The point here is that the VLAN30 interface is a sub-interface of the LAN port. But, the policy needs to allow traffic from "VLAN30" to "DMZ" interfaces, not from "LAN" interface.
Then, allow PING on the DMZ interface (in the interface setup).
BTW, take great care that there is no policy from DMZ to VLAN30 if the DMZ is a real DMZ. This would be a 'best practice'.
"Kernel panic: Aiee, killing interrupt handler!"