IDS/IPS on DNAT

Question

Does IDS/IPS work , on a DNAT rule. 
 
 EG I have a webserver which faces the internet on port 22 (SFTP) and 443. The web server sits behind the Firewall and traffic is DNAT'd to it. 
 
 I have created a DNAT rule. The server sits inside the Internal Subnets. Internal Subnets network address range is added to the IDS/IPS. 
 
 Will a person accessing the web server over the internet be subjected to IDS/IPS inspection? Or must I use the WAF to do so? 
 
 Thanks

BAlfson · Answer

IPS is also applied to inbound WAF traffic. See #2 in Rulz and the relevant diagrams there to understand that IPS is applied virtually everywhere. 
 Cheers - Bob