PAT interfers with Web Server Access over L2 tunnel

[clyde.a.huffman.ctr@mail.mil]

I'm working on a network to accomplish 3 things:

1) NAT overload to the internet

2) L2 tunnels to remote users

3) PAT subcontractors to the Web server on the outside interface with port mapping

PROBLEM STATEMENT

Everything is working except the PAT (ip nat inside source static tcp 192.168.175.66 80 interface GigabitEthernet0/0 8080) stops the remote user (over the L2 tunnel) from accessing the web server.  If I remove t he PAT,  Web access for the remote user is good.  See the tcpdump on the Web Server showing http coming in but not getting out (note length 0 shows that the hand-shake fails).

QUESTION

How can I change to PAT to allow normal access to the Web Server over L2.

This is the test configuration I'm using to simulate the WAN.  Attached are the two configurations and the tcpdump.

[luis_cordova]

hi clyde.a.huffman.ctr@mail.mil,

Query:
In the public inetrface you have this ACL configured:

interface GigabitEthernet0/0
 description OUTSIDE
 ip address 192.168.168.235 255.255.255.0
 ip access-group REMOTE_OUTSIDE_IN_ACL in
 ip nat outside

ip access-list extended REMOTE_OUTSIDE_IN_ACL
 permit tcp host 192.168.168.140 host 192.168.168.235 eq 8080
 deny   tcp any host 192.168.168.235 eq 8080
 deny   udp any host 192.168.168.235 eq 8080
 permit ip any any

In it, you only allow traffic from host 192.168.168.140.
Is this ACL the one blocking the traffic?

Regards

[clyde.a.huffman.ctr@mail.mil · Accepted solution]

My mistake again.  The problem is there. 

If I leave the REMOTE_OUTSIDE_IN_ACL but remove the nat ((ip nat inside source static tcp 192.168.175.66 80 interface GigabitEthernet0/0 8080)) the web server access is good through the tunnel.....

[luis_cordova]

Hi clyde.a.huffman.ctr@mail.mil,

I'm glad I helped you.

Regards