PIX501 Clients can not acccess internet

Clients can't access internet. This is a new setup. Server can get to internet though. Can anyone tell me what I might be missing? x.x.x.x is my public ip.

PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password ibAAe.FWNRCKdvxJ encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname PIXHOU domain-name xxxxxx.local fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 no fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list 100 permit icmp any any echo-reply access-list 100 permit icmp any any time-exceeded access-list 100 permit icmp any any unreachable access-list 100 permit tcp any host x.x.x.x eq www access-list 100 permit tcp any host x.x.x.x eq smtp access-list 100 permit tcp any host x.x.x.x eq https access-list 100 permit tcp any host x.x.x.x eq pop3 access-list 100 permit tcp any host x.x.x.x eq 3389 pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside x.x.x.x 255.255.255.0 ip address inside 192.168.2.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location 192.168.1.0 255.255.255.0 inside pdm location 192.168.2.2 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 10 interface nat (inside) 10 192.168.2.0 255.255.255.0 0 0 nat (inside) 10 0.0.0.0 0.0.0.0 0 0 static (inside,outside) x.x.x.x 192.168.2.2 netmask 255.255.255.255 0 0 access-group 100 in interface outside route outside 0.0.0.0 0.0.0.0 x.x.x.x 1 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225

I can't seem to figure why I can get on the internet with my server, but none of the clients. They get an ip, but can not open any websites. Below is my config, with x.x.x.x for my public IP. Can anyone take a look and tell me what I might be missing? Thanks

PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password ibAAe.FWNRCKdvxJ encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname PIXHOU domain-name abc123.local fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 no fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list 100 permit icmp any any echo-reply access-list 100 permit icmp any any time-exceeded access-list 100 permit icmp any any unreachable access-list 100 permit tcp any host x.x.x.x eq www access-list 100 permit tcp any host x.x.x.x eq smtp access-list 100 permit tcp any host x.x.x.x eq https access-list 100 permit tcp any host x.x.x.x eq pop3 access-list 100 permit tcp any host x.x.x.x eq 3389 pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside x.x.x.x 255.255.255.0 ip address inside 192.168.2.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location 192.168.1.0 255.255.255.0 inside pdm location 192.168.2.2 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 10 interface nat (inside) 10 192.168.2.0 255.255.255.0 0 0 nat (inside) 10 0.0.0.0 0.0.0.0 0 0 static (inside,outside) x.x.x.x 192.168.2.2 netmask 255.255.255.255 0 0 access-group 100 in interface outside route outside 0.0.0.0 0.0.0.0 x.x.x.1 1 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225

In each of the above lines, replace host x.x.x.x by the phrase interface outside For example,

access-list 100 permit tcp any interface outside eq pop3

I would suggest that you should not have that second nat (inside) statement. The only way it could be useful is if you had inside traffic whose source IP was not in the 192.168.2/24 range -- but when the replies come back for any such traffic, the PIX would have to drop the replies because you have no 'route' statement telling the PIX to send that traffic to the inside interface. Thus, the only traffic that would have any benefit from that second nat (inside) statement would be virus traffic that uses random forged source IP addresses to send disruptive traffic to external machines.

That's your main problem. You cannot static your outside IP address as a whole. Get rid of it and replace it with a series of statements

static (inside,outside) tcp interface www 192.168.2.2 www netmask

and repeat with www changed to smtp https pop3 3389, one by one.

Why are you allowing 192.168.1/24 to access PDM? You have no other mention of 192.168.1/24 and there is no route back for it through any interface.

dhcpd auto_config outside is only useful if you are using ip address outside dhcp in order for the PIX itself to get an IP address and route settings (for itself) from an external DHCP server; dhcpd auto_config then allows the route and WINS and DNS values from to be copied from the external server over to any internal dhcp clients that are relying on the PIX to provide them with address information. But you are not using ip address outside dhcp so there will be nothing from the outside to copy, so there is no point having the line.