Can you create an NT Server with the same domain name & same server name, but on different segments? One domain/server would be on the outside of the firewall, so the firewall could actually block the segment address.