While you can configure your machine to tag traffic with a VLAN ID (there's usually an option somewhere in your OS's network settings) often you won't configure anything vlan related on your machine and will configure vlans on the switch. If a port on a switch is configured as "untagged" any packet passing into that port (where the traffic doesn't have a vlan tag) will have the vlan tag added to it. When the traffic leaves an untagged port, the vlan ID will be removed. In this case you're pretty much just using VLANs to divide a single switch into multiple separate switches.
With tagged ports, they won't change the VLAN tags on packets entering or leaving the ports, however they will only permit traffic which has a VLAN tag that the port is tagged with. You would use a tagged port to carry traffic which is already tagged such as when connecting devices which already tag their traffic or when connecting switches together in order to carry multiple VLANs between switches. You can also get other types of devices that produce tagged traffic such as VoIP phones (which can tag their traffic to differentiate it from traffic from a connected PC, see below) or from a wireless access point which may broadcast multiple different networks on different VLANs. You would configure the VLANs that the device should tag traffic with in the settings on the device itself.
To give a rough example of how these may work together. Say you're in an office with a pair of switches which should be connected together to act as one big switch. You have two VLANs - VLAN 100 is for "office PCs" and VLAN 200 is for "voip phones" in order to keep VoIP traffic separate from PC traffic. Quite often with VoIP phones, in order to save ports on the switch, you can plug the phone into the switch and then plug your PC into the phone. In this sort of environment, the phone will tag its own traffic with a VLAN ID (200 in this example) and pass traffic from the PC without modifying it (so it won't have a vlan ID). You would then configure the switch port that the phone (and therefore the PC) is connected to to be untagged for VLAN 100 and tagged for VLAN 200. This means that the traffic originating from the PC (which doesn't have a vlan tag, i.e. it's untagged) will be tagged with VLAN 100, traffic from the phone (which will already be tagged with VLAN 200) will be allowed to pass. If the port wasn't tagged with VLAN 200, the traffic from the phone wouldn't be allowed to pass and would be dropped. Then, the ports that link the two switches together would be set up as tagged for all VLANs on both switches so that traffic for all VLANs will be carried between the switches, this is often known as a "trunk" port.
What you would then often do is configure a port to be "tagged" for all VLANs and connect this to the router. The router would then be configured so that each VLAN would show up as a separate network interface on the router. The router can then be configured to route between VLANs and to firewall traffic from each VLAN as appropriate.
