I have a Destination NAT rule which is assigned to the Untrusted interface group. This group includes the guest interface and IoT interface. The rule is meant to convert DNS requests which aren't destined for the local DNS server to be redirected to that server. The PC I'm using is on the LAN interface (not untrusted). The DNS server itself is on the LAN interface as well.
When I have the rule set to match on source != DNS_SERVER_IP the rule works fine. If I change the source to "any" the DNS server starts fail in its requests to the upstream DNS server (which is just a public DNS server). So it seems like requests from the DNS server are being redirected back to that same server, thus failing. But, this makes no sense to me because the DNS server is NOT in the untrusted interface group, so the NAT rule shouldn't apply.
What is going on?
Source: r/opnsense · by /u/kohbo