I think you are referring to this. For the internal hosts to access the server with the internal address I suppose that a DNAT rule in the PREROUTING chain to capture packets from the LAN to the public IP of the server and change the destination field to the private IP address will do.