The sites you are using as the <iframe> src might not work well in iframes. A site in an <iframe> might target the top/parent window of the browser, which in this case, is the zimbra web client. When you click a link in that site while in the iframe, it takes over the top window and the browser window becomes theirs (i.e. the link is opened the full tab).
For example, if a page contains an <a> link and targets "_top", when the link is clicked within an iframe, the whole window is taken over.
Code:
<a href="test.html" target="_top">this is a link to TEST.html</a>
Total side note: sites like twitter.com check if the window they are in is the "top" window. If not, they set the "top" window to be their site...so you can't even browse twitter inside of an iframe...it takes over the whole window making it impossible to iframe twitter.
Also, the config_template.xml is used when you are routing Zimlet JavaScript requests from your zimlet back thru ZCS. In the case of an iframe, the framed site is not routing thru ZCS (via the Zimlet Proxy Servlet), the site is loading from the browser (i.e. that's the way iframes work). So configuring the allowed domains in config template will have no affect.
Just an FYI:
ZCS 6.0:Zimlet Developers Guide:Proxy Servlet Setup - Zimbra :: Wiki
You can test if a site can work in a iframe by making a simple test.html page with an <iframe> tag and see if you can navigate the <iframe>'d site w/o it taking "over" the top window.