yeah, ancient version of ip as well. doesn't list the info I want, such as for example from OpenWRT:
12: wlan1-1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-guest state UP mode DEFAULT group default qlen 1000
link/ether 00:25:9c:13:e4:aa brd ff:ff:ff:ff:ff:ff
which clearly shows that wlan1-1 is part of br-guest for example.
so, here's the question you need to answer to understand why the ebtables rule doesn't work (try some kind of "brctl" or "bridge" commands to find out the info)
are vlan3, and wl0.1 both in the br1 and is there anything else in br1, such as eth0 for example or eth1 by itself... the only thing in this bridge should be vlan3 and wl0.1
also it seems like maybe you've been posting a mishmash of two different tomato configs on two different routers?
In the end you want stuff to come in to your bridge from openwrt on vlan3 or go out to openwrt on vlan3 but you don't want anything to go local wifi to wired or wifi to wifi or wired to wifi...
if you want guests to access the guest network by wired... you need to add those ports to a separate vlan, say vlan4 and place those ports untagged into vlan4 and put vlan4 in the bridge along with vlan3 and wl0.1 that will isolate them properly.
Also, you need iptables rules on tomato that prevent routing between traffic on br1 and any other location such as your main LAN on vlan1, or your "wan" port on vlan2