Port Forwarding - External to Internal

[KWMDIT]

Sorry if this is very simple, but my Cisco knowledge is dated and I'm not hands on anymore, but needs must at the moment.

I have a Cisco 800 series router with a public IP assigned to the dialler interface (call it 1.1.1.1 for this purpose).

The router has a VLAN (/24 subnet) assigned and DHCP is handing out addressed to the 4 interfaces on the router.

I have a device on port 3 that I need to be able to access from the outside world.  The IP of this device is 2.2.2.2 (for this purpose).

I want to lock access to a single external public IP (call it 3.3.3.3 for now).

So after that ramble, I want any traffic (on any TCP/UDP ports) coming to the router from an external public IP of 3.3.3.3 to be redirected to the router port 3 (device of which is 2.2.2.2 private IP).

I am pretty sure I can do this with access-lists and port forwarding, but I'm far too rusty to grasp it I'm afraid.

ip nat outside is already set on the dialler interface, and ip nat outside is set on the internal VLAN that the ports all sit in.

[KWMDIT]

Anyone?

[paul driver]

Hello

Sounds like you require port address translation (PAT)
Example: <  this will allow access to the internal host 2.2.2.2 using the public ip of 3.3.3.3 on tcp port 80 and udp port 69

ip nat inside source static tcp 2.2.2.2 80 3.3.3.3 80 
ip nat inside source static udp 2.2.2.2 69 3.3.3.3 69
ip nat inside source static 2.2.2.2  3.3.3.3  < or you can just allow all the ip stack

[KWMDIT]

Thank you for the reply.  But no progress I'm afraid.

I entered exactly as you stated.  I tried for TCP 443 (as the internal device has a web GUI) and also without to just allow the entire stack as you suggested.

My test machine is at home so I use my public IP instead of the 3.3.3.3 in the example, and the internal private IP of the device instead of the 2.2.2.2.  Then open my browser and go to https://1.1.1.1 (where 1.1.1.1 is the public address of the dialler interface on the router).

Am I missing something?