Do your allow rules on LAN use a source of "*" or a source of "LAN net"? The latter is strictly the single locally connected network on the LAN interface. So if you are using that you might want to change it to "*" or create an alias that contains all your VLANs and use that.