Собсно без ната впн работает, с натом нет. Пришлось пока обойтись костылем в виде route-map. Но очень хочется от него избавится. Конфиг вот:

!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname xxxxxxxx
!
boot-start-marker
boot-end-marker
!
! card type command needed for slot/vwic-slot 0/0
logging buffered 51200 warnings
!
no aaa new-model
clock timezone PCTime 3
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
dot11 syslog
!
!
ip cef
!
!
ip domain name yourdomain.com
ip name-server 217.67.178.162
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
ip address-pool local
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
  protocol pptp
  virtual-template 1
!
voice-card 0
no dspfarm
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto pki trustpoint TP-self-signed-1512721406
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1512721406
revocation-check none
rsakeypair TP-self-signed-1512721406
!
!
crypto pki certificate chain TP-self-signed-1512721406
certificate self-signed 01
  <-поскипано->
!
!
username xxxxx privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
username xxxx privilege 0 password 0 xxxxxx
archive
log config
  hidekeys
!
!
!
!
ip tcp path-mtu-discovery
ip ssh time-out 60
ip ssh version 2
!
!
!
!
interface GigabitEthernet0/0
description $ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$$ETH-LAN$
ip address 192.168.9.1 255.255.252.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1
description $ETH-WAN$
ip address 217.67.xxx.xxx 255.255.255.248
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
media-type rj45
!
interface Virtual-Template1
ip address negotiated
ip tcp adjust-mss 1420
peer default ip address pool vpdn
ppp authentication chap callin
!
ip local pool vpdn 192.168.9.10 192.168.9.15
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 217.67.xxx.xxx
!
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source route-map Internet interface GigabitEthernet0/1 overload
/* было так: ip nat inside source list 11 interface GigabitEthernet0/1 overload
/*
!
access-list 10 remark NAT
access-list 10 permit 192.168.9.1
access-list 10 permit 192.168.9.3
access-list 10 permit 192.168.9.2
access-list 10 permit 192.168.9.4
/*было так access-list 11 remark nat
           access-list 11 permit 192.168.9.0 any
/*
!
!
!
route-map Internet permit 20
match ip address 10
!
!
!
!
control-plane
!
!
!
voice-port 0/1/0
!
voice-port 0/1/1
!
voice-port 0/3/0
!
voice-port 0/3/1
!
!
!
!
!
!
!
banner login C


!
line con 0
login local
line aux 0
line vty 0 4
privilege level 15
login local
transport input telnet ssh
line vty 5 15
privilege level 15
login local
transport input telnet ssh
!
scheduler allocate 20000 1000
!
end  

В чем грабли?