The answer is not entirely straight forward, unfortunately.
The short answer is: Don't put any tagged networks through an unmanaged switch.
The longer answer is a bit more complex. Basically, unmanaged switches are not designed to carry tagged networks. This means that the behavior is undefined and may be different from swtich to switch (brand/model or even version of any given model).
You may find the following types of situations, depending on the switch in use (generally it would be just one mode from this list):
- The VLAN tags can pass transparently without issue. So if you have a trunk from your router and then say a VLAN aware AP, this may work just fine.
- The switch does not pass the tagged networks, so only the untagged network will function properly.
- The switch strips the tags and then co-mingles all of the networks. This is a really bad situation because it will give every device access to all VLANs and may also be entirely unpredictable as to what network a given host will join.
- The switch chokes entirely on the tags and doesn't switch traffic normally in general.
- There is also the possibility that the switch operates in an unpredictable manner overall, where you might not be able to say "oh, this switch does x."
Assuming that the tags pass without issue, the other major issue is that there is no way to configure any of the ports. That is to say that all ports become trunk ports -- the same as whatever trunk ports exist at the uplink. This means that all devices that are VLAN aware could gain access to the other VLANs (this is fine when explicitly desired like for an AP, but not good for an untrusted computer, for example). Further, you cannot untag a network that is tagged on the uplink for a normal non-VLAN aware device (i.e. STB, game console, regular computer, etc.) to use... they will only be able to use the untagged network (if any) as it exists on the trunk.
Basically, the unmanaged switch should only ever be tasked with a single, untagged network. If you've got VLANs in your setup, make sure that the port that connects to an unmanaged switch is configured as such (be it a port on a router or a managed switch).
Does that help?