If I understand right what you are exlaining then your VPN Site-2-Site Tunnel is allready up, but you are not able to connect to a specific port right.
The VPN Tunnel is not controlled by the outside interface access-list if there is one then it is in the VPN config.
The problem could be:
1. Setup of the access-list:
NOTE: Your NONAT looks ok !
PIX(config)# access-list NONAT permit ip Internalnet ISubnet Externalnet Esubnet
PIX(config)# nat (inside) 0 access-list NONAT
Then you can restrict access to a few ports or IP addresses on both sides. Check if you have that kind of access-list in your PIX setup.
PIX(config)# access-list VPN permit ip Internalnet ISubnet Externalnet ESubnet
PIX(config)# crypto map REMOTE 10 match address VPN
Normaly the VPN Tunnels does not have restrictions !
2.) Investigate if you have routing problems. Can you ping or traceroute from one or the other sides.
Might be good starting point to try to ping from the Destination server where you try to connect. Try another port or application as Remote Desktop server.
3.) That port might be just allowed from the local LAN but not from the remote one. See if there is a local firewall service running.
4.) Troubleshoot with the capture command on the PIX to see until who the packets are going:
example:
access-list 120 permit tcp any any eq 19813
access-list 120 permit tcp any any eq 19814
capture vpncap access-list 120 interface inside
show capture vpncap access-list 120 detail
to remove the capture:
no capture http access-list 120 interface inside
Hope this gives a good starting point.
sincerely
Patrick
