I'm seeing some things in Wireshark I can't explain. My setup is as follows: A router with a single global IP doing NAT for the devices behind it. I am also behind it with my computer. I port forward port 53 external port to my computer also on port 53 in the router (as an experiment).
From that point on, no-one in the network can do NS resolves anymore. Not even me. But the weird thing is that I'm seeing everyone their NS lookup queries in Wireshark arriving on my computer.
Can anyone explain this? I thought that port forwarding was meant to only apply on traffic coming from outside the NAT. It seems like the internal traffic is also being relayed to me. Is this a bug in the router? This seems like a huge security hole.