And likely an ACE that permits traffic. Is this thru an ASA or a router? Is the an ACL applied to the external interface? It seems like your outbound NAT works correct, but you either are not doing a static nat or port forwarding, and/or not permitting the traffic to be initiated from the outside.
