IP static nat

[murindagomo]

Hi all.

I have a Cisco ISR4221 Router with a public IP address for internet on Gi0/0/0 and LAN is connected on Gi0/0/1. I also have a second public IP address subnet that is configured as a sub-interface GI0/0/0.100 which has a static NAT for a web server on the LAN such that the web server can be reached from the internet (This works fine). The static NAT uses public IP A.B.C.D to private IP 192.168.1.10. PCs on the LAN can reach the web server by using IP address 192.168.1.10. It is required for PCs on the LAN to be able to reach the web server by using its public IP A.B.C.D as well however this is failing. For example 192.168.1.11 can reach the web server 192.168.1.10 but cannot reach it by using its public IP A.B.C.D. How can this be achieved?

[balaji.bandi]

what is the version of code running, below example of hairpin what you looking - the concept is the same but if you have the latest IOS XE some command syntax may be changed :

https://community.cisco.com/t5/routing/how-to-do-nat-reflection-nat-hairpin-on-a-cisco-1800-router/td-p/2754725

[MHM Cisco World]

this need hairpin and I think that ISR4K not support NVI. 
https://stucknactive.com/2019/05/09/11-16-configuring-nat-virtual-interface/

[murindagomo]

Good day all.

I have followed hairpin configuration as advised and I don't get internet. Also hairpin fails to work. Below is my running config if you can please point out what could be wrong:

interface Loopback1
ip address 172.31.255.1 255.255.255.255
ip nat inside
!
interface GigabitEthernet0/0/0
description **** INTERNET ****
ip address 58.167.85.105 255.255.255.254
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/0.100
encapsulation dot1Q 100
ip address 58.167.66.130 255.255.255.252
!
interface GigabitEthernet0/0/1
description *** LAN *****
ip address 192.168.116.254 255.255.255.0
no ip redirects
ip nat outside
ip policy route-map PBR-LAN
negotiation auto
!
no ip nat service sip tcp port 5060
no ip nat service sip udp port 5060
ip nat inside source static 192.168.116.47 58.167.66.129
ip nat inside source list ACL_HAIRPIN_NAT interface Loopback1 overload
ip nat inside source list ACL_INTERNET_NAT interface GigabitEthernet0/0/0 overload
ip nat inside source list NAT interface GigabitEthernet0/0/0 overload
no ip forward-protocol nd
ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 58.167.85.104
!
!
!
ip access-list extended ACL_HAIRPIN_NAT
permit ip 192.0.0.0 0.255.255.255 host 192.168.116.47
ip access-list extended ACL_INTERNET_NAT
permit ip 192.0.0.0 0.255.255.255 host 192.168.116.47
deny ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255
permit ip 192.0.0.0 0.255.255.255 any
!
!
route-map PBR-LAN permit 10
set interface Loopback1
!

[MHM Cisco World]

just check if your router support 
ip nat enable 
command 

[murindagomo]

Unfortunately the router does not support ip nat enable

[MHM Cisco World]

from @balaji.bandi  link read this you will get answer why I mention NVI (nat enable )
""Hi Ken,

I am sorry this response took so long. The last week has been very busy and I had to focus on tasks at hand.

Okay, so, definitely, starting with very recent 12.4T and 15.x IOSes, the PBR approach for the NAT hairpinning no longer works. The configuration shown above would work only for older 12.4T IOSes and their predecessors (I've tested it on 12.4(15)T13 where the PBR-based approach works but any newer IOS after that should be considered as not suitable for the PBR-based style).

It seems, however, that this task should in fact be solvable using the newer NVI style of NAT configuration, and that the configuration will in fact be very simple. In order for me to provide you with the most direct configuration changes, may I ask you to post your current working configuration (in which the NAT hairpinning is not implemented yet)? I will make sure to respond within an hour or two after getting your current configuration.""

[murindagomo]

The router does not support ip nat enable and PBR hairpinning is no longer supported. How best can I achieve this?

[balaji.bandi]

if the router does not support. punch hole in your local DNS, pointing to local IP address

so external  yourdomain.com (poublic IP)

internal yourdomain.com (local ip)