Hmm there is a lot of „any in .“ sent to the forwarder. What about to block all dns traffic besides the known external ips from the nodes automatically. Or is there anything I have not thought of