Nihsa wrote

Why can't i get acces to internet on these VLAN ?

Because the port connected to the router isn't a member of VLANs 10, 20 and 30.

You could assign one port connected to the router to VLANs 1, 10, 20 and 30. PVID is 1. All other ports are members of the individual VLAN (10 or 20 or 30) and have the corresponding PVID. So, all frames arriving on ports in VLANs 10, 20 or 30 are tagged with the corresponding PVID and are being forwarded to the router. Responses from router are tagged with PVID 1 and are being forwarded to all VLANs.

Note that such a setup still uses a common broadcast domain over all VLANs.

A truly isolated setup would be to use a VLAN-aware router using a trunk port to the switch, three different subnets assigned to three VLANs on the router (yielding three separate broadcast domains) and switch ports with membership in only one VLAN (10, 20 or 30), but not in Default VLAN 1. The router's firewall setup would then block inter-VLAN traffic and allow access from each VLAN to the Internet. This will effectively isolate all three subnets.

Rduhb wrote

My problem is after I created a couple of VLANs I can't access the switch from any of the ports in the VLANs.  Any thoughts?

You could create a virtual interface for each VLAN. But you need different IPs for each interface, which is normally no problem since usually every VLAN is assigned an unique subnet. The switch's UI then can be reached through the IP of the virtual interface.

Rduhb wrote

But the router is connected to port 1, which is included in each vlan.  Unless you’re referring to the actlan port on the router.  

A port can not be "included in each VLAN". A port can be a member of one or more VLANs and in order to get Ethernet frames from other VLANs, the port must be a member of those VLANs, too. Thus, a VLAN could include each port (which makes it the Default or Native VLAN), but not the other way around.

The PVID of the port decides which VLAN ID is used to tag an Ethernet frame with on ingress. So, ingress frames on port 1 must be tagged with VLAN ID 1 (or any other VLAN ID) by either the switch (if it receives "untagged frames") or by the connected router/server/laptop (then it receives "tagged frames") and to get forwarded inside the switch to other ports those other ports must be members of VLAN 1 (resp. any other ID choosen for the VLAN), too.

The point regarding the thread opener's setup is that for egress frames on port 1 being forwarded from other ports, which can be tagged either with VLAN ID 10, 20 or 30, port 1 must also be a member of those VLANs in addition to its Primary VLAN 1, which makes up its Primary VLAN ID (PVID). The other ports also have a Primary VLAN; it's PVID 10 for VLAN 10, PVID 20 for VLAN 20 and PVID 30 for VLAN 30. They are by default members of VLAN 1, the Default VLAN.

No idea, though, what an "actlan port" should be.

Rduhb wrote

Sorry, that was a serious typo.  Meant to say "...actual port...".  Thanks for the help!!!  I've got a lot of research and studying to do.  

You're welcome. Good guides for VLAN can be found here:

Ethernet Switiching FAQ

Configuring 802.1q VLANs

Hope this helps!