web and mail is only a bunch of single ports. I would use VIPs with portforwarding for port smtp, pop3, http (https, imap, …if neeeded) and advanced outbound NAT on top. Then enable nat reflection at system>advanced and your lan clients will even be able to access your webserver and mailserver by the public IP.