Yes on router with packet sniffer. So basically it performs NAT… now is this because DSTNAT rule in general or because initial packet dst ip (8.8.8.8) is not in same subnet (LAN bridge subnet) of DSTNAT to-addresses IP? I will check behavior when DSTNAT is performed on IP within same subnet (it should be triggered for any IP not in DNS address list and port 53).
Edit:
Actually DSTNAT never gets triggered if dst IP is on same subnet (which makes sense), if case is needed to hairpin NAT for dst IP in same subnet, to-addresses IP must be on other subnet…