I have sites with similar layout, using sendmail's LUSER_RELAY.

The mc entry is;

        define(`LUSER_RELAY',mail.domain1)dnl

  - External users (domain2) are aliased, so miss the relay.
  - Local accounts also miss the relay.
  - The rest are relayed to the internal mailserver.

Ref: /usr/share/sendmail/README

  LUSER_RELAY     The site that will handle lusers -- that is, apparently
                  local names that aren't local accounts or aliases.

-- 
Rex McMaster                       rex@mcmaster.wattle.id.au
                     http://www.compsoft.com.au/~rmcm/pgp-pk

Berndt Josef Wulf writes:
 > G'day,
 > 
 > is there a FAQ/Document on setting up mail distribution on a firewall?
 > 
 > The situation is the following:
 > 
 > Currently, the firewall in use is Borderware which is nolonger
 > supported and will be replaced by NetBSD. There are geographically
 > seperated user groups for which email will arrive at the firewall.
 > 
 > External users are listed in the /etc/alias list of the firewall and
 > their email is redirected to the appropriate accounts. For all other
 > users, email is redirected to the internal mailserver, Groupwise 5.2.
 > 
 > The aim is to redirect email for external users at the firewall and
 > not from the internal mailserver. 
 > 
 > 
 >   user-ext@domain1|
 >                   |--- internet ---> [fw.domain1] ---+
 >   user-int@domain1|                      |           | 
 >                                          |           |
 > 					 |           |
 >   user-ext@domain2 <-- internet ---------+           |
 > 						     |
 >                                                      v
 >                                               [mail.domain1]
 > 
 > 
 > Is anyone using a similar setup? Suggestions? Pointers?
 >