Encountered the same issue. Managed to find a workaround though. Not sure if it’s applicable to all issues people are facing here but it might be worth a shot.
Workaround: use DNS-over-HTTPS
The box’s DNS server returns fake 198.18.x.x addresses, and the gateway behind them only forwards port 443. If you resolve real IPs over DNS-over-HTTPS (which itself runs over 443), connections on other ports go through.
System-wide fix. Ask your bot to install dnscrypt-proxy listening on 127.0.0.1:53, with DoH upstreams pinned to IPs (Cloudflare 1.1.1.1 and Google 8.8.8.8), then set /etc/resolv.conf to nameserver 127.0.0.1. The box has no systemd, so have it start the resolver from a shell profile script so it comes back after a restart.