Re: To enter on account not ip doubt

This isn't going to do you any good:

    nat {
        rule 1 {
            description servidor
            destination {
                port 5950
            }            inbound-interface eth0            inside-address {
                address 192.168.2.201
                port 5950
            }
            log disable
            protocol tcp
            source {
            }
            type destination
        }

Your (primary) WAN interface is pppoe0, not eth0.

Also, you'll need to create a duplicate of this rule (and the other one) to handle incoming traffic on pppoe1.

Also, take out everything in "port forwarding" (as it'll fight with the DNAT rules). Given your setup, you'd likely be better off running an internal DNS server than trying to use NAT Hairpin too (IMO, hairpin is an ugly hack -- not UBNT's fault -- to let admins be lazy and have 'one less thing' to do)