VLAN Tagging

This router supports VLAN tagging which allows for various advanced networking setups. In particular, VLAN tagging can be very useful when only a single Ethernet cable goes from a room to another, and you need to have different kinds of network traffic going through this cable (ie, WAN and LAN for instance).
In addition, the router supports VLAN tagging on the WAN port, which basically means the WAN port can be used both for WAN (public Internet) traffic and LAN traffic. However, this feature is probably quite new and may be subject to some bugs. I managed to achieve the result I wanted but the behavior was very strange (the same exact setup worked, then completely failed - the LAN devices were not pingable from the router).

Setup

You need to follow the exact steps described on this Asus page. They use as an example the exact setup I wanted to achieve (a single Ethernet cable linking the distribution room with a switch to a router that is placed in a more central area of the house).
You will need a smart switch, ie a switch that can be configured and that supports VLAN tagging as well. I used the TP-Link TL-SG108E model.
In my case, I decided to use port 1 of the switch for the WAN traffic (so port 1 was connected to the modem), ports 2-5 for LAN devices and ports 6-8 were reserved on the default VLAN. Here is the configuration of the switch:

Apparently you would need to separate the different VLANs you configured with separate sub networks. I don't know exactly how to achieve that properly yet (if at all possible with the Asus router), but I managed to get what I wanted without it in the end. In my cases, all devices should actually be reachable by any other.
Maybe what made the setup work in a more permanent way was to activate VLAN on the router not only on the WAN configuration page but also on the LAN configuration page. On the Asus web configuration, you need to access the tab named "Guest Network Pro". I created two guest networks, including one with VLAN tagging (and ID 3). It's not logical that this was requested, but again, this may be needed because of bugs in the router firmware.
Another option would have been to use another smart switch on the end of the single Ethernet cable linking the switch to the router (although in this case, VLAN tagging on the WAN port, and even VLAN tagging altogether, does not need to be supported at all by the router, so it's a bit stupid to use an extensive router with this setup).