You can play with partitions and CSS for that, create the same DN in two partitions, one internal, one external, make sure the inbound CSS from your trunk/GW/etc can only reach the external one, and either make it CFA to whatever you want, or create a TP, make sure internal users can only reach the internal DN. That's all you need.
Are you getting this error “Installer User Interface Mode Not Supported. The installer cannot run in this UI mode. To specify the interface mode, use the -i command-line option, followed by the UI mode identifier. The value UI mode identifiers...
The below trick might come handy when you have to add a new node to a cluster but you don't have or is unsure of the security password for the publisher. This procedure has been around for ages.
1) Login into the CLI of the Publisher.