We have one router connected to the internet and other port to the clients.
Ether 9 and ether 10 are in a OSPF / BGP setup so forward (=internet) traffic come in (requests) through port 9 and should come back to client though ether10 (response traffic).
Before we just had all traffic (in/out) flowing from/to router over ether10 and the router would catch all dns requests (p56) and reroute to itself (=internal cache) and that worked fine for months.
But today, after we arranged the second link to clients with OSPF / BGP separated up and downlink links with full failover it didn't work any more.
I had to disable the p56 dst-nat rule to make dns resolution possible again.
(I have to say that all clients traffic initially is told to use an dns server outside our network. So dns is not pointing to one of the internal IP's of the gateway router. It points to the internet servers)
Now are the two ports ether 9 end ether 10 both in this router that is also having the dns cache and connect to the internet.
So, I can understand that a dns request pointing to an internet server that comes in at ethernet 9 gets actually 'catched' by the dst-nat rule and is redirected to the internal cache. The router now has to send back an answer to a destination that was the original source address. All router's forward traffic is leaving through ethernet 10.
But this is actaully now 'output' chain traffic. Leaving the router from itself. Maybe the connection tracker has in its registration tables that the request originally entered router from ethernet 9 and thus is send back to that same interface again? Since the OSPFis in charge of the traffic this is now a dead end for this dns response traffic and thus it never makes it back to the client?
I can understand all that, but to be honest have no clue how to solve this apart from enabling the 'forwarding to the internet of dns' again.......
If you need some more info let me know and I'll print these.