# access from inside
SAT lan/lannet core/wan_ip yourservice, SAT: new destination = yourprivatehost_ip
NAT lan/lannet core/wan_ip yourservice
# access from outside
SAT wan/all-nets core/wan_ip yourservice, SAT: new destination = yourprivatehost_ip
Allow wan/all-nets core/wan_ip yourservice
Your pirvate (inside) host should use DFL as default gateway and accept external (non lannet) inbound solutions. If it's not possible, change last Allow rule to NAT, but you will lose source (external clients) IP addresses.