Hijacked DNS timeouts

[trendy]

SNAT/Masquerade is only necessary when in the same zone, so the Pihole will not respond directly to the host and trigger the "reply from unexpected source".

Block and Redirect DNS to PiHole

You are right! I tried the masquerade rules (initially I thought you were saying about the wan postrouting masquerade) and now replies back to clients seem to come from the legitimate nameserver. Regarding IPv6 why are you trying to masquerade on the wan? Any host contacting some other host on the internet should use the GUA, not the LUA. I also fixed the reply from unexpected source for ipv6 just with this: ip6tables -t nat -A POSTROUTING -d fd00:bbbb::2 -p udp -m udp --dport 53 -m comment --…