The One-Line Firewall Rule That Broke DNS for Everything

A single, textbook NAT rule silently rewrote loopback DNS queries' source address, and every application on the machine lost name resolution at once — including the tool being used to push the fix.

July 30, 2026

This article is also available in Traditional Chinese: 中文版 — same content, just a language difference.

A completely standard NAT rule — the kind that appears in nearly every guide for sharing a machine's internet connection — broke DNS resolution for every single application on that machine, immediately, with no obvious connection between "I added a routing rule" and "nothing can resolve a hostname anymore."

The setup, and the rule that looked completely routine

A machine already running a local DNS resolver stub — a small process listening on a loopback address that every application on that machine queries for name resolution — needed a blanket NAT masquerade rule added, to let a newly-configured routing path work correctly for other traffic. This exact kind of rule (rewrite the source address of all outgoing packets to the machine's own address, so return traffic routes back correctly) is genuinely standard practice for exactly this class of problem, and appears close to verbatim in a huge number of networking guides.

Unlock this article to keep reading, or subscribe for unlimited access to everything. See Pricing for details.