Depends on a device.
On EdgeRouter X for example the interfaces are labeled eth0-eth4 by default, not wan, lan1-lan4. Master interface aka CPU is called dsa and ports are labeled like eth0@dsa, eth1@dsa, etc. So in a case of ERX eth0 refers to a physical port.
Here’s an example:
# ip -br link
lo UNKNOWN 00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP>
dsa UP ff:ff:ff:ff:ff:7a <BROADCAST,MULTICAST,UP,LOWER_UP>
eth0@dsa UP ff:ff:ff:ff:ff:7a <BROADCAST,MULTICAST,UP,LOWER_UP>
eth1@dsa LOWERLAYERDOWN ff:ff:ff:ff:ff:7b <NO-CARRIER,BROADCAST,MULTICAST,UP>
eth2@dsa UP ff:ff:ff:ff:ff:7c <BROADCAST,MULTICAST,UP,LOWER_UP>
eth3@dsa UP ff:ff:ff:ff:ff:7d <BROADCAST,MULTICAST,UP,LOWER_UP>
eth4@dsa DOWN ff:ff:ff:ff:ff:7e <BROADCAST,MULTICAST>
br-iso UP ff:ff:ff:ff:ff:19 <BROADCAST,MULTICAST,UP,LOWER_UP>
With DSA - there will be a master interface which wouldn’t be used in your /etc/config/network. The rest of the interfaces are “slave” interfaces - they are all individual interfaces unless added to a bridge. On your device it looks like there is a lan bridge br-lan with interfaces lan1 lan2 and a single unbridged wan interface which nevertheless is still a part of the master DSA interface.
If VLAN tagging doesn’t work as expected on WAN interface - you can consider adding all three interfaces to a single bridge, enable vlan filtering on that bridge, and add the vlans both to the bridge and to single interfaces. Last I’ve heard though IGMP snooping and bridge vlan filtering was causing kernel crashes with mt7621 + DSA. Not sure if this had been already patched tbh.
See this thread - it will have some good info relevant to your device.