The acme client needs to reach LE though. Or you need to do a dance where the client is outside of the private network and ships the certificate into the private network.