use forward only option

- this is needed to resolve reverse DNS for external private IPs
  because bind 9.9 defaults to empty-zones-enable yes
- this allows to better run behind firewalls