UNABLE TO ACCESS THE INTERNET FROM LOCAL PROVIDER ON A SITE-TO-SITE VPN CONNECTION

Question

Dear All,
I have a site-to-site connection  from point A to point B. From point B i am unable to access the internet from local internet provider.
I am trying to ping from 192.168.20.1 the dns 8.8.8.8   but i receive the  message "destination net unreachable".
When i run "show ip nat translation" i receive nothing.
The vpn connection is working properly, i can ping the other side 192.168.10/24
Below is the configuration of the cisco router on point B.
dot11 syslog
ip source-route
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.21.254
ip dhcp pool voice
 network 192.168.21.0 255.255.255.0
 default-router 192.168.21.254 
 option 150 ip 192.168.5.10 
ip cef
ip domain name neocleous.ru
ip inspect name IOS_FIREWALL tcp
ip inspect name IOS_FIREWALL udp
ip inspect name IOS_FIREWALL icmp
ip inspect name IOS_FIREWALL h323
ip inspect name IOS_FIREWALL http
ip inspect name IOS_FIREWALL https
ip inspect name IOS_FIREWALL skinny
ip inspect name IOS_FIREWALL sip
no ipv6 cef
multilink bundle-name authenticated
vty-async
isdn switch-type primary-net5
redundancy
crypto isakmp policy 5
 hash md5
 authentication pre-share
 group 2
crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
 lifetime 28800
crypto isakmp policy 50
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key Pb85heuvMde9Wdac5Qohha7lziIf142u address [ip address]
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 10
crypto ipsec transform-set TRANSET esp-aes esp-sha-hmac 
crypto ipsec transform-set TRANSET2 esp-des esp-md5-hmac 
crypto ipsec df-bit clear
crypto map CryptoMAP1 ipsec-isakmp 
 set peer [ip address]
 set transform-set TRANSET 
 match address CryptoACL
interface FastEthernet0/0
 description Primary Provider
 ip address [PUBLIC IP MAIN PROVIDER] 255.255.255.252
 ip access-group outside_acl in
 ip mtu 1390
 ip nat outside
 ip virtual-reassembly in
 load-interval 30
 duplex auto
 speed auto
 crypto map CryptoCY
 crypto ipsec df-bit clear
interface FastEthernet0/1
 description TO LAN
 no ip address
 load-interval 30
 speed 100
 full-duplex
interface FastEthernet0/1.1
 description DATA VLAN
 encapsulation dot1Q 20
 ip address 192.168.20.254 255.255.255.0
 ip access-group inside_acl in
 ip nat inside
 ip inspect IOS_FIREWALL in
 ip virtual-reassembly in
 ip tcp adjust-mss 1379
interface FastEthernet0/1.2
 description VOICE VLAN
 encapsulation dot1Q 21
 ip address 192.168.21.254 255.255.255.0
interface Serial0/2/0:15
 no ip address
 encapsulation hdlc
 isdn switch-type primary-net5
 isdn incoming-voice voice
 no cdp enable
interface FastEthernet0/3/0
 no ip address
 ip access-group outside_acl in
 ip nat outside
 ip virtual-reassembly in
 shutdown
 duplex auto
 speed auto
 crypto map CryptoCY
ip local pool VPNPool 192.168.23.2 192.168.23.10
ip forward-protocol nd
ip http server
no ip http secure-server
ip nat inside source list nat_list interface FastEthernet0/3/0 overload
ip route 0.0.0.0 0.0.0.0 [default gateway ip]
ip access-list standard VTY
  permit 192.168.20.0 0.0.0.255
ip access-list extended CryptoACL
 permit ip 192.168.20.0 0.0.0.255 192.168.3.0 0.0.0.255
 permit ip 192.168.21.0 0.0.0.255 192.168.5.0 0.0.0.255
 permit ip 192.168.21.0 0.0.0.255 192.168.6.0 0.0.0.255
 permit ip 192.168.21.0 0.0.0.255 192.168.12.0 0.0.0.255
 permit ip 192.168.21.0 0.0.0.255 192.168.2.0 0.0.0.255
 permit ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
 permit ip host 192.168.22.1 192.168.5.0 0.0.0.255
 permit ip host 192.168.20.1 192.168.5.0 0.0.0.255
 permit ip host 192.168.22.1 192.168.6.0 0.0.0.255
ip access-list extended DFBIT_acl
 permit tcp any any
ip access-list extended inside_acl
 permit ip 192.168.20.0 0.0.0.255 host 192.168.3.35
 permit ip 192.168.20.0 0.0.0.255 host 192.168.3.39
 permit ip 192.168.20.0 0.0.0.255 host 192.168.3.23
 permit ip 192.168.20.0 0.0.0.255 host 192.168.3.18
 permit ip 192.168.20.0 0.0.0.255 host 192.168.3.55
 permit ip 192.168.20.0 0.0.0.255 host 192.168.10.144
 permit ip 192.168.20.0 0.0.0.255 host 192.168.10.146
 permit ip 192.168.20.0 0.0.0.255 host 192.168.10.141
 permit ip host 192.168.20.253 host 192.168.3.21
 permit ip host 192.168.20.254 host 192.168.3.21
 permit ip 192.168.20.0 0.0.0.255 host 192.168.3.10
 permit ip 192.168.20.0 0.0.0.255 host 192.168.20.254
ip access-list extended nat_list
 deny   ip host 192.168.20.254 192.168.10.0 0.0.0.255
 deny   ip host 192.168.20.254 192.168.3.0 0.0.0.255
 deny   ip host 192.168.20.1 192.168.3.0 0.0.0.255
 deny   ip host 192.168.20.1 192.168.10.0 0.0.0.255
 deny   ip host 192.168.20.2 192.168.3.0 0.0.0.255
 deny   ip host 192.168.20.2 192.168.10.0 0.0.0.255
 permit ip host 192.168.20.1 any
 permit ip host 192.168.20.2 any
 permit ip host 192.168.20.254 any
ip access-list extended outside_acl
 permit gre any host [ip address]
 permit esp any host [ip address]
 deny   ip any any
ip sla 2
 icmp-echo 192.168.10.254 source-interface FastEthernet0/1.1
 frequency 180
 timeout 500
ip sla schedule 2 life forever start-time now
logging 192.168.3.21
route-map DFBIT_routemap permit 10
 match ip address DFBIT_acl
 set ip df 0
route-map ISP2 permit 10
 match ip address nat_list
 match interface FastEthernet0/3/0
route-map nonat permit 10
 match ip address nonat_acl
route-map ISP1 permit 10
 match ip address nat_list
 match interface FastEthernet0/0

Answer 1

You cannot access internet, because all traffic is tunneled for VPN !!!!
Please see cisco tech documentation and bypass traffic for internet.
eg.  if lan traffic is going from site a to site b  then through vpn
      else
       lan traffic to internet (any) should be out thorugh the vpn .