I have

1) 2830n (Router A)
2) 2820n (Router B)

Both on the correct firmware release

Router A is on 172.21.21.x with a DFGW of 172.21.21.3
Router B is on 172.21.21.x with a DFGW of 172.21.21.1

A and B are connected using a WDS in Bridge mode, WPA2 encryption and MAC address validation.

In Bridge mode, PCs and devices on the 172.21.21.x subnet can see and communicate with each other, regardless if one is connected to Router A or Router B.

I tried to setup VLANs on Router A with different subnets, example
VLAN 0 172.21.21.0 with DFGW .3
VLAN 1 192.168.1.0 with DFGW .1
etc

When VLANs are active and everything's rebooted, you can get from Router B subnets to Router A subnets, but not Router A to Router B. Cannot even ping the DFGW of B from A. I have also checked the WDS status and both A and B show them as Up (U status).

Any ideas, please?

Many thanks

Not going to work I'm afraid.

When the packet is sent across the WDS link it is stripped from its ethernet frame and is re-encapsulated. This means that it loses its VID tag.

You can access LAN A ok from the WDS link because this is the default setting for the LAN. You cannot access the second subnet because the VLAN tagging is non transferable across a wireless link.

As far as I'm aware this is a fundamental problem inherrent to the connection type, I'm happy to be proved wrong though.