Yes, this will work. In practice, I have found that 99% of access scenarios are client-pull-from-server.
Where it could break is if you are used to using MMC to manage your workstations from your server, but if you don't do that already, it's no biggie.
One gotcha to look out for is that you need to make sure your clients have access to your domain controller's DNS server. So if your NAT box routing the 192.168.20.0/24
network is also running its own DHCP server, make sure it hands out the IP address of your domain controller (192.168.1.100
) in DHCP, or if it runs its own DNS forwarder, make sure the NAT box uses your domain controller as upstream DNS.
Honestly — 9 times out of 10 if your client can’t converse with the server, it’s a DNS issue, not a NAT issue.
As a general recommendation (slightly off-topic), I highly recommend you start to look at IPv6 deployment. Active Directory and SMB over IPv6 is not supported with Server 2003 or Windows XP, but is fully supported in Windows Vista and Server 2008, so is something to think about. (With DirectAccess and Agile VPN, this is made a lot easier than you would otherwise think.)