Firewall rule to allow DNS on orange does not work wth CU203

Network DNS
1

My private network consists of RED, GREEN, BLUE and ORANGE zones. A long time ago I created a firewall rule to allow one physical and one virtual machine on the orange net to use the DNS on the green net.

grafik

With CU 203 this rule seems not to work anymore. Requests from both machines are in the firewall log but as far as I can see they do not get any answer.

19:07:24 	INPUTFW 	orange0 	UDP 	172.19.252.252
172.20.99.1 	55216
53(DOMAIN) 		3e:c6:40:03:ba:86
19:07:24 	INPUTFW 	orange0 	UDP 	172.19.252.252
172.20.99.1 	55216
53(DOMAIN) 		3e:c6:40:03:ba:86
19:07:24 	INPUTFW 	orange0 	UDP 	172.19.19.19
172.20.99.1 	46623
53(DOMAIN) 		8c:dc:d4:3c:f4:94
19:07:24 	INPUTFW 	orange0 	UDP 	172.19.19.19
172.20.99.1 	46623
53(DOMAIN) 		8c:dc:d4:3c:f4:94

Do I have to change something?

2

What are your allow rules?
The log shows, that the DNS request packets from your orange devices are blocked by the FW ( chain INPUTFW, which is one of the first chains the pckat is sent to just after receipt ).