Take a look at my posts in this thread - https://community.roonlabs.com/t/roon-across-vlans/262545/7
I have a rule on my UDM Pro to allow establised and related replies from a group of IoT hosts (Roon/Sonos etc) back to the private VLAN where my i-devices live for controlling music playback.
I also allow multicast DNS between the VLANs so that client apps can find devices on the IoT VLAN.