I hope this makes sense. Others might be able to explain it better.
In addition to that, think of VLANs as if they were literally separate physical networks connecting nodes together (a non-virtual LAN). If you had that, you'd have to have separate NICs/ports in every devices for each of the physical networks to connect into.
In order to avoid that, VLANs allow you to simulate having those separate physical networks, while sharing ports/NICs. To make that work, the packets have to have identifiers (badges, as above, or VLAN tags) to indicate which VLAN they belong to, so the devices can make decisions about how to handle them.
So to expand on the 'bouncer' metaphor above, which applies to both switches and hosts... on a switch, once the bouncer has a allowed a packet in, the switch has to decide which other ports (if any) that packet should be sent out on. As it sends the packet out on each of those ports, it either applies or removes a suitable badge so that the device on the other end of that link (which has its own bouncer) will be able to handle the packet when it arrives.
It's also important to understand that *inside the switch* all packets have tags (badges), always. If a packet arrives on a port without a tag, and the bouncer allows it in because that port allows incoming untagged packets, the switch will apply a tag to that packet (the 'default VLAN' on that port) so that the packet can then go through the process described above. If the packet then gets sent out on a port which uses the same default VLAN and doesn't require tags, that tag will be removed and the packet will leave the port without a tag. This is the default (out of the box) configuration of a switch in most cases: packets arrive without tags, they get 'tag 1' as they enter, and 'tag 1' is removed as they exit.
