Cisco IOS – How to Obtain Cisco IOS Firmware

I am not quite sure what you want, but if you just want to map port 80 of an external to ip to an internal ip port 80. I think you pretty much have it, but I think you might just need to change:

ip nat inside source static tcp  80 10.10.10.60 80 extendable

to

ip nat inside source static tcp 98.123.123.94 80 10.10.10.60 80 extendable

But besides this, if this is production, once you have it working the way you think you want. You might want to pay a consultant to come in and check your work, it doesn't get much more important than the router.

The command is

ip nat inside source static <internal address> <public address>

for NATing the an entire IP, or

ip nat inside source static tcp <internal address> <port> <public address> <port>
ip nat inside source static udp <internal address> <port> <public address> <port>

For specifc udp or tcp ports.

Then you need to have an access list on the outside interface that permits access to the port on the public address.

Also, make sure you have ip nat inside on the inside interface and ip nat outside on the outside interface

Update 1

The access-list bound to the external interface needs to include a rule to allow the incoming connection. Lets say you have port 80 is the port you want to forward. Lets also say that Dialer0 is your outside interface and FastEthernet0 is your inside, and 10.1.1.1 is the internal IP address:

interface FastEthernet 0
    ip nat inside
!
interface Dialer 0
    ip nat outside
    ip access-group outside-in in
!
ip nat inside source static tcp 10.1.1.1 80 interface Dialer0 80

ip access-list extended outside-in
    permit tcp any any eq 80
    deny ip any any

Note that with this example, I have bound the NAT to the Dialer0 interface so that we don't need to hard code the IP address into the config - it will take whatever address the D0 interface has as the public address.

Also note that the permit command in the access-list allows access to any IP on port 80. Only use this method if the router does not route other addresses than the one used for the outside interface. Otherwise, hardcode host <ip address> where the IP address is that of the outside interface in place of the second "any"