vlans on openwrt TP-Link WNDR4300

# This is on a TP-Link WDR4300
# eth0 is connected to port 0 of the switch, WAN is port 1,
# and ports 0 - 3 are the LAN ports 2 - 5.
#
# The WAN port is connected to a gateway server that has LAN traffic
# tagged as VLAN 2, and a guest network tagged as VLAN 3. Both also go
# tagged to the CPU (port 0, hence the "0t").
# VLAN 2 is available untagged on the LAN ports, and on wlan0 and wlan1
# (2.4GHz and 5GHz)
# VLAN 3 is available on wlan0-1 and wlan1-1.

# /etc/config/network :

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd53:b60b:e960::/48'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '0t 1'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '2'
        option ports '0t 1t 2 3 4 5'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '3'
        option ports '0t 1t'

config interface 'vlan2'
        option type 'bridge'
        option _orig_ifname 'wlan0 wlan1'
        option _orig_bridge 'true'
        option proto 'static'
        option ifname 'eth0.2'
        option ipaddr '192.168.28.252'
        option netmask '255.255.255.0'
        option gateway '192.168.28.1'
        option broadcast '192.168.28.255'
        option dns '192.168.28.1'

config interface 'vlan3'
        option proto 'none'
        option type 'bridge'
        option _orig_ifname 'wlan0-1 wlan1-1'
        option _orig_bridge 'true'
        option ifname 'eth0.3'

# part of /etc/config/wireless :

config wifi-iface
        option device 'radio0'
        option mode 'ap'
        option network 'vlan2'
        option ssid 'myssidname'
        option encryption 'psk2'
        option key 'secret'

config wifi-iface
        option device 'radio1'
        option mode 'ap'
        option network 'vlan2'
        option ssid 'myssidname'
        option encryption 'psk2'
        option key 'secret'

config wifi-iface
        option device 'radio0'
        option mode 'ap'
        option ssid 'guest access'
        option encryption 'psk2'
        option key 'welcome'
        option network 'vlan3'

config wifi-iface
        option device 'radio1'
        option mode 'ap'
        option ssid 'guest access'
        option encryption 'psk2'
        option key 'welcome'
        option network 'vlan3'