LAN clients - how to access service located on WAN VIP internally

[DJKR]

Below is my network setup.

What I am trying to achieve is the follows

• computer on LAN3 interface with IP address 172.30.16.54 is trying to access abc.def.com

• abc.def.com resolves to 192.168.2.38

• 192.168.2.38 is VIP from the WAN interface, it is in a 1:1 NAT relationship with 192.168.1.50 on interface LAN

• when the computer tries to access 192.168.2.38 I can see it on the log of the LAN3 interface but cannot see it on the WAN interace

• 172.30.16.54 can ping 192.168.2.38

• it is trying to create an IPSEC tunnel from 172.30.16.54 to 192.168.2.38 so I can see the initial ISAKMP packet towards port 500

• Should I be able to route this internally as required?

[johnpoz]

Why would you not just resolve abc.def.com to 192.168.1.50 in the first place for devices behind pfsense...