In the C7 and other typical gigabit routers, two CPU ports and all 5 of the Ethernet ports go into a single 7-port switch chip-- a "jungle" of possible connections from anywhere to anywhere. The default configuration sets up two VLANs to send WAN and LAN traffic through to one CPU port each. In this simple setup, the VLANs are only used internally in the switch, everything entering or leaving is untagged.
Expanding to more than 2 VLANs while having only two CPU ports, it becomes necessary to abandon this simplified setup and tag packets on a CPU port. So change to tagging on the eth1 CPU port so it can handle both LAN and guests. First change eth1 in VLAN1 from untagged to tagged. Also have the switch tag it on your trunk cable. The ports connected to regular LAN devices remain untagged. Then in the LAN network interface physical settings, change from eth1 to eth1.1. It is best to do this while logged in to the router by wifi, in case something gets messed up and Ethernet stops working.
Then you can create a new VLAN for guests. Make it tagged in both the CPU and the trunk port. Create a guest network bridge and attach eth1.3 (if your guest VLAN is 3) to it.