This is how I set up my network to allow for a separate network for my servers - these are in my /etc/config/network.
Enable first the vlan options on the switch:
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
Ports 2,3 and 4 - the switch numbers them as 0,1 and 2 - are untagged on VLAN 1. Port 5 is the switch CPU, 't' means it's tagged, since it will appear on more than one VLAN.
config switch_vlan
option device 'switch0'
option vlan '1'
option vid '1'
option ports '0 1 2 5t'
This is my WAN port - now on VLAN 2 - the number of the port on the switch is 4:
config switch_vlan
option device 'switch0'
option vlan '2'
option vid '2'
option ports '4 5t'
Finally my server side VLAN, it's number 3 and it includes only the first port on the router - numbered 3 on the switch:
config switch_vlan
option device 'switch0'
option vlan '3'
option vid '3'
option ports '3 5t'
Now the configuration of the LAN bridge, where all the clients (wifi and ports 2,3 and 4) are sitting. This is bound to
VLAN 1 on the eth0.1 interface:
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option ipaddr '192.168.66.1'
option netmask '255.255.255.0'
option ip6assign '60'
The WAN is attached to the second VLAN - eth0.2:
config interface 'wan'
option ifname 'eth0.2'
option proto 'dhcp'
And this is my server interface, bound to VLAN 3 via the eth0.3 interface, I have spanning tree protocol enabled on this interface:
config interface 'server'
option type 'bridge'
option proto 'static'
option ifname 'eth0.3'
option ipaddr '172.10.0.1'
option netmask '255.255.0.0'
option stp '1'
You can do most of this configuration also using the web interface from Network->Switch.
VLAN 1 - Ports 0,1,2: untagged; Ports 3,4: off; CPU: tagged; Port 6: off -- Port 6 is actually the CPU seen from the WAN port;
VLAN 2 - Ports 0,1,2,3: off; Port 4: untagged; CPU: tagged; Port 6: off -- This is the WAN port
VLAN 3 - Ports 0,1,2,4: off; Port 3: untagged; CPU: tagged; Port 6: off -- This is the server VLAN
I suggest you connect to the router using wifi while playing with the switch -- it's going to make you life easier.
Creating the VLANs is only the beginning: you also have to create a zone for the lan you have just created and setup the rules to allow -- or not -- the traffic.