Trust No Packet: DNS Queries Can Be Your Firewall’s Weakest Link