Anahaym wrote

yes, with the default VLAN 4 it works, but if I assign other IP range (for example 10.10.10.0/24) on the computer - it works too.

I need to allow only the 192.162.102.0/24 network. Otherwise, VLAN makes no sense...

Not sure what you mean. A VLAN just isolates Ethernet traffic to certain ports from Ethernet traffic to other ports, which are not member of this VLAN. Of course it works with any subnet IP used in this virtual LAN if there are at least two devices communicating to each other using an IP from this subnet.

Also make sure that the VLAN 4 member ports are not members of any other VLAN (including the default/system VLAN 1).

Anahaym wrote

I thought that PVID is used when no VLANs assigned to the port in VLAN Config Tab.

[Updated 02/2020 to include new settings in more modern firmware versions for TP-Link switches.]

No. According to the standard, any port of a managed switch must always be a member of at least one VLAN, let's call it "Port VLAN (PV)" (sometimes also called "Native VLAN" or "Primary VLAN"). The ID of the PV is the "Port VLAN ID (PVID)", which every switch assigns any port (wether you can see/change it in the UI or CLI is another question, but I bet on Cisco switches you can do so as well).

In other words: If you have only one VLAN, it's the one you usually call "LAN" and the "real" VLAN exists only in the switch. Often, switches use VLAN ID 1 as PVID for this so-called "default", "system" or "native" VLAN. All Ethernet frames come in untagged, get assigned VLAN ID 1 and leave any port as untagged frame again. This is the reason why in default settings of TP-Link switches all ports are members of VLAN 1 with PVID=1 and are marked "untagged".

Now for tagged ports: According to the standard, a port can be member of more than one VLAN. It still has the first VLAN as its Port VLAN, which will be used for untagged frames.¹

¹ Note that the standard does not differentiate between ports which are in one VLAN and ports which are in more than one VLAN. They all are just ports, they can be member of any VLAN, they can be set to tagged/untagged and they have a Port VLAN ID (PVID). In daily life ports are differentiated and are called "access port" (if untagged) or "trunk port" (if tagged).

The PVID also plays a role for tagged (trunk) ports: If untagged Ethernet frames arrive on a trunk port, they are assigned the PVID of this port. If Ethernet frames tagged with the PVID are being forwarded to a trunk port, they can either go out as tagged (unchanged) or untagged (because it's the Port or Native VLAN for this port) depending on the policy or setting of the switch.²

² Older TP-Link switches had three settings: ACCESS port (untagged), TRUNK (PVID retained on egress) and GENERAL (frames with VID = PVID either removed or retained on egress according to an Egress Rule). On newer switches such as the T1600G-28TS which do not differentiate between TRUNK and GENERAL, you just need to set the port's membership of the VLAN as a tagged member for the Port/Native VLAN (TRUNK behavior) or as an untagged member (GENERAL behavior). In other words, trunk ports allow for an Egress Rule without needing to set the port type to GENERAL.

Long story short:

In most of my networks I want only tagged traffic over trunk links, so I use the (elsewhere unused) VLAN 1 as the System (Default/Native) VLAN for untagged traffic and unused ports. But there are no devices connected to VLAN 1. It just exists in all of my switches to "drop" untagged traffic, which might be injected by someone plugging a computer to a trunk port of a switch (note that newer TP-Link firmwares allow to drop untagged traffic arriving on a trunk port using a setting "Accepted Frame Types").

• Trunk ports and unused ports thus are also members of VLAN 1 and always have their PVID set to 1.
• Access ports are members of one VLAN only (starting with VLAN ID 2), so their PVID is this VLAN's ID.

If you need VLAN 1 for a real subnet, then assign another VLAN ID to your System (Default/Native) VLAN, e.g. 100. Use this as PVID for trunk ports and for unused ports to absorb untagged traffic arriving on trunk ports.