Thanks.
I've added to the mix : queues and scheduled rules ....

I hope Google translate will do the job :

Backup your pfSense config. So from now on, you can go back the what you have right now.

Then : console menu option 4 - Factory defaults.

From now on, you have to respect one rule : change only the admin password. Change nothing else.
I make a special note for DNS : don't remove add change anything. Out of thne box, the resolver works just fine.

Do some testing and conclude that everything works fine.

Now, you have a choix :
Import the backed up config. And then goto here, as you're back to square one.
Or : add your own changes one by one, each step separated by extensive testing.
As soon as you detect that something 'fails', you know where it went wrong.

Address: 172.16.24.1

That is your pfSense LAN IP, right ?

And no answer came back ?

Can you post your LAN firewall rules ?
Like :

Unbound is listening on the LAN interface ?
Like :

Server: UnKnown

that points to a problem to be honest, is that not pfsense? pfsense should always be able to resolve its own name.

nslookup www.google.com
Server: UnKnown
Address: 172.16.24.1

I wouldn't trust those idiots with anything.. VPN service intercepting something as basic as dns is not what they are suppose to be about.. Most people use a vpn to make sure their isp isn't seeing or intercepting their dns..

would say your dns is borked.

Wasn't NordVPN intercepting 'all DNS' requests as seen in some recent forum threads ??
And now it is replying with Pure-BS ?!

@stephenw10 Don't need to go that far, we've got all the resources on board : https://forum.netgate.com/topic/186580/dns-suddenly-broken-on-some-vlans/60?_=1726676960650

That 103 address is a packethub IP.. But as so eloquently stated by @Gertjan 192.0.0.88 is not google.. hehehe, still giggling.. Love it!

He ? what ? where is nordvpn coming from ?

The thing is : that IP is, IMHO, not Google ...

hahaha - yeah I would concur.. that is not google ;) hehah

Address: 103.86.96.100

Who is that 103.86.96.100 ?
Not your pfSense, right ?

What was the DNS IP your PC got from pfSense (see the ipconfig /all command shown above )?
More something like 192.168.1.1, right ? wrong ?

edit : anyway, your PC got an answer : 192.0.0.88 so that must be Google. That's all a browser needs to connect to 'Google : that IP.
The thing is : that IP is, IMHO, not Google ...

nslookup www.google.com

nslookup www.google.com
Server: UnKnown
Address: 103.86.96.100

Risposta da un server non autorevole:
Nome: www.google.com
Address: 192.0.0.88

You should do the test on a device that is attached to the pfSense LAN.

Example : on windows PC :

nslookup www.google.com

example :

C:\Users\Gauche>nslookup www.google.com
Serveur :   pfSense.bhf.tld
Address:  2a01:cb19:dead:beef:92ec:77ff:fe29:392c

Réponse ne faisant pas autorité :
Nom :    www.google.com
Addresses:  2a00:1450:4006:80c::2004
          142.250.200.196

Btw : "2a01:cb19:dead:beef:92ec:77ff:fe29:392c" is my pfSense LAN IP.
Also known as "192.168.1.1" in the old days.

Do you see an answer from 127.0.0.1

yes

Was this a Yes, I did this from my device, like a PC, and I ran "nslookup" and it worked just fine.
Or Yes, .... but I did something else but I can't tell you what I did
Or Yes, I have these tools
Or Yes ....

?

If you can ping an external ip, and you can resolve the some external fqdn to its IP.. What exactly is not working?

use your fav tool, nslookup, dig, host, doggo, etc. etc.

To see if the resolver is working pfsense.. you could use the dns lookup tool, in pfsense diagnostic.. Do you see an answer from 127.0.0.1

When you add a bridge you may need more firewall rules. What rules have you added?