gluon-firewall: reject DNS queries from br-client (they should be accepted on local-node only)