I'm trying to control which IP address I use for DNS based on the domain string. I'm on Fedora with firewalld and have tried the command:firewall-cmd --direct --add-rule ipv4 filter PREROUTING 0 -t nat -p udp \--dport 53 -m string --algo bm --hex-string '|06|<example>|03|<com>|' \ -j DNAT --to-destination a.b.c.dI'm certain that I've used the correct value for the hex string and destination IP. The rules do show up when I list the nat table, but tcpdump shows no traffic for the destination IP. Is nat the correct table for this or should I be using filter? Or possibly something else?Also, I have no idea if there's a way to clear out the rules that haven't been flagged with --permanent. I could likely just reboot, but that doesn't seem necessary.
Forwarding DNS traffic for specific domain
iptables;dns;firewalld