VLAN misconfiguration

[AndrewZ]

Hello everyone

I'm running RT-AC66U with 380.62_1 and following the examples found in this forum to build SSID-to-VLAN mapping.

Setup is pretty straight forward: AP--trunk--Switch--trunk--Router

Port 4 on AP is configured as a trunk with 2 VLANs - vlan1 for default private Wi-Fi and vlan3 for Guest Wi-Fi.
The problem I see that Guest Wi-Fi simply works as it should, but for some reasons my regular private Wi-Fi clients are hitting the router on vlan3 (which is guest) and not on vlan1 (which is private). Private clients get associated with the right SSID, then DHCP works as it should on the right VLAN, then the 1st packet after the IP is assigned is sent over the wrong VLAN. Confirmed running tcpdump on the router port.
Here is the script I'm using:

#!/bin/sh
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"

robocfg vlan 1 ports "4t 8t"
robocfg vlan 3 ports "4t 8t"
vconfig add eth0 3
ifconfig vlan3 up

brctl addbr br1
brctl addif br1 vlan3
brctl delif br0 wl0.1
brctl delif br0 wl1.1
brctl addif br1 wl0.1
brctl addif br1 wl1.1

ifconfig br1 up

nvram set lan_ifnames="vlan1 eth1 eth2"
nvram set lan_ifname="br0"

nvram set lan1_ifnames="vlan3 wl0.1 wl1.1"
nvram set lan1_ifname="br1"

killall eapd
eapd

Some diagnostics output:

admin@RT-AC66U-xxxx:/tmp/home/root# brctl show
bridge name  bridge id  STP enabled  interfaces
br0  8000.xxxx  no  vlan1
                     eth1
                     eth2
br1  8000.xxxx  no  vlan3
                    wl0.1

admin@RT-AC66U-xxxx:/tmp/home/root# robocfg show vlan

VLANs: BCM53115 enabled mac_check mac_hash
  1: vlan1: 4t 8t
  3: vlan3: 4t 8t

Any suggestion or recommendation?
Thanks!