Why does it show LAN address when NAT is enabled on cisco?

Question

I have following network connections

LAN -> Cisco Router -> 16 port switch -> Server (netflow)
                                      -> ISP

And i have following config on Cisco router

interface FastEthernet0/0
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
interface FastEthernet0/1
 ip address <router ip> 255.255.255.x
 ip nat outside
ip route 0.0.0.0 0.0.0.0 <gateway ip>
ip flow-export destination <server ip> <port>

I have allowed router ip on Server. Though I had no data received on server:port which a service was running. But when I tcpdump the port:

$ tcpdump -pn udp port <port>
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eno1, link-type EN10MB (Ethernet), capture size 262144 bytes
12:30:52.926946 IP 10.10.10.1.59663 > server:port: UDP, length 1464
12:30:52.927521 IP 10.10.10.1.59663 > server:port: UDP, length 1464

Which is weird to me. I was expecting the router ip.

1. Why does it show LAN address?
2. Is it ok to allow 10.10.10.1 to my server ?

Answer 1

1. The traffic is surely the netflow export UDP packets you have configured. It would normally come from the inside interface, hence the inside address. Use ip flow-export source to change the source interface.

2. Yes, allow traffic from the inside of the router to the server, otherwise your server will not send packets to and from the router, such as logging, configuration, NTP, whatever. Unless of course your intention is to really separate this server somehow.

Answer 2

If it's is souce nat translation then source private ip address is translated to natted public ip .

So in cisco router

"When debug nat command is on "

Logs will reflect lan subnet ip address to translating natted public IPaddress.

For destination nat scenario will be quite reverse .

Logs will reflects public ip address translation to natted private IPaddress