I assume this is a filtering issue but I don't know. If I remove the proxy
settings (uncheck the box in IE, Internet Options, Connections, LAN
settings, Use a proxy server), I can still browse, and I can tell it's not
through the proxy because I can watch the proxy console on the server - it
shows no connections. If I configure myself to use the proxy, I do go
through it and it's working as I want.

For a starter, in FILTCFG, I have

STATUS - enabled

ACTION - deny packets in filter list
(permit packets not in filter list)

FILTERS - (list of denied packets)
EXCEPTIONS - (list of packets always permitted)

I hope this is correct.

When I click on (list of denied packets), I have two items,

Source Packet Type Destination
<All Interfaces> <Any> PUBLIC
PUBLIC <Any> <All Interfaces>

I just went through all the actual filter exceptions (list of packets always
permitted) and don't find anything that shouldn't be there for a specific
purpose. The only filter with a dest. port of 80 has a source IP address of
our windows server, which is not the workstation I'm testing from. It's for
stateful http (http-st).

There are a few filters that are questionable, I guess - is there a way to
disable an individual filter exception without removing it? I didn't see
that in filtcfg.

TIA for where to look next at this one.