Let me quickly explain how VLANs work on the wire: A normal ethernet packet does not have a special field for the VLAN id. VLAN packets, on the other hand are a later extension that uses a new packet format which consists of all fields of the old format plus the additional tag, as definined in 802.1Q. So on the same wire, you can have untagged and tagged packets, and the interpretation is that they "just go past each other" and form different "virtual connections" on top of a physical connection.
So what does your switch do when you define a VLAN group with tagged and untagged ports, say
VID=100? If the switch receives packets tagged with
100 on ports 1-4, it will forward them (with the same tag) to (the other numbers in) ports 1-4, and it will strip the tag and forwarded them to ports 5-6. All other tags and untagged packets on port 1-4 are ignored. When it receives untagged packets on ports 5-6, it will forward them untagged to the other port in 5-6, and it will tag them with
100 and forwarded it to port 1-4. All tagged packets received on ports 5-6 are ignored (for this VLAN)
VID=201: If it receives packets tagged with
201 on ports 5-6 or 10-11, it will forwarded them tagged to the other ports in 5-6,10-11 and untagged 7-9 etc.
What it doesn't do is to somehow forward packets "between" different VLANs: A packet tagged with
100 and received on port 1-4 is not retagged with
201 "on port 5-6" and forwarded to the
VID=201 VLAN, and then again retagged with
101 and forwarded to port 12-15.
The IP address that is assigned in the switch plays no role in this at all: A switch works on OSI level 2, where there are no IP addresses.
DHCP issues are also totally unrelated, this is purely networking.
So in your current configuration, there's no connection between VLAN 100 and VLAN 101 (unless you defined a routing table somewhere), they are completely separate, and hence the server and the client can't ping each other.
If you can explain what you want to achieve with your network configuration, I can try and come up with a solution. Something along the lines:
The client and server should always communicate, the left laptop should only communicate with the server and not the client, the right laptop should only communicate with the client and not the server, the laptops should only communicate via IPsec. All computers have only a single ethernet plug.
Usually in this situation you'd use one VLAN for each "separate" connection, so each computer will be part of several VLANs. Note that is purely administrative, and not secure: Nothing prevents any "rogue" computer from pretending that it is on other VLANs as well. So please mention security concerns, if there are any.