I have the router for the internal network (a Linux box) do a bridge. So it is all the same network and no extra NATing is required. That router blocks connections into the internal network.