NAT Reflection on Opt/VLAN

[tmc]

Trying to configure Opt and VLAN with main LAN.  Goals:
1. Subnets on all 3 cannot access each other.
2. However Ports/Services provided on LAN and used on Opt & VLAN reflect back in using WAN NAT.

If I turn on Rule so Opt/VLAN cannot access LAN subnet directly, Reflection (or SplitDNS) does not appear to work.  If I turn off the Rule then it does.  But we need no access to LAN except through NAT (and Rules created therefrom) and don't want to create 2 NAT/Rule sets

I would guess reconfiguring NAT as Floating Rules would work, but if so (and can someone confirm) what is the "If" interface for the new NAT/Rules (VLAN or LAN)?

TIA!