Struggling create VLAN in DSA config (OpenWrt 22.03)

This seems quite unrelated to the issue of VLANs. Would you like me to split this into a new topic?

see this:

This isn't how port forwarding works. Port forwarding listens on the wan interface and then forwards request from the wan to a specific host on the lan. 192.168.1.1 is the address of the router on the lan interface -- it will not be able to port forward in this situation. The best way to test your port forwards is with a device that is not part of your own network -- i.e. a phone on cellular (not wifi) or from a different network entirely.

The firewall can do this, but this only works if the device isn't controlled by someoene who might try to circumvent the block (such as a tech-savvy kid). This would also be good to ask in another thread.