Help with securing self ip's and forwarding virtual server for a DMZ server using non-http

Port Lockdown only handles traffic destined directly to the self IP, not for traffic which it would forward.

If you're not using a remote logging destination and able to see your traffic there you can simply use tcpdump from your BIG-IP device and filter on traffic from your DNS server to see which virtual server it is going through.

Something along the lines

tcpdump -i 0.0 -nn host <IP-address of DNS-server>

at the end of the line you should see something along the lines of

in slot1/tmm0 lis=/Common/your_forwarding_vs