Unable to static NAT to internal Web Server

Question

Trying to Static NAT inside Web Server to allow access from outside (Network) client. Not working so far. I’m testing this in my Lab before putting to production, but still cannot bring up the web page. I tried tracing via netflow, and to me it looks like data is being transferred back to client. But I can’t get the page up.

Equipment: - 2x2801 Cisco Router - 1x3750 Cisco Router - 1XMBA -> client - 1xMBP running VM Fusion Windows IIS as the web server. Web server IP is 10.10.0.18

If I put the client and server on same network segment with no routers inbetween I can bring up the page on the client. I can also get to the page via the host browser regardless of network configuration.

R1 -> hostname e2911

interface FastEthernet0/0
ip address 12.1.1.2 255.255.255.192
ip nat outside
ip nat enable

interface FastEthernet0/1.11
description connection to Lab
encapsulation dot1Q 11
ip address 172.30.10.1 255.255.255.248

ip nat inside source list 100 interface FastEthernet0/0 overload
ip nat inside source static tcp 10.10.0.18 8888 12.131.157.66 8888 extendable
ip route 0.0.0.0 0.0.0.0 fa0/0
ip route 10.10.0.0 255.255.0.0 172.30.10.3
ip route 172.18.10.0 255.255.255.0 172.18.10.5
!
access-list 100 permit ip 172.18.10.0 0.0.0.255 any
access-list 100 permit ip 172.30.10.0 0.0.0.255 any
access-list 100 permit ip 10.10.0.0 0.0.255.255 any

SW -> hostname 3750SW

interface FastEthernet1/0/2
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface FastEthernet1/0/3
 switchport access vlan 11
 switchport mode access
!
interface Vlan11
 description Lab vlan
 ip address 172.30.10.2 255.255.255.248
!
ip route 0.0.0.0 0.0.0.0 172.18.10.1

R2 -> hostname lab

ip dhcp excluded-address 10.10.0.1 10.10.0.20
!
ip dhcp pool LAB
   network 10.10.0.0 255.255.0.0
   default-router 10.10.0.1
!
interface FastEthernet0/0
 ip address 172.30.10.3 255.255.255.248
 ip flow monitor MONITOR-1 output
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 !
!
interface FastEthernet0/1
 ip address 10.10.0.1 255.255.0.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
ip nat inside source list 1 interface FastEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 172.30.10.1
!
access-list 1 permit 10.10.0.0 0.0.255.255
access-list 1 permit any

WebServer: 10.0.0.18

Outside Client: 12.1.1.1

netflow - trace excerpts

Answer 1

Try removing the NAT commands from the lab router.

Answer 2

NAT with an inside source means that the conversation needs to originate from inside (web server). I think you want to use inside destination to specifically let outside originated conversations get to the web server.

Inside destination NAT will also allow you to load share across multiple servers.