VLAN tagging in a nutshell:
- When a port must pass traffic from only one VLAN, the port is untagged on that VLAN
- When a port must pass traffic from multiple VLANs, the port can be untagged on one VLAN (the port's "native" VLAN) and must be tagged on all additional VLANs
- Very few PC or other egde device NICs can do 802.1Q, so edge ports generally are untagged members of one VLAN only, and links interconnecting network devices are tagged in additional VLANs
The picture only appears to show your Netgear configuration, but not the physical topology. If your Firewall has 2 ports (LAN and Internet) it should be physically connected like this:
.----------.
| INTERNET | .------------------. .--------.
| ROUTER =-----= WAN FW LAN =-----= SWITCH |
| | '------------------' '--------'
'----------'
So only one cable between the FW and the switch, VLANs created on the switch and LAN port of the FW. The link between switch and FW LAN port should be the one tagged, all edge ports untagged to whichever VLAN they belong to.
If you are running your firewall's Internet connection through switch port 1, have office PC connected to ports 2-4 and ports 1-4 are on the same VLAN on the switch, the firewall is not protecting your office PCs.