Professional Network Engineers who are used to enterprise-grade kit and the standard Berkeley CLI do not understand SoHo VLAN configuration.
We expect that once a VLAN exists in the database, and a port is set to either be tagged or untagged in that VLAN, that we're done. "conf t; int etX; switchport access vlan X; switchport mode access; no shutdown; end; wr" aaaand profit. But noooo.
Alas, SoHo-grade gear is not your friend. You find the VLAN configuration page, you set your ports to be tagged or untagged for the VLANs you wish to allocate, but things don't work right on the untagged ports. They just don't appear to be a part of the VLAN you specified!
So, what do? What is the missing magic?
PVID is the key. It stands for Port VLAN Identifier. Search the documentation for your switch of choice and how to correctly set this value. Once done, commit your changes and observe that your ports work as expected. The setting maps untagged frames into a VLAN when received by the switch; your ports lacking a non-default PVID config are likely all set to a PVID of 1, and therefore all your untagged ports are transmitting their traffic into that VLAN.