I was slightly confused how PVID works since I learned Native VLANs when configuring Cisco switches. But luckily I found this article and that helped.
I have this setup on ZyXEL GS1900 switch:
It is simple - first / second port should "carry" VLANs into another OpenWrt / managed switch and the other ports are to connect PCs, printers...
Based on my reading of the article, the following config will have no effect since a single Untagged VLAN means that both Ingress / Egress are that single VLAN:
And with Cisco I would assign some unused VLAN as PVID on trunk ports to make sure that the untagged packets don't work (that they're tagged to an unused VLAN). But based on my reading of the article, untagged packets are ignored by default and the following Cisco-style config would actually break first and second trunk port:
In other words config from the first screenshot is all I need.
Could you please correct me if I'm wrong?