<< are any of the workstations able to ping outside the router?
try www.cisco.com or something.
Also, you'll have to specify which DNS server is to be used, you can't leave it blank when manually changing IPs.
How are you denying "groups" IP addresses port requests, exactly? >>
I have set...