Das Werkstatt

[Problem]
You have a service running, e.g. some replication service, and can access it from outside without a problem using a normal POSTROUTING IPTables Line; But from the inside, you hit a wall if you use the EXTERNAL PUBLIC IP and thus must reconfigure the client every time depening on if you're in LAN or WAN. Well, not anymore.

[Solution] -s 192.168.1.0/24 = Only if the request comes from our LAN, AND
-d PUBLIC IP = the destination IP is our PUBLIC IP AND
-dport SERVICE PORT = the port it wants to connect is the service we want
THEN DNAT to the actual SERVER_IP of the server running the service.
On the way back, we check mostly for the same things, but the SNAT of the Source is the IP of the ROUTER = The machine running the iptables. It knows the way the packets must go back, dont worry.

The whole thing looks funny, but works like a charm. Also, make sure you have needed ACCEPT rules in the appropriate INPUT, OUTPUT and FORWARD Chains, as well as IP_FORWARDING = 1 set on the router itself.

In case you're scared now, here a example with fake IPs, assuming:

Our Webserver has the Public IP 1.2.3.4 and the LAN IP 192.168.1.10
Our Router is 192.168.1.1 (the machine where you are editing the iptables)
Our Service Port is a Webserver = 80
(I hope i didn't mess up the example now... the whole thing is a pretty huge brainfuck as-is...)