If your web server needs to be accessable from the internet, it will need a real address on the internet. The same goes for your mail server. The mechanism for doing this, and still having the boxes behind the firewall vary. Here are a couple of choices:
Note, by the way, your servers should have static addresses, even if behind a NAT router. Select a small range of addresses at the beginning or end of your DHCP scope. Exclude these addresses from the DHCP scope. From this pool of addresses,assign static addresses to all of your servers.
Choice 1: Use the port forwarding feature of the router or firewall. Publish the firewall address as the web server address and as your mail server address. Set the firewall to forward packets coming to port 25 to the REAL (internal) address of the mail server. Set the firewall to forward packets coming to port 80 to the REAL (internal) address of the web server.
Choice 2. Give the servers real, routable addresses behind the firewall (you may have to get these addresses from your ISP). Set the firewall to filter out all trafic to those servers except the exact protocols and ports that they should get.
Good luck.
