Config backup to local nextcloud server

[sesquipedality]

So I have a NATed LAN behind an opnsense firewall.  Port forwarding (with reflection) is in place for my nextcloud server on TCP port 8443.  All works well in that I can access the sever using https://www.internet.name.com:8443/ from both inside and outside of the network.

However, the config file backup option in opnsense does not work in that opnsense times out trying to contact the server.  This does not happen when the internal name of the server is used, but for security reasons, nextcloud will not serve files as the server's SSL certificate only covers its public facing name.  If I want to back up my config from the opnsense router to the internal server, it therefore has to be done via using the public host name and NAT reflection.

NAT reflection does not appear to be working from the router itself.  I force an update from the user interface, but the page waits for a long term before returning with an error. The firewall logs are unhelpful, and do not show any block rules being matched or any traffic being allowed from the router.  tcpdump confirms no traffic to or from port 8443 (the port I am using) on either the LAN or WAN interfaces related to the request to back up the config file.

The error from the logs is:

2020-04-19T15:47:53   config[43811]: {"url":"https:\/\/<server_url>\/","content_type":null,"http_code":0,"header_size":0,"request_size":0,"filetime":-1,"ssl_verify_result":0,"redirect_count":0,"total_time":60.030287,"namelookup_time":0.022502,"connect_time":0,"pretransfer_time":0,"size_upload":0,"size_download":0,"speed_download":0,"speed_upload":0,"download_content_length":-1,"upload_content_length":-1,"starttransfer_time":0,"redirect_time":0,"redirect_url":"","primary_ip":"","certinfo":[],"primary_port":0,"local_ip":"","local_port":0}
2020-04-19T15:47:53   config[43811]: Error while fetching filelist from Nextcloud

(DNS on the router is resolving the public host name.)

Does anyone have any suggestions as to what is going on, and how I might fix it?  Thanks.

[fabian]

You do not need NAT reflection but a host override on the firewall itself.

[sesquipedality]

Thanks.  I'd thought that might be the case, but I'm having difficulty in figuring out where in the interface I should set that up.  Certainly my attempts so far haven't been successful.

[sesquipedality]

Mapping the public server name to the local IP in the DNS overrides in

Services -> Unbound DNS -> Overrides

Solved the problem, but of course now all machines on the internal network resolve the public server name to the local IP for all purposes, which may be a little more of a reconfiguration than I ideally wanted.  I'd still be interested in knowing whether this is doable using NAT and mirroring if anyone knows how.