Dropped traffic when accessing WAN IP from LAN with NAT Reflection disabled

Determine why internal LAN hosts cannot reach a forwarded service via the firewall's public IP when NAT Reflection is disabled, and whether enabling Pure NAT or Proxy NAT restores connectivity without introducing application‑level issues.

Consider the need to keep processing overhead low on modest hardware, avoid breaking protocols that embed IP addresses (such as FTP or SIP), and evaluate whether the extra CPU cost of Proxy NAT is acceptable for the expected connection rate.

Does enabling Pure NAT restore reachability for typical services like HTTP and SSH? What are the compatibility differences between Pure NAT and Proxy NAT for protocols that carry IP addresses in the payload? Is implementing split‑DNS a preferable workaround when NAT Reflection must stay disabled for performance reasons?