Flint2 (GL-MT6000)and vlans

Hi, I have just received a Flint 2 (GL-MT6000) to replace my current home brew arm based AP's. I used to use OpenWRT on buffalo hardware some years ago but the modern OpenWRT is opaque to me and I am failing at step 1 :frowning:

I have reflashed it with OpenWRT 23.05.5

I want to duplicate my current wifi network which consists of:

Firewalls, DHCP, DNS and routing (OSPF via bird) is provided by the network.
A trunk containing 7 VLANs. (can I use the WAN port for this?)
One is for management (44, no wireless) - this should be firewalled.
Each of the others has an associated VAP with no connection to management.
One VLAN (41) has 5Ghz and 2.4Ghz on the same SSID, rest are 2.4Ghz only.
One VLAN (46) also needs a LAN connection for a switch connected to media equipment.

The first thing I want to do is connect the management lan - my initial attempts to get it to work ended up with packets going to where I didn't want them. From a post I read, I am thinking that the GL-MT6000 isn't a simple hardware layout like I have been assuming. And there is a lot of confusion with DSA and setup guides so that I need help. I can some redesign of the network (e.g., provide a separate cable for management if that's the only way it can be done.

As a start can I get some hints on how to get the management VLAN securely connected and then add one wireless to vlan VAP after which I should be ok? I would prefer Luci if it can be done that way.

BillK

Basic outline - you add ports and vlans to br-lan, then select which vlans are tagged on which ports, which are untagged.