add nft rule forwarding udp dns requests to tor

CHANGELOG.md

@@ -5,6 +5,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- when running entrypoint as `uid=0`:
+  add `nftables` rule forwarding udp dns requests (port 53) to tor
+  (alternative for less flexible `docker run --publish 53:9053 …`)
 
 ## [4.2.0] - 2021-04-30
 ### Added

entrypoint.sh

@@ -4,7 +4,10 @@ set -e
 
 if [ "$(id -u)" -eq 0 ]; then
     nft add rule ip nat PREROUTING ip protocol tcp fib daddr type != local counter redirect to :9040 \
-        || echo 'failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
+        || echo 'warning: failed to configure nftables for transparent proxy (missing CAP_NET_ADMIN?)'
+    nft add rule ip nat PREROUTING fib daddr type local udp dport 53 counter redirect to :9053 \
+        || echo 'warning: failed to configure nftables for DNS proxy' \
+                '(alternative for less flexible `docker run --publish 53:9053 ...`)'
     exec su -s /bin/sh tor -- "$0" "$@"
 fi