use hide nat for network behind the external ip of you perimeter gateway