Avoid hijack DNS requests send to loopback

redirect_nftables_rules.go

@@ -537,10 +537,7 @@ func (r *autoRedirect) nftablesCreateDNSHijackRulesForFamily(
 			dnsServer = r.tunOptions.Inet6Address[0].Addr().Next()
 		}
 	}
-	nft.AddRule(&nftables.Rule{
+	exprs := []expr.Any{
-		Table: table,
-		Chain: chain,
-		Exprs: []expr.Any{
 		&expr.Meta{
 			Key:      expr.MetaKeyNFPROTO,
 			Register: 1,
@@ -550,6 +547,24 @@ func (r *autoRedirect) nftablesCreateDNSHijackRulesForFamily(
 			Register: 1,
 			Data:     []byte{uint8(family)},
 		},
+	}
+	if chain.Hooknum == nftables.ChainHookOutput {
+		// It looks like we can't hijack DNS requests sent to loopback.
+		// https://serverfault.com/questions/363899/iptables-dnat-from-loopback
+		// and tproxy is not available in output
+		exprs = append(exprs,
+			&expr.Meta{
+				Key:      expr.MetaKeyOIFNAME,
+				Register: 1,
+			},
+			&expr.Cmp{
+				Op:       expr.CmpOpNeq,
+				Register: 1,
+				Data:     nftablesIfname("lo"),
+			},
+		)
+	}
+	exprs = append(exprs,
 		&expr.Meta{
 			Key:      expr.MetaKeyL4PROTO,
 			Register: 1,
@@ -571,7 +586,6 @@ func (r *autoRedirect) nftablesCreateDNSHijackRulesForFamily(
 			Register: 1,
 			Data:     binaryutil.BigEndian.PutUint16(53),
 		},
-			&expr.Counter{},
 		&expr.Immediate{
 			Register: 1,
 			Data:     dnsServer.AsSlice(),
@@ -581,7 +595,12 @@ func (r *autoRedirect) nftablesCreateDNSHijackRulesForFamily(
 			Family:     uint32(family),
 			RegAddrMin: 1,
 		},
-		},
+		&expr.Counter{},
+	)
+	nft.AddRule(&nftables.Rule{
+		Table: table,
+		Chain: chain,
+		Exprs: exprs,
 	})
 	return nil
 }