Got it, there is a solution. The reason it was not starting before was because the log files could not be created. Amazing what actually reading the error.logs will reveal.
This works: #Port 80 Listen 192.168.168.3:80 # internal web, outside access blocked with ipchains rules Listen 192.168.168.3:81 # external web, accessible by Internet
