AdGuard: Port 5310 ist closed -- why?

[white-rabbit07]

Hi.
I don't know if this is a "bug or a feature" but I have a problem using AdGuard on Port 5310.
As you can see here, AdGuard is installed an listening on port 5310 in these subnets:

Next thing I tried was a nmap-test if port 5310 is open (from my management network):

-- worked.

After that I tried to use AdGuard with dig -- worked:

And then the problems began:
The same test from a client in my WiFi-Subnet showed that the port is closed. Why?

The last test was a "regular" DNS-Test with Wireshark on port 53 which was no problem:

And finally the DNS-Request on port 5310 with Wireshark:

The Client-IP is registered in the AdGuard-WebUI. So: What's the problem here?
Thanks for any hint.

AdGuard Home Version: v0.107.54 -- running as a plugin on OPNSense 24.7.5_3

[white-rabbit07]

hm -- is it really that simple: just a missing firewall-rule like this one?