On 21.12.2003, at 03:54, Alan Schmitz wrote:

> I added a 1:1 entry for aaa.bbb.ccc.29 to 192.168.2.29, and I added 
> rules to allow limited access to the DMZ from the WAN, and full access 
> to the DMZ from the LAN.  Everything worked fine from the WAN.  When I 
> tried to access the web site on aaa.bbb.ccc.29 from the LAN, I got the 
> webGUI for m0n0wall.  I was able to bring up the web site on the 
> public server using the 192.168.2.29 private address.

Yep, that's a well-known limitation in ipnat and also applies to normal 
inbound (i.e. non-1:1) NAT setups. Packets cannot "loop" through the 
WAN interface, so that means you'll have to use the private addresses 
to access DMZ from LAN. This FAQ entry explains it:

http://www.phildev.net/ipf/IPFprob.html#8

- Manuel