Flashstart bypass: bypassed IPs still redirected to catch-all DNS rule

[Tbaile]

Steps to reproduce

• Add hosts to the IPSet for Flashstart bypass.
• Enable Flashstart ProPlus
• Observe that DNS requests from these hosts are still redirected to port 53 of the firewall, not bypassed

Expected behavior

• Hosts in the Flashstart bypass IPSet should bypass DNS filtering and send DNS queries freely without being caught by the catch-all rule

Actual behavior

• DNS traffic from hosts in the bypass IPSet is still being redirected to the firewall, not bypassed.
• Catch-all rule incorrectly applies to bypassed IPs, especially after updates or profile changes.
• Manual workaround is required to restore intended behavior after rules are lost.

Components

• ns-flashstart 1.0.2

See also

• Mattermost discussions:
  • https://mattermost.nethesis.it/nethesis/pl/ircupfsbbt8amqg55csxzkopwh
  • https://mattermost.nethesis.it/nethesis/pl/b693tgzd6tdnjnu1ffmb38r9hr
• Helpdesk tickets: https://helpdesk.nethesis.it/a/tickets/193146

[Tbaile]

QA: check that the issue is not reproducible with latest DEV build