>это скорее баг чем фича.
>конфиг в студию. и попробуйте софт поменять на более свежий

!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname host
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
!
resource policy
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
!

ip cef
!
!
!
ip domain name host.ru
vpdn enable
!
vpdn-group 1
!
vpdn-group 2
! Default PPTP VPDN group
accept-dialin
  protocol pptp
  virtual-template 1
!
!
!
!
!
crypto isakmp policy 1
hash md5
authentication pre-share
lifetime 3600
crypto isakmp key xxx address x.x.x.x
!
!
crypto ipsec transform-set ts1 esp-des esp-md5-hmac
!
crypto map xxx 1 ipsec-isakmp
description name
set peer x.x.x.x
set transform-set ts1
set pfs group1
match address 102
!
!
!
interface Tunnel0
description ipsec
ip address x.x.x.x x.x.x.x
tunnel source x.x.x.x
tunnel destination x.x.x.x
tunnel mode ipip
crypto map xxx
!
interface FastEthernet0/0
description external
mac-address 0021.1234.4325
ip address x.x.x.x 255.255.255.240
no ip proxy-arp
ip nat outside
ip virtual-reassembly
ip tcp adjust-mss 1452
duplex auto
speed auto
!
interface FastEthernet0/1
description $ETH-WAN$
no ip address
duplex auto
speed auto

!
interface FastEthernet0/0/0
!
interface FastEthernet0/0/1
!
interface FastEthernet0/0/2
!
interface FastEthernet0/0/3
!
interface Virtual-Template1
ip unnumbered Vlan1
ip mroute-cache
peer default ip address pool PPTP
ppp encrypt mppe auto required
ppp authentication ms-chap ms-chap-v2
!
interface Vlan1
ip address 192.168.150.61 255.255.255.0
ip nat inside
ip virtual-reassembly
ip flow egress
!
!
ip local pool PPTP 192.168.150.196 192.168.150.224
ip classless
ip route 0.0.0.0 0.0.0.0 x.x.x.x
ip flow-export version 5
ip flow-export destination x.x.x.x 9996
!
no ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 5 life 86400 requests 10000
ip nat inside source list 10 interface FastEthernet0/0 overload
!
access-list 10 permit 192.168.150.0 0.0.0.255
access-list 102 permit ip host 192.168.190.131 host 192.168.190.130
access-list 110 permit ip any any
access-list 199 deny   ip any any
route-map FLOW permit 10
match ip address 199
!
!
!
control-plane
!
!
line con 0
login local
line aux 0
line vty 0 4
exec-timeout 0 0
privilege level 15
login local
transport input ssh
line vty 5 15
privilege level 15
login local
transport input ssh
!
end

если включить на vlan1 ip route-cache flow, то нат работает, но трафик экспортируется и исходящий с интерфейса и входящий, игрался с ip policy route-map -- не помогло.