Why is my DNS server not resolving from an external system?

Question

server1 and server2 are guest VMs in a KVM host machine:

server1.example.com[192.168.4.210] : Configured as DNS server

tcpdump output while query is running from server2

server2.example.com[192.168.4.220] : Client querying server1

[user@server2 ~]$  nslookup server2.example.com 192.168.4.210
;; connection timed out; no servers could be reached

[user@server2 ~]$  ping -c 1 192.168.4.210 
PING 192.168.4.210 (192.168.4.210) 56(84) bytes of data.
64 bytes from 192.168.4.210: icmp_seq=1 ttl=64 time=0.385 ms

--- 192.168.4.210 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.385/0.385/0.385/0.000 ms
[user@server2 ~]$ 
[user@server2 ~]$ nmcli con show eth0 | grep ipv4.dns
ipv4.dns:                               192.168.4.210, 8.8.8.8
ipv4.dns-search:                        example.com
[user@server2 ~]$ 

Edit : Ok , now i seem to have fixed the problem but still unable to understand what is the problem. running wireshark shows error : "Code 10 = Communication with Destination Host is Administratively Prohibited)."

Online search showed that its related to firewall and needed to run service iptables stop;iptables --flush

Thats it, nslookup is working now.but still unable to get my head around the problem since firewall-cmd has replaced iptables and i don't understand what is really going on.

Answer 1

The answer came out to be very simple.

[user@server1 ~]$ sudo firewall-cmd --permanent --add-port=53/tcp
success
[user@server1 ~]$ sudo firewall-cmd --permanent --add-port=53/udp
success
[user@server1 ~]$ sudo firewall-cmd --reload
success
[user@server1 ~]$ 

but i really wanted to see any permission denied or any logs for theses errors