Iptables vs dns (win nslookup интересное поведение)

Centos 5.4 + iptables+ bind9
Есть проблемы в работе ДНС при включенном iptables.
Если iptables выключен, то на win машине:

C:\Documents and Settings\Администратор>nslookup
Default Server: mail.domain.ru
Address: 192.168.100.1

> mail.domain.ru

Server: mail.domain.ru
Address: 192.168.100.1

Name: mail.domain.ru
Address: 192.168.100.1

Если iptables поднят:

C:\Documents and Settings\Администратор>nslookup
Default Server: mail.domain.ru
Address: 192.168.100.1

> mail.domain.ru

Server: mail.domain.ru
Address: 192.168.100.1

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to mail.domain.ru timed-out
> exit

Bind настроен на прямое и обратное отображение:
mail.domain.ru 192.168.100.1
[url]ftp://ftp.domain.ru[/url] 192.168.100.1

Настройки iptables (eth0 192.168.100.1 - LAN, eth1 192.168.255.10 - INET)
[root@gate etc]# iptables-save
# Generated by iptables-save v1.3.5 on Fri Nov 18 19:49:56 2011
*nat
:PREROUTING ACCEPT [5:284]
:POSTROUTING ACCEPT [1:108]
:OUTPUT ACCEPT [1:108]
-A POSTROUTING -o eth1 -j SNAT --to-source 192.168.255.10
COMMIT
# Completed on Fri Nov 18 19:49:56 2011
# Generated by iptables-save v1.3.5 on Fri Nov 18 19:49:56 2011
*mangle
:PREROUTING ACCEPT [21:1658]
:INPUT ACCEPT [17:1452]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [16:1620]
:POSTROUTING ACCEPT [16:1620]
COMMIT
# Completed on Fri Nov 18 19:49:56 2011
# Generated by iptables-save v1.3.5 on Fri Nov 18 19:49:56 2011
*filter
:INPUT DROP [4:312]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:allowed - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_packets - [0:0]
:udp_packets - [0:0]
-A INPUT -p tcp -j bad_tcp_packets
-A INPUT -s 192.168.100.0/255.255.255.0 -i eth0 -j ACCEPT
-A INPUT -s 127.0.0.1 -i lo -j ACCEPT
-A INPUT -s 192.168.100.1 -i lo -j ACCEPT
-A INPUT -s 192.168.255.10 -i lo -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -d 192.168.255.10 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p tcp -j tcp_packets
-A INPUT -i eth1 -p udp -j udp_packets
-A INPUT -i eth1 -p icmp -j icmp_packets
-A FORWARD -p tcp -j bad_tcp_packets
-A FORWARD -s 192.168.100.0/255.255.255.0 -p gre -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p icmp -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 1723 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 4666 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 4667 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 3389 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 10000 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 500 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 4500 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 1119 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 1999 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 6112:6119 -j ACC
EPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 6112:6119 -j ACC
EPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -s 9.16.142.1 -j ACCEPT
-A OUTPUT -p tcp -j bad_tcp_packets
-A OUTPUT -s 127.0.0.1 -j ACCEPT
-A OUTPUT -s 192.168.100.1 -j ACCEPT
-A OUTPUT -s 192.168.255.10 -j ACCEPT
-A allowed -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A allowed -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A allowed -p tcp -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A tcp_packets -p tcp -m tcp --dport 21 -j allowed
-A tcp_packets -p tcp -m tcp --dport 20 -j allowed
-A tcp_packets -p tcp -m tcp --dport 25 -j allowed
-A tcp_packets -p tcp -m tcp --dport 995 -j allowed
-A tcp_packets -p tcp -m tcp --dport 2222 -j allowed
-A tcp_packets -p tcp -m tcp --dport 8080 -j allowed
-A udp_packets -p udp -m udp --dport 8080 -j ACCEPT
-A udp_packets -p udp -m udp --dport 20 -j ACCEPT
COMMIT

iptables -A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 53 -j ACCEPT

--=XliN=-- написал:

iptables -A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 53 -j ACCEPT

Попробовал, результат=0.

У меня же бинд стоит на 192.168.100.1, если iptables выключить, то все нормально с nslookup

Решено

Добавил
$IPTABLES -A INPUT -p UDP --dport 53 -j ACCEPT

почему-то если дописать к этой строке ограничение вида -i eth0 или -s 192.168.100.0/24, то запускается iptables без ошибок, но правило не работает.

В связи с этим вопрос:
по идее эта строка откроет доступ и с интернет интерфейса по udp ан сервер.
Как этого избежать?