Outbound Policy + VLAN bug in 8.5 and 8.4.1

Running 8.5.2 release version, and the bug is back:

One IOT VLAN device (in.touch gecko dongle connected via ethernet) is not getting DNS, even though other devices on the network can get DNS, and can ping this device.

Last time this happened, I did packet captures which looked like this:

no. Time Source Destination Protocol Length Info
453 0.794275 10.0.64.104 10.0.64.1 DNS 82 Standard query 0x1234 A intouch2.geckoal.com
454 0.794441 10.0.64.1 10.0.64.104 ICMP 110 Destination unreachable (Port unreachable)

In other words, the IOT device (on VLAN with address 10.0.64.104) is sending a DNS query to the Peplink, and it appears the Peplink is blocking the request.

I opened a new ticket this morning: 25041234 The device is currently in the broken state with Remote Access enabled.

@sitloongs I hope someone from Peplink can diagnose it this time?