Ole, it all depends , if you want ALL vpn users under your current tunnel group without exeption to access only one destination host 192.168.1.250 on port 80 sure it is posible , you would t need to define it in your nonat access list and crypto acl.
would be something as:
access-list nonat permit ip host 192.168.1.250 192.168.200.0 255.255.255.0
access-list permit tcp host 192.168.1.250 192.168.200.0 255.255.255.0 eq 80
nat (inside) 0 access-list nonat
but if you then need to get more granular such as permiting some users to the whole subnet 192.168.1.0/24 and some just 192.168.1.250 then it can not be possible with 6.3 code, you would need 7.x code above to do per user VPN filters ..
a work around perhaps with 6.3 if the need to restrict access to just one host to certain VPN users but not all I would think of a work around to create another RA tunnel group with restrictions and add users to that new tunnel group , and have a separate VPN tunnel group for accessing all 192.168.1.0/24 network. This way you could have control of users access per tunnel groups.
If you ever think of upgrading your 501 to ASA5505 here is a link on vpn filters.
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml
Regards
Jorge Rodriguez
