You are using a transparent mode instead of Nat, then we are in a layer 2 environment.
means from Vlan 10 to vlan 20 , there is no way you can have any packet. that what a broadcast domain is used for (VLAN)
From the internal port point of view id your switch is on a different vlan such as vlan 1 for example and you extend the vlan 20 using 802.1q or even dot1q (wich is a Cisco way of using 802.1q) then on both side you should have the same set-up
same native vlan (vlan 1)
same 802.1q vlan (vlan20)
good luck, please consider using the NAT mode, more secure, more efficient and not really more complicate