Need to allow only a few networks/IP blocks for DNS request

Hi

We are using an LTM iRule and is applied to the Virtual Server. I have not found whether or how SNAT can be done on client side.

I have also tried with the trigger "when DNS_REQUEST" and found no hit on that iRule and traffic is processed as is. This iRule is applied on the Virtual Server, the IP which clients are using as their DNS.

when DNS_REQUEST {     
         Previously it was CLIENT_ACCEPTED 

if { [matchclass [IP::client_addr] equals TrustedAddresses] }{

        Uncomment the line below to turn on logging.
        log local0.  "Valid client IP: [IP::client_addr] - forwarding traffic"
        forward
} else {

    Uncomment the line below to turn on logging.
    log local0. "Invalid client IP: [IP::client_addr] - discarding"
    discard
}
}

I am logging whether its allowed or discarded. When I was using CLIENT_ACCEPTED, I could see in logs as.

"Valid client IP: (one of the self IP) - forwarding traffic"

Our expectation is to see "Valid client IP: (one of the client IP) - forwarding traffic"

Thanks