I would guess you are having problems with the NATing on your firewall machine. You definitely CAN make it so that internal machines that hit the firewall public IP get the same results as external hosts. However, to achieve this you will need to "double NAT" the connections. You need to make sure that both the source and destination gets re-written.
I'd guess that right now you are only doing the DNAT, so your packets get forwarded on to the destination machine, but the source address is still your LAN address. So the destination server tries to reply directly to the source, but it replies with it's IP address and the source machine rejects it because it expect it to come from the firewall public IP.
For these sorts of problems I will use tcpdump to track it down. For example, on the destination host I would run:
tcpdump -lni eth0 port 80
Then try making a connection from an internal machine to the "build.example.com" name. What you SHOULD see is the source address is the firewall internal IP address, and the destination IP obviously will be the internal IP on the destination machine. If you don't see any packets related to this traffic, your DNAT isn't working on the firewall. If the source address is the IP on the source machine it means that you are not doing SNATing on the packets. Probably because you are only NATing traffic when it leaves the firewall via your upstream link.
If the tcpdump on the destination machine doesn't help, you can try doing a tcpdump on the firewall. There are several different tcpdumps I typically do:
tcpdump -lni any port 80
This will show port 80 traffic on any interface. So for NATing, you will typically see the incoming packet without any translation, and then you will also see that packet after the results of any NAT. However, this tcpdump will only show HTTP (port 80) traffic. What you WON'T see is ICMP traffic like firewall REJECT rules or if nothing is listening on the port...
tcpdump -lni any host $SOURCE_HOST_IP
This one will show anything to/from the source host, so you will see ICMP messages which may be useful. However, this will ignore the NATed packets.
tcpdump -lni any host $DESTINATION_HOST_IP
This will show packets going to the destination machine, or coming from it. These should list the destination host IP and the firewall IP that is in the same network as the destination host. If it isn't, the NAT rules need to be looked at.
DNS views can be used as well, but that can be annoying to set up and maintain as well. But it does have the benefit that traffic will go directly to the destination host rather than having to hit the firewall.
My recommendation would be to make it so the internal hosts can reach the external IP, but it really depends on your exact needs.
The first will show packets going to
