You don't need a DMZ or extra DNS zones or anything like that. You merely need a capable router.

Our Cyberguard SG575 (running Linux) does it just fine
Our previous firewall, a ClarkConnect Linux machine (Redhat based) worked fine.
Our very old ipchains based RH6.2 system didn't work properly and worked exactly as you describe.
_________________________
Christian
#40104192 120Gb (no longer in my E36 M3, won't fit the E46 M3)