what you can do is the following:
If you go into advanced configuration/luci → network → interfaces → devices tab.
You can edit br-lan, then click on vlan filtering.
then you click on add you see the vlan number 1 left, make it untagged on all ports.
Untagged means: that a vlan only reach the destination port, you can only have one per port (technically you can define more, but it will only sent one), you can also kinda see it as your default vlan for that port.
Tagged means: it tags a vlan and it can traverse beyond one port, you can have multiple vlans, and also combine them with untagged vlans.
So lets say you create another row with vlan 2 then you can set this one as tagged on the port to the flint 1 and choose to ignore for the rest of the other ports.
But don’t save and apply yet, now you need to go back to luci → network → interfaces → interfaces tab and edit lan, then you change the device to br-lan.1 to avoid locking out
For the other vlans you can create a new interface and cover the new
br-lan.<vlan number> you can use any local ip you want aslong its rfc1918
subnetmask is 255.255.255.0 and gateway leave empty, also click on the tab advanced and uncheck
Use default gateway checkbox this is so that traffic doesn’t orginate from different interfaces than for wan or vpn, only lan is allowed to follow it.
You can also create a new firewall zone and forward them to wan, you can do that in luci → firewall and then clicking edit on a zone.
Well let me know how far you can come , its probably a little itimidating but once you know it, it is easy, i wish i could make some screenshots but im on a phone atm
Heres a video which can be a really good use