forwarder and allow-query

[Thomas Stalder]

First thanks for the hints to idendify my forwarder problem.
Compiling the newest Bind but running the distributed version
coming with Solaris was not very smart of me :-)
Now I'm running into the next trap. Below you find what I tried
to do on our name server in the DMZ for an internal zone.
Why does'nt the 3rd example work?

Thanks a lot, Thomas
-------
Following works fine (which I probably will stick to):

zone "ch.firm-internal.com" in {
     type slave;
     file "/var/named/db.ch.pwcinternal.com";
     masters {
     10.41.66.193;
     };
     allow-query {
          10.41/16;
          192.22.22.96/27;
     };
};
-------
This works as well (forwarding to internal name server, open
to the public):

zone "ch.firm-internal.com" in {
     type forward;
     forward only;
     forwarders {
          10.41.66.193;
     };
};
-------
Following seems to be buggy. The name server tries to find
the address in the Internet instead forwarding to the  
'internal name server':

zone "ch.firm-internal.com" in {
     type forward;
     forward only;
     forwarders {
          10.41.66.193;
     };
     allow-query {
          10.41/16;
          192.22.22.96/27;
     };
};