DNS/Bind setup

Since there are some real experts here and BIND is currently a topic, I have a question relating my setup: I have a firewall/router with two interfaces (well more router than firewall actually). Internal network runs on a 192.168.x.x network. The BIND daemon only listens on the internal interface, serving some internal zones and forwards all external lookups to a range of known servers. It seems to me that my BIND is therefore unreachable for outside queries and that I do not have a security issue with it. On the other hand, that sounds to good to be true. So, if I'm wrong I'd be glad for any helpful comments on what I have missed and where possible security holes in this setup (BIND related) are. best regards, Stefan