change the rule to actually allow dns traffic to tunnel nameserver, not gateway