I'd intercept port 53 traffic for UDP and TCP, that way it doesn't matter what the IP is. I don't know about consumer stuff, but a dst nat rule should work.