求教 openwrt 单臂路由实现 vlan 互通配置问题

家里两台 NAS 分别接入了两条宽带上网,因为不想把两个 NAS 接入同一个局域网,所以分别接入了两个 vlan ，但是又想实现两个 NAS 能互访，查找了相关资料和 deepseek 可以通过配置单臂路由实现两个 vlan 互通

单臂路由为一个玩客云 openwrt 版本为 23.05
/etc/config/netwrok 文件如下:
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fdac:8a2b:a0df::/48'

config interface 'lan'
option device 'eth0'
option proto 'static'
option ipaddr '192.168.2.2'
option netmask '255.255.255.0'
option ip6assign '60'

config interface 'docker'
option device 'docker0'
option proto 'none'
option auto '0'

config device
option type 'bridge'
option name 'docker0'

config device
option type '8021q'
option ifname 'eth0'
option vid '3'
option name 'eth0.3'
option ipv6 '0'

config device
option type '8021q'
option ifname 'eth0'
option vid '4'
option name 'eth0.4'
option ipv6 '0'

config interface 'vlan3'
option proto 'static'
option device 'eth0.3'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'

config interface 'vlan4'
option proto 'static'
option device 'eth0.4'
option ipaddr '192.168.1.1'
option netmask '255.255.254.0'

/etc/config/firewall 内容如下:
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option flow_offloading '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'

config include 'nikki'
option type 'script'
option path '/etc/nikki/scripts/firewall_include.sh'
option fw4_compatible '1'

config zone 'docker'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option name 'docker'
list network 'docker'

config zone
option name 'vlan3_zone'
option network 'vlan3'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'

config zone
option name 'vlan4_zone'
option network 'vlan4'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'

config forwarding
option src 'vlan3_zone'
option dest 'vlan4_zone'

config forwarding
option src 'vlan4_zone'
option dest 'vlan3_zone'

config rule
option src 'vlan3_zone'
option dest 'vlan4_zone'
option target 'ACCEPT'
option name 'vlan3_to_vlan4'

config rule
option src 'vlan4_zone'
option dest 'vlan3_zone'
option name 'vlan4_to_vlan3'
option target 'ACCEPT'

config rule
option name 'Allow-ICMP'
option src '*'
option proto 'icmp'
option target 'ACCEPT'

网络布置如下:
https://imgur.com/a/mj5xD60

现在这个配置 vlan3 和 vlan4 还是 ping 不通求高人指点