Yes, on the FL860 we have to get internet "allow all-services from lan-wan1 to all-nets" and "all-tcp"
This setting I have from D-link Sweden with the standard settings I had no internet.
I think the dfl860 blocks notthing and now I search for the settings to let the dfl to do the work.
The group that want access to the server with rdp is from outside the company the isa server shows the ip addresses and that whout i block with the firewall
I will copy and past the settings witch is now on the dfl.