Cannot get NAT & Firewall configured correctly.

Question

Hi,
I have spent days reading and trying to get this to work with no luck.
I am trying to open port 3389 for RDP to an internal PC.
I am also trying to get a H.323 IP phone to communicate to the PBX. I have tried allowing all communications from my home office IP addrerss through the dialer1 interface, but still no go.
Info regarding the installation:
Cisco 880 Series Router
DSL service into the building - PPPoe Dialler1 Interface
VLAN1 - Internal Network 1 - Gateway 192.168.1.1
VLAN2 - Internal Network 2 (currently no devices on network) - Gateway 192.168.2.1
VLAN3 - Wireless Network - Gateway 192.168.3.1
PBX is on VLAN1 - 192.168.1.10
Current config:
show run
Building configuration...
Current configuration : 6141 bytes
! Last configuration change at 22:11:10 PCTime Sat Jan 3 2015 by nathan
version 15.2
no parser cache
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
hostname BladePile
boot-start-marker
boot-end-marker
logging buffered 51200
enable secret 5 XXXXXXXXXXXXXXXXXX
enable password 7 XXXXXXXXXXXXXXXXXXX
no aaa new-model
memory-size iomem 10
clock timezone PCTime 10 0
clock summer-time PCTime date Mar 30 2003 3:00 Oct 26 2003 2:00
crypto pki trustpoint TP-self-signed-3103805736
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-3103805736
 revocation-check none
 rsakeypair TP-self-signed-3103805736
crypto pki certificate chain TP-self-signed-3103805736
 certificate self-signed 01
  XXX
  quit
ip dhcp excluded-address 192.168.1.1 192.168.1.50
ip dhcp excluded-address 192.168.2.1 192.168.2.50
ip dhcp excluded-address 192.168.3.1 192.168.3.50
ip dhcp pool vlan1
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
 dns-server 203.134.64.66 203.134.65.66
 lease 7
ip dhcp pool vlan2
 network 192.168.2.0 255.255.255.0
 default-router 192.168.2.1
 dns-server 203.134.64.66 203.134.65.66
 lease 7
ip dhcp pool vlan3
 network 192.168.3.0 255.255.255.0
 default-router 192.168.3.1
 dns-server 203.134.64.66 203.134.65.66
no ip bootp server
ip name-server 203.134.64.66
ip name-server 203.134.65.66
ip cef
no ipv6 cef
ipv6 spd queue min-threshold 30
ipv6 spd queue max-threshold 31
multilink bundle-name authenticated
license udi pid CISCO887VA-SEC-K9 sn XXXXX
archive
 log config
  hidekeys
username XXXXX privilege 15 password 7 XXXXXXXXXXXXXXX
controller VDSL 0
ip tcp synwait-time 10
interface Ethernet0
 description $ETH-WAN$
 ip address dhcp client-id Ethernet0
 ip nat outside
 ip virtual-reassembly in
 ip tcp adjust-mss 1452
 shutdown
interface ATM0
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no atm ilmi-keepalive
 hold-queue 224 in
 pvc 0/16 ilmi
 pvc 8/35
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
interface FastEthernet0
 switchport trunk allowed vlan 1-3,1002-1005
 switchport mode trunk
 no ip address
interface FastEthernet1
 no ip address
 spanning-tree portfast
interface FastEthernet2
 switchport access vlan 2
 no ip address
 spanning-tree portfast
interface FastEthernet3
 switchport access vlan 3
 no ip address
 spanning-tree portfast
interface Vlan1
 ip address 192.168.1.1 255.255.255.0
 ip access-group 101 in
 ip nat inside
 ip virtual-reassembly in
 hold-queue 32 in
 hold-queue 100 out
interface Vlan2
 ip address 192.168.2.1 255.255.255.0
 ip access-group 102 in
 ip nat inside
 ip virtual-reassembly in
 hold-queue 32 in
 hold-queue 100 out
interface Vlan3
 ip address 192.168.3.1 255.255.255.0
 ip access-group 103 in
 ip nat inside
 ip virtual-reassembly in
 hold-queue 32 in
 hold-queue 100 out
interface Dialer0
 no ip address
 no cdp enable
interface Dialer1
 ip address negotiated
 no ip unreachables
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly in
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 ppp authentication chap callin
 ppp chap hostname XXXXXXXXXXXXXXX
 ppp chap password 7 XXXXXXXXXXXXXXXX
 ppp pap sent-username XXXXXXXXXXXXXX password 7 XXXXXXXXXXXXXX
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip flow-top-talkers
 top 10
 sort-by bytes
ip nat inside source list 100 interface Dialer1 overload
ip nat inside source static tcp 192.168.1.20 3389 interface Dialer1 22000
ip nat inside source static tcp 192.168.1.55 3389 interface Dialer1 22001
ip route 0.0.0.0 0.0.0.0 Dialer1
logging trap debugging
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 100 permit ip 192.168.2.0 0.0.0.255 any
access-list 100 permit ip 192.168.3.0 0.0.0.255 any
access-list 101 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 deny   ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 101 permit ip any any
access-list 102 deny   ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 102 deny   ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 102 permit ip any any
access-list 103 deny   ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 103 deny   ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 103 permit ip any any
dialer-list 1 protocol ip permit
no cdp run
control-plane
line con 0
 no modem enable
 stopbits 1
line aux 0
line vty 0 4
 exec-timeout 40 0
 privilege level 15
 password 7 XXXXXXXXXXXXXXXXXX
 login local
 transport input telnet ssh
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
sntp server 192.189.54.17
end

Answer 1

Thanks for the additional information which does clarify several things. I am glad that the RDP issue is resolved and that it was not a router issue.
It is helpful to know that the phones that are in vlan 1 are working. And it is not surprising that a phone at your home office accessing via the Internet is not working. The essence of the problem with the phone at the home office is what IP address does it attempt to access? The config that you posted shows that devices inside (which should include the phone system) are getting dynamic address translation. So it is not feasible for a device from outside to initiate traffic to an inside device. I would suggest that this is essentially the problem that you faced in trying to support RDP from outside. So the solution for your home office phone would be similar to the solution for RDP (but will be more complex because of the greater number of ports involved).
To answer your question about whether the ports can be opened only to one IP address depends on how the network in your home office is working. Does it ALWAYS have the same IP going to the Internet. If so then you could do a static translation for the ports specifying the source address and the destination address. If it is variable they you need to do the translation for any source address.
HTH
Rick