iptables and DNS

["Brian Ugie" <bugie@pzs.com>]

Hi,

  I am hoping that someone can explain the role that DNS has in
relation to iptables and if there is a way to stop iptables from
resolving. 

  I have a network where a netscreen firewall sits in front or our
servers. We map public IPs to the servers and do initial port filtering
from the netscreen. We also want to have each machine filter just in
case the windows box gets compromised ;). It has seemed to me that
iptables will not first use /etc/hosts to resolve but will go straight
to the DNS server. Is this a valid statement? nsswitch.conf lists file
first. Since DNS will resolve the server to a public address but it is
actually on a private address, iptables get confused and the net result
is long delays on ssh and ftp logins and server time outs on DNS
queries. 

  To test my theory I set the DNS record to the private ip and that
worked like a champ. I feel that I am left with only the option to
create views in bind.

  Has anyone else out there seen this or know of a better solution? 

Thanks in advance,

Brian