It's fine now. I don't think that basic W.NT really does NATing but it could route two or more Networks (depending on how many NICs) that have the same subnet mask. Example 192.168.4.x and 192.168.5.x both with subnetmask 255.255.255.0
NATing is usually done between totally different Networks.
The solution to my previous problem was to add a route statement on the router accessed by the outside NIC of the NT server.
Now I'm wondering if I can authenticate users on the in-side of the NTserver to access the Internet. They can now but they're not being monitored and controled. Something like a proxy server. But can we do it without the proxy server ?