This seem to be incorect, if upstream has a untagged PVID, it becomes just eth1.
Also because it seem you are creating a dumbap from the looks of it, you can allow everything in zone wan, so input and forward can be set to accept or the whole zone can be removed.
There is only one other issue I see:
the router is unable to find the default route, and since wan port is part of br-lan which is the 'gateway', you need to make sure each created interface has option: default gateway unchecked, please edit vlan60, click on the advanced tab uncheck, that checkbox mean if the interface is a 'wan' interface but by default creation often this is checked, this causes a wan conflict.
With ip r you can verify if the default route points to your upstream router.
If issue still persist maybe someone with experience with swconfig on the Flint 3 can help as I don't own a Flint 3 and I'm aware the port numbering is odd, you want to tag cpu, and tag the wan port, and maybe untag a port for lan if needed, the tutorial can help more in this case.