Http Return Traffic With Td-w8960n

I purchased a TD-W8960N ADSL modem+router to replace the 2WIRE device that I had been renting from BELL. After entering my BELL b1xxxxnn authentication, the default config almost works, but not quite. It seems like I do not receive any return traffic (from the web) for HTTP, so I cannot browse. VPI/VCI (0/35) are correct, the PPPoE connection is established, and the router is assigned an IP address. I can ping the outside. The routes look like what I expected. I get DNS server info from the established connection. DHCP seems to work: DHCP gives addresses to LAN devices, and I can access the router's web interface on 192.168.1.1. NTP seems to work (router gets the correct time.) DNS seems to work correctly. From a terminal session, I can run nslookup to verify that the dns resolver (192.168.1.1) works; I can get answers for www,fda.gov, www.microsoft.com, etc. So far so good. But when I use a browser, I get nothing back, almost as if the router were blocking the return traffic: browser reports timeout waiting for [website]. Interestingly, this behaviour is the same when the connecting device is Ubuntu 11.10 or Win7. Both do work unchanged with BELL's 2WIRE modem. I am doing all this with a wired connection, for now, to reduce complexity. I have upgraded the router firmware. Same behaviour with Firefox, IE, and Chromium browsers. More and more my hunch is that the SPI Firewall is blocking something it shouldn't, namely return traffic ("ESTABLISHED") on tcp/80. Specifically, from a LAN-connected host I can do "telnet www.fda.gov 80" and establish a connection, which confirms that DHCP, DNS and routing are OK. But I never receive any traffic from the host. Would love to test this with the SPI Firewall off. But the on/off checkbox for the firewall is not available for PPPoE. Anyone know how to completely turn off this router's firewall under PPPoE? Same behaviour if I set DMZ=LAN-IP. Any and all suggestions for what to try next, are welcome.