Something other than port 53 is blocking the LAN based BIND9 Servers

[Mike Lieberman]

Hi, I am new here, but have been using BIND since 1994. 

I am confused by the issue herein and maybe someone has an idea of at least what group I should be talking to. 

I have a Debian based operation and my BIND9 servers run on Debian. BUT...

This is really about BIND as it interacts with my ISP supplied FTTH routers. There is apparent port blocking of the servers ONLY using their newer routers and not the older ones. I can't figure out which port is being blocked because UDP and TCP port 53 is open in all cases and works from any client (including a client application running from Terminal on a server). (Once again, my BIND servers work fine without errors.)

My ISP (PLDT Philippines) has had a FTTH router that allowed my three BIND servers to work flawlessly. It didn't require a whitelist on a firewall. And all clients could either use our LAN based DNS service or a public one. DIG and NSLOOKUP (yes I know is has been obsoleted, but net-tools still has it) works.

But older Router reached EoL and the ISP wanted to change it out to its new FTTH router. And that is when I hit a wall.

The newer router blocks my local BIND servers (ONLY not clients using downstream servers) from receiving anything from the Internet. OUR BIND servers still have the local networks, but nothing else. 

So, with the new router, my clients can access a public DNS server downstream and get FQDN resolved. The new router allows remote DNS lookups but denies my local BIND servers access to resolve the same non-local addresses.

The ISP's EoL equipment is really no longer good for other reasons but I can't use the new one.

The question I need resolved by the proper group/forum is: What port or technology is doing the blocking? The ISP has no idea.

I have tried three of the new routers but all blocked my servers. I tried a replacement EoL router and that works. Without changing anything on the network, other than the physical router, it was like flipping a switch.