docs(dns): clarify reuse of existing LAN DNS redirect rule

dns/end-to-end-migration-runbook.md

@@ -87,6 +87,9 @@ If these fail, do not proceed to IP swap.
 ## 6) Apply/confirm pfSense DNS enforcement policy
 If not already done, apply forced DNS interception for LAN + VLANs.
 
+If you already have the LAN redirect rule (`LAN`, TCP/UDP, `!LOCAL_DNS`, `53` -> `LOCAL_DNS:53`), keep it and do not duplicate it.
+Only add missing interface rules for `OPT2`, `OPT3`, `OPT4`, `OPT5`, and `OPT6`.
+
 Reference (fast entry):
 - [pfsense-forced-dns-quick-entry.md](./pfsense-forced-dns-quick-entry.md)
 

dns/pfsense-forced-dns-all-vlans.md

@@ -33,6 +33,8 @@ Path: `Firewall > NAT > Port Forward`
 
 Create 6 rules, one each on: `LAN`, `OPT2`, `OPT3`, `OPT4`, `OPT5`, `OPT6`.
 
+If LAN rule already exists and matches these fields, keep it and only add the missing VLAN rules (`OPT2` to `OPT6`).
+
 Use these exact fields for each rule:
 - Interface: `<that interface>`
 - Address Family: `IPv4`

dns/pfsense-forced-dns-quick-entry.md

@@ -13,6 +13,9 @@ Create:
 ## 1) NAT Port Forward rules (enter these 6)
 Path: `Firewall > NAT > Port Forward`
 
+If you already have a correct LAN rule matching `Force DNS to LOCAL_DNS (LAN)`, keep it and skip re-creating Rule A.
+Then create only the missing VLAN rules (`OPT2` to `OPT6`).
+
 For each block below, click `Add` and use exactly these fields.
 
 ### Rule A: LAN