firewall rules are not working for some vlans

[o2cool]

I am trying to set up a new router box and for some reason I cannot get dns to work on some vlans. I am trying to use the rule interface: source this net any port, dest this addr dns(53) port and it works for some vlans but not others unless i change dest to any which bypasses the need to separate vlan traffic. This is with unbound and allowed on all interfaces. I tried using a single network for dns and that didn't work either. Any suggestions? subnets range across all RFC1918 address space. I am building a network for home and work needs for qa testing. I am running lacp (3 port) to the main switch, and I am thinking of using the 4th port as a master for the webui, dns, ssh, all opnsense services and just use the lagg as inter-network and wan traffic. I have the firewall set up in hybrid mode, no auto reflection options.


Suggestions?