Bind9/iptables Seeking Enlightenment
I'm trying to get a better understanding of how bind9 works (and doesn't work) with iptables. I have done the following experiment and need a guru to help explain the results.
I have Bind9 up and running well on a standalone laptop. No recursion, no connection to the outside world. It responds properly when accessed as localhost or by IP or servername as well as finding a default server on its own. Works fine for both forward and reverse lookups.
Start iptables, flush everything, set all policies to accept. We're wide open here. Bind9 still looking good.
Now set the nat OUTPUT policy or the nat POSTROUTING policy to drop. Suddenly Bind9 can't find any servers, and within a minute or two the whole system freezes. Why? What is Bind9 doing in the nat tables? Why does whatever Bind9 is doing cause the entire system to freeze?
Any insight appreciated.