A VLAN is a broadcast domain, not a firewall
Putting hosts in different VLANs splits one switch into separate broadcast domains, and that is the whole trick: a broadcast in VLAN 10 is never seen in VLAN 20. It also means traffic cannot cross between them on its own: something has to route it. Turn the router on in this lab and the same two hosts start talking; leave the guest VLAN walled off and they still do not, because separation and routing are two different decisions.
Learn the idea behind the lab
This lab is the practice; VLANs & trunking explains tagging and trunk links.