@ckdash 

If you have set up the VLAN in both controller and standalone mode and it does not work, then it is not a problem with the router.

@Clive_A   It is a problem with the router if its NOT actually tagging the WAN port on egress.

@ckdash I suggest using the port mirroring functionality to mirror the WAN port to an unused port and then using wireshark on the port to see if the egress data is actually tagged

edit: just noticed this thread https://community.tp-link.com/en/smart-home/forum/topic/608944?sortDir=ASC&page=2 seems there was a beta f/w to fix this issue

  @ckdash 

I've done tests in the controller and stand alone with vlan on the WAN, no problems, but the story doesn't say anything about which firmware you're using, if you don't have the latest then upgrade. If it doesn't work then the problem must be something other than the router.

  @MR.S thanks. I'm increasingly coming to the conclusion that the problem lies "between keyboard and chair". It's not like I'm a novice at this - I've configured loads of routers and networks in my time. 
Ruling things out along the chain:

- ONT: works with Asus XT8 router

- ONT to router cable: same cable works with Asus router, and the port indicator lights show 2.5Gbps connection

So we're now at the router. It powers up, it's happily dishing out addresses to devices on the LAN and it's been adopted by the OC200. 
The screenshots of the config show the same as someone put earlier in the thread.

The firmware is for V1 hardware which my device says it is and is Build: 20240324 which I believe is the latest.

The firmware for the OC200 controller is 1.29.4 Build 20240304 Rel.54362

  @ckdash yes, then you have the latest firmware, then it's checked out :-)
I have an ER707-M2 in a lab and I configured vlan 999 on the switch that is tagged this vlan. then I tested in controller and stand alone against vlan999. this is how the configuration looks in controller mode.

What happens if you connect to a PC instead of a router? have you tried setting vlan on the network card. I use vlan 999 on the test you have to edit to match your vlan

  @ckdash 

can you show me a screenshot of the vlan configuration on the Asus router to?

  @MR.S I can indeed show an Asus XT8 screenshot

  @ckdash 

it looks like it's something else, it's IPTV configuration, do you have a screenshot of the wan settings of Asus router?

you will again find IPTV settings on the Omda controller if you go to services, IPTV

when i test there seems to be something wrong i can't bring up any wan port. the box is empty. on my ER8411 router I can select the WAN interface here.

what happens when you try here?

  @MR.S hi. That's how you set the WAN VLAN on Asus. It is a bit odd. 
You can't do it that way on the TP-Link. You can't set the WAN 1 port to be the IPTV port. 

You can set one of the other ports to be a WAN port, and then allocate that port on the IPTV screen. But I've tried that, and it doesn't work either. 

  @Clive_A 

I can also select WAN interface on ER8411, but I cannot select anything on ER707-M2 or ER706W, I don't know if the problem is controller or router, I use controller version 5.14.20.8 running on windows which is early release.