Basic VLAN setup

Question

I want to create a closed network (Vlan 1010) with internetaccess but I am new to tagged and untagged ports. I have a Netgear switch. This is my current setup:

• TG = Firewall WAN
• Office = Office network with default gateway to internet
• TG LAN = Firewall LAN
• SM + GM = Devices

The untagged and VLAN1010 are connected by the Firewall. Will my vlan 1010 network be able to get internet access through the firewall with this setup?

Answer 1

VLAN tagging in a nutshell:

• When a port must pass traffic from only one VLAN, the port is untagged on that VLAN
• When a port must pass traffic from multiple VLANs, the port can be untagged on one VLAN (the port's "native" VLAN) and must be tagged on all additional VLANs
• Very few PC or other egde device NICs can do 802.1Q, so edge ports generally are untagged members of one VLAN only, and links interconnecting network devices are tagged in additional VLANs

The picture only appears to show your Netgear configuration, but not the physical topology. If your Firewall has 2 ports (LAN and Internet) it should be physically connected like this:

.----------.
| INTERNET |     .------------------.     .--------.
|  ROUTER  =-----= WAN    FW    LAN =-----= SWITCH |
|          |     '------------------'     '--------'
'----------'

So only one cable between the FW and the switch, VLANs created on the switch and LAN port of the FW. The link between switch and FW LAN port should be the one tagged, all edge ports untagged to whichever VLAN they belong to.

If you are running your firewall's Internet connection through switch port 1, have office PC connected to ports 2-4 and ports 1-4 are on the same VLAN on the switch, the firewall is not protecting your office PCs.

Answer 2

Your configuration should function properly if:

1: Your VLAN Layer3 interfaces are properly configured on your firewall 

2: Your NetGear switch has proper tagged, untagged and PVID values set for its ports: 
    2a: Ensure that "Untagged VLAN" and "PVID" values are set: the PVID value is the second half of VLAN membership for ports on NetGear switches. 

    2b: Ensure that the firewall understands the difference between the VLANs, (for example, with a 802.1q trunk and tagged / native VLAN functionality between the switch and firewall).

Answer 3

thank you very much for both of your anwsers @PantherModern and @Arimo. I was able to solve it fairly easy, the issue turned out to be when you have a NetGear router you have to make sure all untagged ports on your custom vlans are given the correct PVID. When I did that, there was no issues. I appreciate all your help, and by that I was able to understand my situation better. I wish you a great day.