I am using a 1711 Security router to connect a small network to the Internet. Internet side is using a single IP address (NAT overload). The router is also an Easy VPN server for a number of PC clients. I want to allow incomming connections for mail (port 25) to static NAT to an internal mail server but at the same time allow the VPN users to access port 25 directly no NAT translations. I am using an "ip nat inside source route-map vpn-map interface fastethernet 0 overload" statement to exclude inside network to VPN connections from being NAT'ed. IF I then add an "ip nat inside source static inside.ip 25 outside.ip 25" statement I can access the mail server from outside but loose the ability to access the mail server port 25 from a VPN. It seems I need to exclude the static statement from the inside to VPN but can't seem to figure out how to get it right.
