Awesome. Glad to hear it's working now.
While I haven't spent the time to experiment with the 802.1q stanzas, it does seem to break things. It's not necessary to create those stanzas because the ports are automatically tagged as needed based on the bridge-vlan configurations. Explicitly setting the port tag status will ensure that all packets sent and received will be associated with the correct VLAN. (TBH, I'm still not certain about the difference between lan1, lan1:u, and lan1:u*, and nobody has been able to give a proper answer as to why there are three ways to write a line that should be untagged; but in my experience here, if you want a port untagged, set it explicitly with :u*)
AFAIK, you can set different MACs per port, but not per-VLAN.
If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! 