@GrizzlyKiwi 

On the switch, the uplink port(to your pfSene) should be Tagged, and all 3 VLANs should contains this port;

Other ports should be untag, but you need to give them correct PVID.

  @GrizzlyKiwi Assuming your "standard lan" is VLAN ID 1, the switch port linked to your pfSense router will be an up-link trunk.  The trunk port should have a PVID that matches the pfSense PVID or untagged VLAN, this is so the switch can get an IP address in the main LAN.  Generally you should also have the switch trunk port's untagged VLAN match the PVID (there are times these don't match but I don't think you are doing that).  Then VLANs 20 & 40 will be tagged.

When you distribute the VLANs out of the switch; if there is only one VLAN on the out port, set the PVID and untagged VLAN to match the VLAN that should go out and set no tagged VLAN.  If there is more than one VLAN out that port (such as an AP) the PVID and untagged VLAN is set to the base network for that connected device, and the additional VLANs as tagged.  An example of this is if you had an AP with a Media SSID and Guest SSID, and VLAN 20 was Media and 40 is Guest, then the PVID and untagged to the AP is 20 and tagged is 40.  The AP will get a default IP address from VLAN 20, and the guest SSID in the AP will need to be set to associate with VLAN 40.

  @JoeSea 

Thank you Joe i will have a look at that tonight when i get home.