it looks like the inverse nat rules make it go - but it needs reboot&test