That's the question which occupies us all.

I've been moving everything public to NAT through our border manager
server. I'm having an issue with our student management portal system.
It runs on an oracle app server. The company we're dealing with
hasn't helped me with configuring the oracle app web server to listen
on a private IP instead of a public.

So I guess my question is this, as long as the web server's default
route is the border manager public NIC, my filtering rules will still
apply whether or not I NAT it? Do I have that right?