DNS servers in firewall VMs bypass the Qubes OS firewall

[3hhh]

Handling DNS traffic locally via a DNS server inside a firewall VM bypasses the Qubes OS firewall.
So even if the Qubes OS firewall explicitly disallows DNS requests from an upstream VM, the DNS requests of that VM will be answered by the locally running DNS server.

This happens because the Qubes OS firewall only hooks forwarded traffic, but not input traffic (i.e. locally handled traffic).

Unfortunately, since the Qubes OS firewall only calls user scripts before it creates its VM-specific rules, I currently cannot fix this in an elegant way.
I'll see whether the Qubes OS behaviour can be changed so that this issue becomes fixable.