NAT 1:1 and Firewall rules order: How to apply a rule BEFORE NAT 1:1 translation

[gilou06]

My config

Two hosts 1&2, host 2 located on LAN has a virtual IP in the DMZ. NAT 1:1 enabled between IP:A and IP:C

My goal: to block traffic IP:B -> IP:C, but allow IP:B -> IP:A

I beleive that the NAT 1:1 translation is applied BEFORE the firewall rules. So in fact the rule "allow IP:B -> IP:A" has no effect AND the rule "block IP:B -> IP:C" also blocks traffic IP:B -> IP:A.

How can we workaround this ?

|
|Wan
|
PfSense–DMZ--  VirtualIP(IP:A), Host 1 (IP:B)
|
|LAN
|
Host2 (IP:C)

thanx
:)