Cisco 870 not getting the Internet

have a 870 with the following configuration that can get to the VPN but not to the Internet. I am brain dead from looking at it all day. Can someone assist? HELP!!


version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Estero
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 4096
logging console critical
enable secret 5 $1$x2YZ$meRsNv4JZyUBcdW7PXyWj1
!
no aaa new-model
clock timezone PCTime -5
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
!
crypto pki trustpoint TP-self-signed-2940161907
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2940161907
revocation-check none
rsakeypair TP-self-signed-2940161907
!
!
crypto pki certificate chain TP-self-signed-2940161907
certificate self-signed 01
quit
dot11 syslog
no ip source-route
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.160.1 10.10.160.4
ip dhcp excluded-address 10.10.160.26 10.10.160.254
!
ip dhcp pool sdm-pool1
import all
network 10.10.160.0 255.255.255.0
default-router 10.10.160.1
dns-server 10.10.100.207 4.2.2.2
domain-name ********.local
netbios-name-server 10.10.100.207
!
!
no ip bootp server
ip domain name Westcodeus.local
ip name-server 10.10.100.207
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
username ******** privilege 15 secret 5 $1$/3rY$JDVknScyoVzzkqK7stdYV0
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key HG45FV00HN address 146.145.35.**
!
!
crypto ipsec transform-set vpnset esp-3des esp-md5-hmac
no crypto ipsec nat-transparency udp-encaps
!
crypto map main 10 ipsec-isakmp
set peer 146.145.35.**
set transform-set vpnset
match address 100
!
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
bridge irb
!
!
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
pvc 8/35
encapsulation aal5snap
!
bridge-group 1
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
bridge-group 2
!
interface BVI1
mac-address 0000.0c52.05cc
ip address 71.2.59.2 255.255.255.128
ip nat outside
ip virtual-reassembly
crypto map main
!
interface BVI2
ip address 10.10.160.1 255.255.255.0
ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 71.2.59.1
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 101 interface BVI1 overload
ip nat inside source static 10.10.160.2 71.2.59.3 route-map nonat
!
logging trap debugging
access-list 1 permit 10.10.160.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.200.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.150.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.150.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.200.0 0.0.0.255
access-list 101 permit ip 10.10.160.0 0.0.0.255 any
!
!
!
route-map nonat permit 10
match ip address 101
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
bridge 2 protocol ieee
bridge 2 route ip
banner exec 
% Password expiration warning.
-----------------------------------------------------------------------
Cisco Router and Security Device Manager (SDM) is installed on this device and
it provides the default username "cisco" for one-time use. If you have already
used the username "cisco" to login to the router and your IOS image supports the
"one-time" user option, then this username has already expired. You will not be
able to login to the router with this username after you exit this session.
It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.
username <myuser> privilege 15 secret 0 <mypassword>
Replace <myuser> and <mypassword> with the username and password you want to
use.
-----------------------------------------------------------------------
banner login Authorized access only!

Disconnect IMMEDIATELY if you are not an authorized user!
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end