Sure.
You have to assign one of the ethernet port to another VLAN (untagged), before you must remove this port to the default VLAN (usually it is 1). Then in the CPU port, add the same VLAN as tagged. A new interface will be created, suppose the CPU interface is eth0 and you choosed VLAN 2 for the trick, it will be eth0.2. Then create a WAN interface using eth0.2 and set the firewall rules according.