One of the basic questions that every administrator have is about configuring static NAT for the services they provide for their customers (mail/web/application/VoIP etc). I have myself answered this question a lot of times in Experts-Exchange. So here is the standard configuration;
Cisco Router :
ip nat inside source static <protocol> <InternalIP> <Port> <PublicIP> <Port>
access-list <Number> permit tcp any host <PublicIP> eq <Port>
int <Internal>
ip nat inside
int <External>
ip nat outside
ip access-group <Number> in
So using the above if I want to allow web server access, the configuration would be as below; Assuming Public IP = 11.12.13.14 and Private IP = 10.10.10.10, Internal Interface = Ethernet0/0, External Interface = Serial0/0
ip nat inside source static tcp 10.10.10.10 80 11.12.13.14 80
access-list 100 permit tcp any host 11.12.13.14 eq 80
int e0/0
ip nat inside
int s0/0
ip nat outside
ip access-group 100 in
