problems with NAT in DMZ

[Christian6]

Dear all,

I'm trying to setup a secure network for hosting a webapplication. I'm using 2 cisco 1841 routers for setting up a DMZ.

I have succesfully created a NAT from the WebServer (192.168.1.2) to the Internet (209.165.200.227) and a NAT from AdministratorPC (192.168.10.2, VLAN 10) to the internet, using NAT overloading.

For the above to work, I've set interface fa0/0 on DMZRouter (the one to the internet, 209.165.200.0/24) to 'nat outside'.

Interface fa0/1 on DMZRouter (to the webserver, 192.168.1.0/29) and interface s0/0/0 on DMZRouter (to OfficeRouter) are set to 'nat inside'.

What I'm missing now is a NAT from DatabaseServer to the 192.168.1.0/29 network. But to create this NAT we must set interface fa0/1 on DMZRouter (to the WebServer, 192.168.1.0/29) to 'nat outside', but that is not possible because it should also be 'nat inside' (for the above NATs to work).

Is there any way to solve this?

Thanks in advance,

Christian

[dominic.caron]

Why are you trying to NAT from the DMZ to the inside network. There is no security benefit to doing that and it will make troubleshooting more difficult.