In case you want to follow what @pc-coholic wrote dont do it. Its waaaaay around to get access to module. Just tag eth2.7 and use it as your WAN and add separate interface in WAN zone. For example name it SFP select device eth2 and give it IP from the range of module and you will have internet and access to module at the same time. No need to put it in br-lan just to get access to module.
Also check this topic where I fixed 2,5Gbps for that module: