I don't see nothing wrong in the config, I hope I didn't miss something. Is it possible that the user of the machine behind the router did something, on his side, to prevent access to certain sites ? What does the ping and traceroute say about the sites in question ? Is this the only machine behind the router having issues with access ?