Cisco887VAW -VPN NAT-Freigabe

Moin moin,

ich habe mal wieder ein kleines Problem mit meinem 887.

Und zwar: Ich habe einen VPN Tunneln in das 36.0 Netz und durch diesen hindurch sollen alle Geräte einen Webserver (192.168.83.9) in meinem Netz 83.0 erreichen.
Dies klappt soweit auch super, allerdings sobald ich eine NAT-Freigabe für den o.g Webserver setze, kommt man via VPN nicht mehr auf diesen drauf.

Wie kann ich es konfigurieren das dies über beide Wege möglich ist? Also via VPN durch den Tunnel auf den Webserver (192.168.83.9) und via WAN über NAT?!

Hier nun noch meine Konfig. inkl. der NAT-Freigabe:


Building configuration...

Current configuration : 13021 bytes
!
! No configuration change since last restart
! NVRAM config last updated at 21:06:30 CET Tue Jan 17 2017 by admin
!
version 15.1
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime localtime
no service password-encryption
!
hostname Cisco887V
!
boot-start-marker
boot-end-marker
!
!
enable secret
enable password
!
no aaa new-model
!
no process cpu autoprofile hog
memory-size iomem 10
clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
service-module wlan-ap 0 bootimage autonomous
crypto pki token default removal timeout 0
!
!
no ip source-route
no ip gratuitous-arps
ip auth-proxy max-login-attempts 5
ip admission max-login-attempts 5
!
!
!
ip dhcp binding cleanup interval 600
ip dhcp excluded-address 192.168.66.1
ip dhcp excluded-address 192.168.83.1
ip dhcp excluded-address 192.168.83.9
ip dhcp excluded-address 192.168.83.4
ip dhcp excluded-address 192.168.83.200
ip dhcp excluded-address 192.168.83.253
ip dhcp excluded-address 192.168.83.252
ip dhcp excluded-address 192.168.83.251
ip dhcp excluded-address 192.168.83.250
ip dhcp excluded-address 192.168.83.240
ip dhcp excluded-address 192.168.83.100
!
ip dhcp pool local
import all
network 192.168.66.0 255.255.255.0
default-router 192.168.66.1
dns-server 192.168.66.1
!
ip dhcp pool 83.0
import all
network 192.168.83.0 255.255.255.0
default-router 192.168.83.254
dns-server 192.168.83.1
!
!
ip cef
ip ips config location flash:ips retries 1
ip ips notify SDEE
ip ips name iosips
ip ips name ips list 111
!
ip ips signature-category
category all
retired true
category ios_ips basic
retired false
!
ip inspect name myfw tcp
ip inspect name myfw udp
ip inspect name myfw sip
ip inspect name myfw rtsp
ip ddns update method dyndns
HTTP
add http://@members.dyndns.org/nic/update?system=dyndns&hostname=<h>&myip=<a>
interval maximum 0 0 5 0
!
no ipv6 cef
!
!
multilink bundle-name authenticated
chat-script gsm "" "atdt*98*1#" TIMEOUT 180 "CONNECT"
license udi pid CISCO887VGW-GNE-K9 sn FCZ1608C0FW
!
!
username
username
username
!
!
!
crypto key pubkey-chain rsa
named-key realm-cisco.pub signature
key-string
30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
00C19E93 A8AF124A D6CC7A24 5097A975 206BE3A2 06FBA13F 6F12CB5B 4E441F16
17E630D5 C02AC252 912BE27F 37FDD9C8 11FC7AF7 DCDD81D9 43CDABC3 6007D128
B199ABCB D34ED0F9 085FADC1 359C189E F30AF10A C0EFB624 7E0764BF 3E53053E
5B2146A9 D7A5EDE3 0298AF03 DED7A5B8 9479039D 20F30663 9AC64B93 C0112A35
FE3F0C87 89BCB7BB 994AE74C FA9E481D F65875D6 85EAF974 6D9CC8E3 F0B08B85
50437722 69C46F9C A84DFBA5 7A0AF99E AD768C36
006CF498 079F88F8 A3B3FB1F 9FB7B3CB 5539E1D1 9693CCBB 551F78D2 892356AE
2F56D826 8918EF3C 80CA4F4D 87BFCA3B BFF668E9 689782A5 CF31CB6E B4B094D3
F3020301 0001
quit
!
!
controller VDSL 0
shutdown
!
controller Cellular 0
!
ip tcp synwait-time 10
!
crypto keyring VPNMK
pre-shared-key address 0.0.0.0 0.0.0.0
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
!
crypto isakmp client configuration group vpngroup
key
dns 192.168.83.1
domain domainname
pool vpnpool
save-password
max-users 5
banner ^C ^C
!
crypto isakmp client configuration group VPNMK
key
dns 192.168.83.1
domain domainname
pool vpnpoolAO
save-password
max-users 5
banner ^C
^C
crypto isakmp profile VPNclient
description VPN Client Profil
match identity group vpngroup
client authentication list clientauth
isakmp authorization list groupauth
client configuration address respond
virtual-template 2
crypto isakmp profile DynDialin
description VPNs mit dyn. IP
keyring VPNMK
match identity address 0.0.0.0
crypto isakmp profile VPNclient1
description VPN Client Profil Andreas
match identity group VPNMK
client authentication list clientauth
isakmp authorization list groupauth
client configuration address respond
virtual-template 2
!
!
crypto ipsec transform-set myset esp-aes esp-sha-hmac
crypto ipsec transform-set CISCO-WRV esp-3des esp-sha-hmac
!
crypto ipsec profile vpn-vti2
set transform-set myset
!
!
crypto dynamic-map BINTEC 11
set security-association lifetime seconds 86400
set transform-set myset
match address VPNMKDYN1
crypto dynamic-map BINTEC 12
set security-association lifetime seconds 86400
set transform-set myset
match address VPNMKDYN2
crypto dynamic-map BINTEC 13
set security-association lifetime seconds 86400
set transform-set CISCO-WRV
match address VPNMKDYN3
crypto dynamic-map BINTEC 14
set security-association lifetime seconds 86400
set transform-set myset
match address VPNMKDYN4
!
!
crypto map VPN 1 ipsec-isakmp dynamic BINTEC
!
!
!
!
!
interface Ethernet0
no ip address
shutdown
!
interface FastEthernet0
switchport access vlan 2
no cdp enable
!
interface FastEthernet1
no cdp enable
!
interface FastEthernet2
switchport access vlan 11
no cdp enable
!
interface FastEthernet3
switchport access vlan 10
no cdp enable
!
interface Virtual-Template2 type tunnel
description IPsec VPN Dialin
ip unnumbered Vlan1
no ip unreachables
ip flow ingress
ip nat inside
ip virtual-reassembly in
tunnel mode ipsec ipv4
tunnel protection ipsec profile vpn-vti2
!
interface wlan-ap0
description Internes Service Interface zum Management des internen WLAN APs
ip unnumbered Vlan1
no cdp enable
arp timeout 0
!
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
no cdp enable
!
interface Cellular0
no ip address
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer in-band
dialer pool-member 2
crypto map VPN
!
interface Vlan1
ip address 192.168.66.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
ip policy route-map DTAG
!
interface Vlan2
ip address 192.168.83.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan10
no ip address
ip nat outside
ip virtual-reassembly in
pppoe-client dial-pool-number 1
!
interface Vlan11
ip ddns update hostname hostname
ip ddns update dyndns
ip address dhcp
ip access-group 111 in
ip nat outside
ip inspect myfw out
no ip virtual-reassembly in
crypto map VPN
!
interface Dialer0
ip ddns update hostname Hostname2
ip ddns update dyndns
ip address negotiated
ip access-group 111 in
no ip redirects
no ip unreachables
ip mtu 1452
ip flow ingress
ip nat outside
ip ips iosips in
ip ips iosips out
ip inspect myfw out
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname
ppp chap password 0 2
no cdp enable
crypto map VPN
!
interface Dialer1
ip address negotiated
ip access-group 111 in
ip nat outside
ip inspect myfw out
ip virtual-reassembly in
encapsulation ppp
dialer pool 2
dialer idle-timeout 0
dialer string gsm
dialer persistent
ppp chap hostname tm
ppp chap password 0 tm
no cdp enable
crypto map VPN
!
ip local pool vpnpoolAO 192.168.83.104 192.168.83.105
ip local pool vpnpool 192.168.83.101 192.168.83.103
no ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
no ip nat service sip udp port 5060
ip nat inside source static tcp 192.168.83.9 22 interface Vlan11 22
ip nat inside source static tcp 192.168.83.9 50001 interface Vlan11 50001
ip nat inside source static tcp 192.168.83.9 50002 interface Vlan11 50002
ip nat inside source static tcp 192.168.83.9 50003 interface Vlan11 50003
ip nat inside source static tcp 192.168.83.9 50004 interface Vlan11 50004
ip nat inside source static tcp 192.168.83.9 50005 interface Vlan11 50005
ip nat inside source static tcp 192.168.83.9 50006 interface Vlan11 50006
ip nat inside source static tcp 192.168.83.9 50007 interface Vlan11 50007
ip nat inside source static tcp 192.168.83.9 50008 interface Vlan11 50008
ip nat inside source static tcp 192.168.83.9 50009 interface Vlan11 50009
ip nat inside source static tcp 192.168.83.9 21 interface Vlan11 21
ip nat inside source static tcp 192.168.83.9 50000 interface Vlan11 50000
ip nat inside source static tcp 192.168.83.200 554 interface Vlan11 554
ip nat inside source static udp 192.168.83.200 554 interface Vlan11 554
ip nat inside source static tcp 192.168.83.4 25 interface Vlan11 25
ip nat inside source static tcp 192.168.83.4 587 interface Vlan11 587
ip nat inside source static tcp 192.168.83.4 995 interface Vlan11 995
ip nat inside source static tcp 192.168.83.9 443 interface Vlan11 443
ip nat inside source route-map 3g-nat interface Dialer1 overload
ip nat inside source route-map adsl-nat interface Dialer0 overload
ip nat inside source route-map cable-nat interface Vlan11 overload
ip route 0.0.0.0 0.0.0.0 Dialer0 2
ip route 0.0.0.0 0.0.0.0 Dialer1 3
ip route 0.0.0.0 0.0.0.0 Vlan11 dhcp
!
ip access-list extended VPNMKDYN1
permit ip 192.168.83.0 0.0.0.255 192.168.36.0 0.0.0.255
permit ip 192.168.83.0 0.0.0.255 192.168.40.0 0.0.0.255
ip access-list extended VPNMKDYN2
permit ip 192.168.83.0 0.0.0.255 10.250.10.0 0.0.0.255
ip access-list extended VPNMKDYN3
permit ip 192.168.66.0 0.0.0.255 192.168.55.0 0.0.0.255
permit ip 192.168.83.0 0.0.0.255 192.168.55.0 0.0.0.255
ip access-list extended VPNMKDYN4
permit ip 192.168.66.0 0.0.0.255 192.168.40.0 0.0.0.255
!
logging esm config
access-list 101 deny ip 192.168.66.0 0.0.0.255 192.168.55.0 0.0.0.255
access-list 101 deny ip 192.168.66.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 101 permit ip 192.168.66.0 0.0.0.255 any
access-list 102 deny ip 192.168.83.0 0.0.0.255 192.168.55.0 0.0.0.255
access-list 102 deny ip 192.168.83.0 0.0.0.255 10.250.10.0 0.0.0.255
access-list 102 deny ip 192.168.83.0 0.0.0.255 192.168.36.0 0.0.0.255
access-list 102 deny ip 192.168.83.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 102 permit ip 192.168.83.0 0.0.0.255 any
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq domain any
access-list 111 permit tcp any eq domain any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq non500-isakmp
access-list 111 permit esp any any
access-list 111 permit udp any eq ntp any
access-list 111 permit ip host 204.13.248.111 any log-input DynDNS_perm
access-list 111 permit udp any eq bootpc any
access-list 111 permit udp any eq bootps any
access-list 111 permit icmp any any echo
access-list 111 permit tcp any any eq ftp
access-list 111 permit tcp any any eq 22
access-list 111 permit udp any eq 5060 any
access-list 111 permit tcp any any eq 50000
access-list 111 permit tcp any any eq 50001
access-list 111 permit tcp any any eq 50002
access-list 111 permit tcp any any eq 50003
access-list 111 permit tcp any any eq 50004
access-list 111 permit tcp any any eq 50005
access-list 111 permit tcp any any eq 50006
access-list 111 permit tcp any any eq 50007
access-list 111 permit tcp any any eq 50008
access-list 111 permit tcp any any eq 50009
access-list 111 permit udp any eq 554 any
access-list 111 permit tcp any eq 554 any
access-list 111 permit tcp any any eq smtp
access-list 111 permit tcp any any eq 995
access-list 111 permit tcp any any eq 587
access-list 111 permit gre any any
access-list 111 permit tcp any any eq 443
dialer-list 1 protocol ip list 101
no cdp run

!
!
!
!
route-map 3g-nat permit 10
match ip address 101 102
match interface Dialer1
!
route-map cable-nat permit 10
match ip address 101 102
match interface Vlan11
!
route-map adsl-nat permit 10
match ip address 101 102
match interface Dialer0
!
!
control-plane
!
alias exec zumwlanap service-module wlan-ap 0 session
banner login
!
line con 0
exec-timeout 0 0
no modem enable
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
line 3
script dialer gsm
no exec
rxspeed 7200000
txspeed 5760000
line vty 0 4
access-class 23 in
privilege level 15
password
login local
transport input ssh
!
scheduler max-task-time 5000
ntp master
ntp server 130.149.17.8 source Dialer0
ntp server 130.149.17.8 source Vlan11
end

ip nat inside source route-map cable-nat interface Vlan11 overload

route-map cable-nat permit 10
match ip address 101
match interface Vlan11

access-list 101 deny ip 192.168.66.0 0.0.0.255 192.168.55.0 0.0.0.255
access-list 101 permit ip 192.168.66.0 0.0.0.255 any

ip nat inside source static tcp 192.168.83.9 443 interface Vlan11 443