You set up a bridge, so it would be helpful to see what is included in your bridge. Also, if you kept that interface in your lan bridge, and your vlans are only tagged with no default, i am not sure the firewall would even be in play. Perhaps someone way smarter than I am can look into this further with you, but when I set up my vlans, I just assigned the interface and did not configure a new bridge and all of my vlans are untagged allowing my swtich to control vlan membership.
It truns out the default input action should be deny indeed, and in order to prevent complete router unavailability I had to create allow rule to "this device" first
