Настройка bind на шлюзе с Debian

#смотрит на роутер
allow-hotplug eth1
iface eth1 inet static
address 192.168.1.126
netmask 255.255.255.0
gateway 192.168.1.1
network 192.168.1.0
broadcast 192.168.1.255
#общая сетка
allow-hotplug eth2
iface eth2 inet static
address 192.168.2.3
netmask 255.255.255.0
network 192.168.2.0
broadcast 192.168.2.255

nameserver 127.0.0.1

acl mynetwork { 192.168.2.0/24; 127.0.0.1};
options {
        directory "/var/cache/bind";
         forwarders {
         213.177.96.1;
         213.177.97.1;
         };
        listen-on { 127.0.0.1; 192.168.2.3;};
allow-query { mynetwork; };
        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { none; };
};

include "/etc/bind/named.conf.options";
};
// prime the server with knowledge of the root servers
zone "." {
        type hint;
        file "/etc/bind/db.root";
};
// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912
zone "localhost" {
        type master;
        file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
        type master;
        file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
        type master;
        file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
        type master;
        file "/etc/bind/db.255";
};
zone "pashtet51.com" {
 type master;
 file "/etc/bind/db.pashtet51";
};
include "/etc/bind/named.conf.local";

$TTL 604800
 @ IN SOA localhost. root.localhost. (
 2009062901 ; Serial
 3600 ; Refresh
 900 ; Retry
 604800 ; Expire
 86400 ) ; minimum
 ;
 @ IN NS localhost.
 @ IN A 192.168.2.3

# option definitions common to all supported networks...
#option domain-name "example.org";
option domain-name-servers 192.168.2.3;