A local firewall probably wouldn't have helped here -- the DNS lookups would be performed by mDNSResponder, not by iTerm itself.
but i do distinctly remember getting alerts for this and being annoyed enough to go figure out how to disable the feature in iterm2 (it was at least a couple years ago, so my memory is hazy).
maybe someone with more recent experience can clear up the mystery for us. =)