard.
There are network switches which aim to simplify this, the process of tagging vlan 90 back to the router they do this when specifying the native vlan (your management vlan) it then tags it automaticly back for better ease of use, unifi is such example, but you still need to untag or tag a other port.
^ you can also daisy chain switches like this, and even encapisulate network devices.
Okay back to the VLAN filtering tab:
lets click on add, and on the left we type 178, I do know the luci is very broken on GL firmware because it is older than OpenWrts, which means there is a visibility glitch, just click it once and then close it by clicking on save and then re-navigate again or refresh, clicking to many times on add results in hundreds of ghost entries 
, do not save and apply here.
Depending on the port and your use case you can use a port of the flint to use a U, then on vlan 1 you remove the U for that port, if you want to traverse it to a network switch you choose tagged as traffic, exactly how i described the basic concept of vlans, the local checkbox is fine if it is checked, it needs to for the cpu so, see:
Ok click on save, but do NOT click on save and apply, this is crucial because br-lan which is the device under lan as interface needs to be changed.
This can be done by clicking on the interfaces tab or from luci index -> network -> interfaces.
Then change the device from lan by clicking edit and then you use br-lan.1, you will see it as a new device showing in that dropdown list
Great, now you can save and apply.
1.1 Interfaces
As continue from 1. we now must create a interface for vlan 178. this will be not so hard
First we navigate to luci index -> network -> interfaces and click on: Add new interface... it's on the bottom of the page.
You could fill this in like this, the name can also be less generic, can also be iot or whatever suits your use case
Then click on protocol and change to static.
This will change the window like this:
And you want to fill it in like this:
The gateway field must be leaved empty otherwise you create a default route, which messes with repeater, vpn functions, its better to not use it all.
Then you click on advanced settings:
And uncheck Use default gateway this is because otherwise other interfaces may think this is a gateway interface, which is wrong only wan and wwan should be typical wan interfaces and you want your traffic going there instead of going over the wrong one and then over wan/wg , lan is more of a special interface in this case.
Now click on firewall settings and on the drop down make a new zone i.e 178 or what suits better for you, it is recommended to use short names.
Then go to dhcp server tab, click on setup dhcp server, basicly alot of the defaults are fine, you could setup the start with 192.168.178.2 and limit with 150 that is also fine.
Save and apply, then navigate back to luci index and go to network -> firewall, and edit the newly created zone, you have to change input from reject to accept, only then clients can receive dhcp leases.
Then edit it again and make sure it forwards to destination zone wan, it can also be both wan and wgclient.
1.2 forwarding
So you have different ways of allowing networks to talk to each other, this is why i think that a brief explaination how traditional firewalls work is needed.
So when I visit a website, my firewall allows it, this is because firewalls are designed to allow every source to destination, it's always one way, basicly everything I initiate as source is allowed, the other side is then allowed to communicate back on the same line.
But when unsolicitated traffic becomes the source traffic with no first initiation of me, then it gets blocked, unless i allow it by port forwarding.
This is why some games have clever ways to still allow multiplayer behind firewalls , first you initiate contact to their main list server, because the server has the open window to communicate back it then can forward a other player.
To reflect this on the firewall zones:
You then can edit zone 178, and on dest zone you add lan, now 178 can talk with lan, but lan not with 178 unless they already talk on the same line as reaction to the first initiator.
I myself like more finer rules rather than zone forwarding, this can be done with traffic rules and it is basicly the same idea but you can do it much strict and finer, for example: only one dest ip in lan is accessible for 178, or only with selective ports.
I can help you if you want. very important, I flashed the openwrt 24.10 firmware as maybe the stock firmware is buggy. Other important details: after some save & apply, the router should be rebooted to get the new config.
