Re: more on my question : DNS answers blocked?

[Daniel Hartmeier]

Looks like the blocked packets were IP fragments. For stateful
filtering, IP fragments must be reassembled, try adding

  scrub in fragment reassemble

at the top of your ruleset.

Daniel