@Auguste / @Tehzie223
Should I use a DMZ based on public or private IP addresses?
If you want your servers in your DMZ be accessible via either WAN1 or WAN2, you have to do one of two things:
a) if you have more than 1 IP for your WAN1/2 setup - say a /29 or bigger network segment - assign your server an address from both pools and setup it's DNS name with both IPs as A records. That would be DNS round-robin as you can't exactly steer which IP the client would take to resolve the DNS and access the client
or more likely use
b) assign your DMZ a RFC1918 private IP range not used anywhere else. Then setup port forwardings on the public IPs you want that server to respond to on both WAN1/WAN2 to that private IP on the DMZ. As pf NAT rules will automatically add "reply-to" cases to the rules, your traffic will go the way it came in, so if you access the service via a.b.c.d via WAN1 you'll get the answer pakets back through WAN1 to your client. If you access it via x.y.z.a via WAN2 it will work, too.
With b) you can access it via IPs on either WAN1/2 at any time. Calling it via DNS name, you could either use a single name with both IPs as A records and have the same round-robin as in a) above or use multiple DNS names, say "myservice-1.domain.tld" and "myservice-2.domain.tld" to and link those two names to wan1/wan2 address and use it accordingly.
