Solution was to add a RETURN in nat/bitmask for every gateway ip.
I haven't tested the Qubes OS code path. Now if connected the nat rules look like this:
tcpdump -ni any port 53
Before you saw traffic to the DNS server (always 10.41.0.1). Now you will see ("Connection to 51.15.9.205 53 port [udp/domain] succeeded!").
We can only iterate once over a generator. After doing, it's like an
empty list. There no real benefit of having it here and we need it in
the future to iterate over the gateways multiple times.
