It only blocks IPv4 traffic, so on an IPv6 enabled host it can easily be bypassed without even involving DNS. But assuming an IPv4-only host, on a system using

It only blocks IPv4 traffic, so on an IPv6 enabled host it can easily be bypassed without even involving DNS. But assuming an IPv4-only host, on a system using nscd, DNS lookup is performed over a Unix socket: Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 23 1445 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 owner UID match 1007 # setuidgid outtest ping -n 1 -4 google.com PING google.com (142.250.102.100) 56(124) bytes of data.