What you are looking to do is perform REVERSE PORT ADDRESS TRANSLATION.
People call it all sorts of crazy things like: NAT Hairpinning, NAT-on-a-stick, NAT reflecting, and NAT loopback.
Just to clear this up,.. Hairpinning is a technique used in a
NAT-on-a-stick configuration that involves having the NAT "loopback"
the traffic. This sounds like what you want, but is very likely NOT
what you want. These configuration in their simple form have only one
interface. They practically turn a router into a NAT server to a
It is difficult to get to these kind of questions using Google, so I will rephrase:
If you cannot reach an internal server using the GLOBAL IP address and port, then this post is FOR YOU!
You have to configure another type of NAT called NVI instead of traditional NAT.
To configure NAT NVI you substitute:
ip nat outside or ip nat inside for ip nat enable in interface configuration mode.
ip nat inside source static a.b.c.d xx int fa0 yy for ip nat source static a.b.c.d xx int fa0 yy in global configuration mode.
ip nat source route-map NAT_MAP interface Dialer1 overload for ip nat inside source route-map NAT_MAP interface Dialer1 overload in global configuration mode.
Now, you should be able to access your web server from the LAN using the GLOBAL IP ADDRESS.
This is GREAT, right ?! Not so if you have a dynamic IP address,
because as soon the router reboots, it will start up, and the NAT
entries will be classical NAT entries instead of NVI entries. This
breaks "port forwarding" in general, so I wrote a script to re-enter
the statements as soon as the interface is placed in up status. I'm
just going to leave this here, and if anybody needs help feel free to
(BTW, you can tell this is happening to you if you have ip nat source
static ... statements visible in the output of show ip nat
translations instead of ip nat nvi translations.)
The script is available here:
Save it, and copy to the router. Look inside the file for how
configure IOS to use the script.
P.S. Enabling NVI makes your router take a slight performance hit. This may be more notable on older routers or 800 series.