Well, test results have been confusing in part because of a loose ethernet jack.
However, it seems it is in fact the firewall - the firewall is not allowing internet traffic for IP's in the range offered by DHCP. Haven't finished testing so I don't know the exact range but I gave DHCP a...