diff --git a/setup.sh b/setup.sh
index cc459c0..09e26aa 100755
--- a/setup.sh
+++ b/setup.sh
@@ -158,8 +158,8 @@ cmd_status() {
         warn "Hosts  entries are NOT configured (run: ./setup.sh hosts)"
     fi
 
-    if sudo iptables -t nat -L OUTPUT -n 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then
-        ok "NAT    redirect 443→$BRIDGE_PORT is ACTIVE"
+    if sudo iptables -t nat -L OUTPUT -n -v 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then
+        ok "NAT    redirect 127.0.0.1:443→$BRIDGE_PORT is ACTIVE"
     else
         warn "NAT    redirect is NOT active (run: ./setup.sh nat)"
     fi
@@ -205,14 +205,17 @@ cmd_nat() {
         ok "NAT rule already active"
         return
     fi
-    sudo iptables -t nat -A OUTPUT -p tcp --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT"
-    ok "iptables: OUTPUT 443 → $BRIDGE_PORT"
+    # Scope to 127.0.0.1 only — /etc/hosts resolves EA domains to loopback, so
+    # only those connections match. All real internet traffic goes to non-loopback
+    # IPs and is never redirected.
+    sudo iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT"
+    ok "iptables: OUTPUT 127.0.0.1:443 → $BRIDGE_PORT"
     warn "This rule is NOT persistent across reboots. Re-run './setup.sh nat' after reboot or use iptables-save."
 }
 
 cmd_unnat() {
     if sudo iptables -t nat -L OUTPUT -n 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then
-        sudo iptables -t nat -D OUTPUT -p tcp --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT"
+        sudo iptables -t nat -D OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT"
         ok "Removed iptables NAT rule"
     fi
 }