All unmanaged swithces is automatically layer 2 devices.
if you have managed switch it doesn't mean that it's L3 device, only if it's routing switch(can do inter-vlan operations without external router/firewall), then you can mention it to be L3 switch.
1. All the trafic what goes in one vlan don't (usually, there is special occasions) go through firewall
2. All the trafic what goes from vlan to vlan go through firewall, unless you have L3 switch doing that for you
3. All the trafic what goes to internet goes through gateway device, that is usually firewall.(same applies to point 2)
Is there anything what need clarification?