NAT Reflection on Opt/VLAN

  • Trying to configure Opt and VLAN with main LAN.  Goals:
    1. Subnets on all 3 cannot access each other.
    2. However Ports/Services provided on LAN and used on Opt & VLAN reflect back in using WAN NAT.

    If I turn on Rule so Opt/VLAN cannot access LAN subnet directly, Reflection (or SplitDNS) does not appear to work.  If I turn off the Rule then it does.  But we need no access to LAN except through NAT (and Rules created therefrom) and don't want to create 2 NAT/Rule sets

    I would guess reconfiguring NAT as Floating Rules would work, but if so (and can someone confirm) what is the "If" interface for the new NAT/Rules (VLAN or LAN)?