Why not "allow-query" in a forward zone?

[Tilman Schmidt]

At 17:10 08.03.00 +0100, Jesper Dybdal wrote:
>For the sake of log files and troubleshooting, I would like the
>firewall itself to be able to look up names and IP addresses in
>the internal networks.
>
>This can be done by defining suitable "forward" zones that refer
>to the internal nameservers.

That's not the way to do it. Instead, set up /etc/resolv.conf on
the firewall machine to use the internal nameserver instead of
the one running on the firewall machine itself. See the recent
thread "Public / Private zones - assistance please" in this
newsgroup.

-- 
Tilman Schmidt          E-Mail: Tilman.Schmidt at sema.de (office)
Sema Group Koeln, Germany       tilman at schmidt.bn.uunet.de (private)