I've been trying to figure out this problem, and I'm just not up to the task. I have a Cisco 2911 router as follows:
Internet connection on GigabitEthernet0/1. Which has it's own static IP: A.B.C.38/30 And we also have some IPs allocated to us:
A.B.C.40/29
Which I use for NATing some services, and also for the PPPOE clients (detailed below)
Internal LAN connection on GigabitEthernet0/0.100
The router has also been setup as a PPPOE concentrator as we have some people who need an Internet connection through a microwave network through our network. I basically have VLANs set up for this, so I also have:
GigabitEthernet0/0.400, 500, and 600.
Finally, one of these people, have their own server located in our server room. This server is setup on it's own subnet and VLAN.
GigabitEthernet0/0.302 which has the IP 172.16.80.254/24. They run a server with VMWare, and have different VMs running on: 172.16.80.1, 172.16.80.2, etc.
I have some static NAT rules written up to get these on the public IP address: A.B.C.41.
Now for the most part, everything is working correctly. The PPPOE clients get their external IPs and can browse the Internet fine. The NATed servers can be reached externally without problems, that's all fine.
Our internal network computers are NATed to our public IP address fine, and we can browse.
Now, there are two problems. First, our internal NATed computers can't browse to the external address of any of our static NATed servers. So, for example. If I try to browse to A.B.C.41 from our internal network, it doesn't work, it times out (obviously 172.16.80.1, etc) work.
Secondly, any of the PPPOE clients (which end up with their own global public IPs A.B.C.42 - 44) can't browse to A.B.C.41 either.
The first problem, isn't really a problem. And I actually solved that by switching to what I believe is called a hairpin NAT? I basically rewrote all the NAT rules to remove "inside" and "outside", but that didn't solve the second problem, which is the actual problem I care about. (I've moved back to using "inside" and "outside" for the moment)
Here's what I believe, are the relevant details from the router config:
bba-group pppoe global
virtual-template 2
interface Loopback0
description IP for Unnumbered Tunnel Interfaces
ip address 1.1.1.1 255.255.255.255
interface GigabitEthernet0/0.100
description NetworkMaint
encapsulation dot1Q 100 native
ip address 192.168.100.1 255.255.255.0
ip nat inside
ip nat enable
ip virtual-reassembly in
ip ospf 100 area 0
interface GigabitEthernet0/0.300
description Mushy PPPOE
encapsulation dot1Q 300
pppoe enable group global
interface GigabitEthernet0/0.302
description Mushy Server
encapsulation dot1Q 302
ip address 172.16.80.254 255.255.255.0
ip nat inside
ip nat enable
ip virtual-reassembly in
interface GigabitEthernet0/1
bandwidth 50000
ip address A.B.C.38 255.255.255.252
ip access-group 160 out
no ip unreachables
no ip proxy-arp
ip nat outside
ip nat enable
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
interface Virtual-Template2
description PPPOE Concentrated Client
mtu 1492
ip unnumbered Loopback0
no peer default ip address
ppp authentication chap
ip local pool shared-client-pool A.B.C.42 A.B.C.46
ip default-gateway A.B.C.37
no ip nat service alg tcp dns
no ip nat service alg udp dns
ip nat pool Mushy-Server A.B.C.41 A.B.C.41 netmask 255.255.255.248
ip nat source static tcp 192.168.1.46 8443 A.B.C.38 443 extendable
ip nat inside source list 10 pool Mushy-Server overload
ip nat inside source route-map NAT-Fibre interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.1.46 3000 A.B.C.38 80 extendable
ip nat inside source static tcp 172.16.80.2 25 A.B.C.41 25 extendable
ip nat inside source static tcp 172.16.80.1 80 A.B.C.41 80 extendable
ip nat inside source static tcp 172.16.80.60 8080 A.B.C.41 8080 extendable
ip route 0.0.0.0 0.0.0.0 202.74.164.37
ip access-list extended LOCAL-LAN
permit ip 192.168.0.0 0.0.255.255 any
access-list 10 remark -=Mushy Server=-
access-list 10 permit 172.16.80.0 0.0.0.255
access-list 11 remark -=Hosted Services=-
access-list 11 permit A.B.C.40 0.0.0.7
route-map NAT-Fibre permit 10
match ip address LOCAL-LAN
match interface GigabitEthernet0/1
route-map NAT-Mushy-Server permit 10
match ip address MUSHY-SERVER
match interface GigabitEthernet0/0.302
Basically, I would love to have the PPPOE clients be able to use the address A.B.C.41.
Any ideas, or help is greatly appreciated.
.41address is in the same network as the.42,.43etc. Routers route between networks, not from a network back to the same network. You must bridge for a host on a network to reach another host on the same network..41address because they are in the same network. The routing process typically ignores packets destined to the same network from which they originated. You may be able to do something with IRB.ip nat outsideto the template interface and have the client reestablish PPP?