use forward only option

- this is needed to resolve reverse DNS for external private IPs
  because bind 9.9 defaults to empty-zones-enable yes
- this allows to better run behind firewalls
Merge pull request #65 from SUSE-Cloud/release/pebbles/master

use forward only option