XG 210 - DMZ web server traffic not accessible from LAN.

Question

Hi all, 
 I've setup a web server in DMZ and its working externally (showing web pages). but any PC on my internal LAN cant see the web pages? 
 
 port2 = wan port. 
 port3 = dmz 
 
 1. added web server to "web server" tab, 
 2. added Rule to allow [ WAN, any host] to [ DMZ, #port2] for HTTP, HTTPS. - also IPS want to DMZ 
 3. added a NAT to allow ANY http. https on port2# translate into DMZ_SVR [DNAT], outbound interface port2. 
 
 Do i need to create a second NAT to my LAN port? 
 Is there a step I'm missing? I actually thought my LAN PCs would go out to the web, resolve the name and come back in as external traffic, but clearly that's not the case. 
 
 Tia 
 Dave

FormerMember · Answer

Hi David, Thanks for reaching out to Sophos Community. 
 You'll need to add the LAN zone in the Firewall rule that allows the DNAT traffic to DMZ zone. Also select "MASQ" in "Translated source (SNAT)" If it's configured as Original. 
 Thanks,