Right - lets start again :)
If you want to allow incoming access to network 192.168.2.0 do you mean connections initiated from outside. If so you need to use static NAT to setup a one-to-one translation for the 192.168.2.x hosts you want to give access to ie. you cannot rely on the dynamic NAT as you go out. It got a bit confusing because we kept using 84.92.xxx.xxx so lets use some dummy public IP addresses.
Outside interface of your router =
84.72.31.10
int dialer0
ip nat outside
ip access-group 101 in
int vlan 1
ip nat inside
ip access-group 102 in
So easy access-list first.
access-list 102 permit ip 192.168.2.0 0.0.0.255 any
then you need to make sure all 192.168.2.x hosts are natted so
access-list 103 permit ip 192.168.2.0 0.0.0.255 any
ip nat inside source list 103 interface dialer0 overload
the above allows all IP to be initiated from the 192.168.2.0 network to the internet and NAT's it to the outside interface.
Now for the harder bit
access-list 101 permit tcp any host 84.72.31.10 established
** this line allows return traffic for TCP connections to be allowed back in.
The established keyword only works for TCP so if you needed udp to be allowed back in then you need to add that in for each port you want eg.
access-list 101 permit udp any 84.72.31.10
Notice the way round this is. This is because the source UDP port coming back will the service and it will be in response to a connection initiated from inside eg.
if 192.168.2.15 initiates a DNS request to a DNS server then this will be allowed out because of acl 102 on vlan 1 interface. The destination port would be UDP 53 but the source port could be anything. When the packet returns the source port is now 53 because it is a response back from a DNS server.
Now the rest of your acl 101 is dependant what you want to give access to and how many spare public IP addresses you have. Lets say you have 1 spare public IP
84.72.31.11
and you wanted to give access to host 192.168.2.20 using http
you would need to add the following line to your config
ip nat inside source static 84.72.31.11 192.168.2.20
and then update your acl
access-list 101 permit tcp any host 84.72.31.11 eq www
Key thing is when traffic is initiated from 192.168.2.x network to internet you can hide all the 192.168.2.x addresses behind the one public IP of your outside interface. But when traffic is initiated from outside you need to tell the router which 192.168.2.x private IP the public IP is attached to.
Really sorry if i have confused you.
Jon
