tl;dr: iptables is really literal, don't forget localhost rules.
Okay! Got it. Michael Hampton gave me the idea to use a logging rule (this was my first time). So I did the following:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 10.0.0.0/8 anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere 10.0.0.0/8
ACCEPT all -- anywhere 167.114.0.0/16
ACCEPT all -- anywhere nis1.example.com
ACCEPT all -- anywhere nis2.example.com
LOGGING all -- anywhere anywhere
Chain LOGGING (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 2/min burst 5 LOG level warning prefix `IPTables-Dropped: '
DROP all -- anywhere anywhere
From there, I started iptables and then attempted to restart ypbind and immediately saw this:
Jul 22 22:53:04 host1 ypbind[9844]: Unable to register (YPBINDPROG, YPBINDVERS, udp).
Jul 22 22:53:31 host1 kernel: IPTables-Dropped: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=1476 DF PROTO=TCP SPT=18660 DPT=7606 WINDOW=2305 RES=0x00 ACK URGP=0
Jul 22 22:53:50 host1 ypbind: NIS server for domain example is not responding.
Jul 22 22:54:01 host1 kernel: IPTables-Dropped: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=1506 DF PROTO=TCP SPT=18660 DPT=7606 WINDOW=2305 RES=0x00 ACK URGP=0
OH NO! It's blocking localhost. I added that to the output rule and got:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 10.0.0.0/8 anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- localhost localhost
ACCEPT all -- localhost localhost
ACCEPT all -- localhost localhost
ACCEPT all -- localhost localhost
ACCEPT all -- anywhere 10.0.0.0/8
ACCEPT all -- anywhere 167.114.0.0/16
ACCEPT all -- anywhere nis1.example.com
ACCEPT all -- anywhere nis2.example.com
LOGGING all -- anywhere anywhere
Chain LOGGING (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 2/min burst 5 LOG level warning prefix `IPTables-Dropped: '
DROP all -- anywhere anywhere
One more ypbind restart and
Jul 22 22:54:38 host1 ypbind: NIS domain: example, NIS server: nis1.example.com
There you have it!