I've been trying to figure out this problem, and I'm just not up to the task. I have a Cisco 2911 router as follows:

Internet connection on GigabitEthernet0/1. Which has it's own static IP: A.B.C.38/30 And we also have some IPs allocated to us:


Which I use for NATing some services, and also for the PPPOE clients (detailed below)

Internal LAN connection on GigabitEthernet0/0.100

The router has also been setup as a PPPOE concentrator as we have some people who need an Internet connection through a microwave network through our network. I basically have VLANs set up for this, so I also have:

GigabitEthernet0/0.400, 500, and 600.

Finally, one of these people, have their own server located in our server room. This server is setup on it's own subnet and VLAN.

GigabitEthernet0/0.302 which has the IP They run a server with VMWare, and have different VMs running on:,, etc.

I have some static NAT rules written up to get these on the public IP address: A.B.C.41.

Now for the most part, everything is working correctly. The PPPOE clients get their external IPs and can browse the Internet fine. The NATed servers can be reached externally without problems, that's all fine.

Our internal network computers are NATed to our public IP address fine, and we can browse.

Now, there are two problems. First, our internal NATed computers can't browse to the external address of any of our static NATed servers. So, for example. If I try to browse to A.B.C.41 from our internal network, it doesn't work, it times out (obviously, etc) work.

Secondly, any of the PPPOE clients (which end up with their own global public IPs A.B.C.42 - 44) can't browse to A.B.C.41 either.

The first problem, isn't really a problem. And I actually solved that by switching to what I believe is called a hairpin NAT? I basically rewrote all the NAT rules to remove "inside" and "outside", but that didn't solve the second problem, which is the actual problem I care about. (I've moved back to using "inside" and "outside" for the moment)

Here's what I believe, are the relevant details from the router config:

bba-group pppoe global
 virtual-template 2

interface Loopback0
 description IP for Unnumbered Tunnel Interfaces
 ip address

interface GigabitEthernet0/0.100
 description NetworkMaint
 encapsulation dot1Q 100 native
 ip address
 ip nat inside
 ip nat enable
 ip virtual-reassembly in
 ip ospf 100 area 0

interface GigabitEthernet0/0.300
 description Mushy PPPOE
 encapsulation dot1Q 300
 pppoe enable group global

interface GigabitEthernet0/0.302
 description Mushy Server
 encapsulation dot1Q 302
 ip address
 ip nat inside
 ip nat enable
 ip virtual-reassembly in

interface GigabitEthernet0/1
 bandwidth 50000
 ip address A.B.C.38
 ip access-group 160 out
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip nat enable
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable

interface Virtual-Template2
 description PPPOE Concentrated Client
 mtu 1492
 ip unnumbered Loopback0
 no peer default ip address
 ppp authentication chap

ip local pool shared-client-pool A.B.C.42 A.B.C.46
ip default-gateway A.B.C.37

no ip nat service alg tcp dns
no ip nat service alg udp dns
ip nat pool Mushy-Server A.B.C.41 A.B.C.41 netmask
ip nat source static tcp 8443 A.B.C.38 443 extendable
ip nat inside source list 10 pool Mushy-Server overload
ip nat inside source route-map NAT-Fibre interface GigabitEthernet0/1 overload
ip nat inside source static tcp 3000 A.B.C.38 80 extendable
ip nat inside source static tcp 25 A.B.C.41 25 extendable
ip nat inside source static tcp 80 A.B.C.41 80 extendable
ip nat inside source static tcp 8080 A.B.C.41 8080 extendable

ip route

ip access-list extended LOCAL-LAN
 permit ip any

access-list 10 remark -=Mushy Server=-
access-list 10 permit
access-list 11 remark -=Hosted Services=-
access-list 11 permit A.B.C.40

route-map NAT-Fibre permit 10
 match ip address LOCAL-LAN
 match interface GigabitEthernet0/1

route-map NAT-Mushy-Server permit 10
 match ip address MUSHY-SERVER
 match interface GigabitEthernet0/0.302

Basically, I would love to have the PPPOE clients be able to use the address A.B.C.41.

Any ideas, or help is greatly appreciated.

  • I'm pretty sure the problem is that the .41 address is in the same network as the .42, .43 etc. Routers route between networks, not from a network back to the same network. You must bridge for a host on a network to reach another host on the same network.
    – Ron Maupin
    Commented Feb 9, 2018 at 2:21
  • That sounds right, but the interface doesn't actually have those addresses associated with any interface. I'm pretty sure when I did some tracing, it sent the packets out the the gateway and then the gateway sent them back. When the gateway sent them back, I was sure that the router would follow the NAT rule? A problem I have is just visibility on here exactly packets are going, and why.
    – Mike
    Commented Feb 9, 2018 at 2:26
  • It's not the addresses on the interfaces, but the addresses on the packets. For example, the hairpin works because the packet addressing is from a network (LAN) to a different network (WAN), but not with the PPPoE to the .41 address because they are in the same network. The routing process typically ignores packets destined to the same network from which they originated. You may be able to do something with IRB.
    – Ron Maupin
    Commented Feb 9, 2018 at 2:31
  • What happens if you add a ip nat outside to the template interface and have the client reestablish PPP? Commented Jul 13, 2018 at 21:33


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.