slapd replication (push based)

Hi,

I have the following setup

LAN --- slapd 2.4.7 (master) --- DMZ ---slapd 2.3.30 (slave)

I'm trying to achieve replication from master to slave. the firewall policy is LAN-->DMZ allow DMZ-->LAN reject

this was actually very easy with slurpd (removed from 2.4) as the only need was to allow TCP traffic from master to slave

with syncrepl it seems to me that no matter if I use push/pull method the client (slave) is the one that binds to the master (provider). this means that firewall rule that allows TCP traffic to LAN is needed - this is very ugly.

is there a way to workaround this (or did i just misunderstand the whole problem)

thanks,

Martin.