The next thing I'd check is for some kind of filtering. Filtering can be implemented using Routing and Remote Access -- presumably you would know if it were enabled, but it's good to double-check.
Probably the most likely cause of your problems is also the most difficult to understand and resolve. It's probably a routing problem. You want to configure Routing and Remote Access so that the default gateway is the router that heads to the public Internet. It's entirely possible that the default gateway is now an internal router, or more likely, your VPN. From the Web server, use the PATHPING command-line tool to ping an address on the public Internet. Is the route what you expect, or does it attempt to go through the VPN or internal networks? If it doesn't go directly to the public Internet, then you've isolated your problem: routing configuration. Use the Routing and Remote Access console and examine the routes configured. If that doesn't work, use the ROUTE command-line tool.
This was first published in August 2003