This stumped us for hours. You can’t configure a VLAN ID on the WAN interface. The dialogue box is there, but it’s greyed out. Eventually in frustration, I configured the WAN interface as an untagged, DHCP client interface, intending to connect it to the provider-supplied router.
After configuring a WAN interface, only then did it become possible to add a sub-interface, which permitted me to specify a VLAN ID.
So, happy ending. My friend has his SME router running dual-SSID, VLAN-isolated networks, happily connected to his new fibre provider.
If you found this useful, please share it and follow me on Twitter - I'd love to connect ;)
David Young HOWTO