redirect works with a port forward rule. port 53 UDP/TCP to not this firewll → IP_OF_THE_FIREWALL port 53 add a pass rule to allow TCP/UDP 53 to this IP if not generated automatically

restriction: pass tcp/udp 53 to “this firewall” block tcp/udp 53 # note that this is usually not needed as there is a default block.