тормозит инет (DNS?) из локалки.

# Completed on Sun Dec  4 23:25:26 2011
# Generated by iptables-save v1.4.10 on Sun Dec  4 23:25:26 2011
*filter
:INPUT DROP [798:25536]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:allowed - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_packets - [0:0]
:udp_packets - [0:0]
-A INPUT -p tcp -j bad_tcp_packets 
-A INPUT -s 172.16.1.0/24 -i eth2 -j ACCEPT 
-A INPUT -s 127.0.0.1/32 -i lo -j ACCEPT 
-A INPUT -s 172.16.1.1/32 -i lo -j ACCEPT 
-A INPUT -s 10.78.26.95/32 -i lo -j ACCEPT 
-A INPUT -i eth2 -p udp -m udp --sport 68 --dport 67 -j ACCEPT 
-A INPUT -d 10.78.26.95/32 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -i eth0 -p tcp -j tcp_packets 
-A INPUT -i eth0 -p udp -j udp_packets 
-A INPUT -i eth0 -p icmp -j icmp_packets 
-A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT INPUT packet died: " --log-level 7 
-A FORWARD -p tcp -j bad_tcp_packets 
-A FORWARD -i eth2 -j ACCEPT 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT FORWARD packet died: " --log-level 7 
-A OUTPUT -p tcp -j bad_tcp_packets 
-A OUTPUT -s 127.0.0.1/32 -j ACCEPT 
-A OUTPUT -s 172.16.1.1/32 -j ACCEPT 
-A OUTPUT -s 10.78.26.95/32 -j ACCEPT 
-A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT OUTPUT packet died: " --log-level 7 
-A allowed -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
-A allowed -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A allowed -p tcp -j LOG --log-prefix "allowed:" 
-A allowed -p tcp -j DROP 
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset 
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not syn:" 
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP 
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT 
COMMIT
# Completed on Sun Dec  4 23:25:26 2011

named   18665   root   20u  IPv4 1058416      0t0  TCP localhost:domain (LISTEN)
named   18665   root   21u  IPv4 1058418      0t0  TCP 10.78.26.95:domain (LISTEN)
named   18665   root   22u  IPv4 1058420      0t0  TCP 172.16.1.1:domain (LISTEN)
named   18665   root   23u  IPv4 1058421      0t0  TCP localhost:rndc (LISTEN)
named   18665   root   24u  IPv6 1058422      0t0  TCP [::1]:rndc (LISTEN)
named   18665   root  512u  IPv4 1058415      0t0  UDP localhost:domain 
named   18665   root  513u  IPv4 1058417      0t0  UDP 10.78.26.95:domain 
named   18665   root  514u  IPv4 1058419      0t0  UDP 172.16.1.1:domain 

# Generated by iptables-save v1.4.10 on Mon Dec  5 00:20:42 2011
*nat
:PREROUTING ACCEPT [104824:9522858]
:INPUT ACCEPT [102413:9378577]
:OUTPUT ACCEPT [384332:27674084]
:POSTROUTING ACCEPT [384141:27644344]
-A POSTROUTING -s 172.16.0.0/16 -j MASQUERADE 
COMMIT
# Completed on Mon Dec  5 00:20:42 2011
# Generated by iptables-save v1.4.10 on Mon Dec  5 00:20:42 2011
*filter
:INPUT ACCEPT [15608760:19180027343]
:FORWARD ACCEPT [426712:409172504]
:OUTPUT ACCEPT [12373491:3256406051]
COMMIT
# Completed on Mon Dec  5 00:20:42 2011

$ cat /etc/named.conf 
options {
	directory "/var/named";
	/*
	 * If there is a firewall between you and nameservers you want
	 * to talk to, you might need to uncomment the query-source
	 * directive below.  Previous versions of BIND always asked
	 * questions using port 53, but BIND 8.1 uses an unprivileged
	 * port by default.
	 */
        forward first;
        forwarders {
                172.16.1.1;
        };

	// query-source address * port 53;
};

// 
// a caching only nameserver config
// 
zone "." IN {
	type hint;
	file "caching-example/named.root";
};

zone "localhost" IN {
	type master;
	file "caching-example/localhost.zone";
	allow-update { none; };
};

zone "0.0.127.in-addr.arpa" IN {
	type master;
	file "caching-example/named.local";
	allow-update { none; };
};