Iis – How to reverse NAT by destination name

You're on the right track. Yes, it is all done on Router A. You will want both F1/0 and S0 to have ip nat inside on them. The ACL on Router A's ip nat inside source command should include both 10.10.10.x and one of the following:

1. If Router B is doing NAT on its own, so Router A only ever sees traffic from 192.168.1.2, you need to add 192.168.1.2 (or 192.168.1.0/30) to the ACL.
2. If Router B is not doing NAT, (which it probably isn't), then you need to add 10.10.20.x to the ACL (and probably also 192.168.1.2 if Router B needs to talk to the Internet).

Basically, the ACL just needs to cover any source IP you want to NAT as it appears to Router A when it enters an interface with ip nat inside on it. Traffic from the Router B LAN will be seen by Router A as 10.10.20.x (unless Router B does its own NAT overload).

A "normal" reverse proxy is routed as well, and this is usually regarded as the most optimal configuration for most applications.

There's a few reasons for a "bridged" setup, however most of them are application specific. A bridged setup doesn't modify the request / response (or shouldn't) in any way, whereas a Proxy server acts as a middle man, which can sometimes cause issues.

I don't have a Barracuda Application firewall myself, however i can't assume its much different then a Apache + Mod_Proxy + Mod_Security server.