Without thinking it through at all: can we just point the DNS record at the internal IP of the log server?