!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname XXXX
!
enable password XXXX
!
ip subnet-zero
!
ip dhcp pool sdm-pool
   network 192.168.0.0 255.255.255.0
   dns-server 212.188.4.10
   netbios-name-server 192.168.0.250
   default-router 192.168.0.250
   lease 0 2
!
ip inspect name Ethernet_0 tcp
ip inspect name Ethernet_0 udp
ip inspect name Ethernet_0 cuseeme
ip inspect name Ethernet_0 ftp
ip inspect name Ethernet_0 h323
ip inspect name Ethernet_0 rcmd
ip inspect name Ethernet_0 realaudio
ip inspect name Ethernet_0 smtp
ip inspect name Ethernet_0 streamworks
ip inspect name Ethernet_0 vdolive
ip inspect name Ethernet_0 sqlnet
ip inspect name Ethernet_0 tftp
ip audit notify log
ip audit po max-events 100
!
!
!
interface Ethernet0
ip address xx.xx.2.70 255.255.255.248
ip access-group s0-in in
ip nat outside
half-duplex
!
interface FastEthernet0
ip address 192.168.0.250 255.255.255.0
ip nat inside
ip inspect Ethernet_0 in
speed auto
!
interface Serial0
no ip address
shutdown
!
ip nat pool MAIL xx.xx.2.66 xx.xx.2.68 prefix-length 24
ip nat inside source list 1 interface Ethernet0 overload
ip nat inside source list 101 pool MAIL overload
ip nat inside source static tcp 192.168.0.47 110 xx.xx.2.66 110 extendable
ip nat inside source static tcp 192.168.0.47 25 xx.xx.2.66 25 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 xx.xx.2.65
no ip http server
!
!
ip access-list extended s0-in
deny   ip 192.168.0.0 0.0.255.255 any
deny   ip 0.0.0.0 0.255.255.255 any
deny   ip host 255.255.255.255 any
deny   ip 127.0.0.0 0.255.255.255 any
deny   ip 224.0.0.0 15.255.255.255 any
deny   ip 240.0.0.0 7.255.255.255 any
deny   ip 10.0.0.0 0.255.255.255 any
deny   ip 172.16.0.0 0.15.255.255 any
deny   ip 192.0.2.0 0.0.0.255 any
deny   ip 169.254.0.0 0.0.255.255 any
permit tcp any host xx.xx.2.66 eq smtp
permit tcp any host xx.xx.2.66 eq pop3
permit tcp any host xx.xx.2.66 eq 4899
permit icmp any any
deny   ip any any
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 101 permit tcp host 192.168.0.47 eq smtp any
access-list 101 permit tcp host 192.168.0.47 eq pop3 any
snmp-server community st_public RO
snmp-server community st_private RW
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server host xx.xx.62.158 st_private
!
line con 0
stopbits 1
line aux 0
line vty 0 4
access-class 7 in
exec-timeout 30 0
password xxxx
!
no scheduler allocate
end

Вот конфиг кошки. 192.168.0.47 это почтовик. Нат работает, Снаружи все мыло работает. А за кошкой, из диапазона 192.168.0.x, почтовик доступен только по своему внутреннему ip. Вопрос - что я не так делаю?