We have BM 3.8.4 on NW 6.5.4. We have had HTTP proxy enabled for some
time, and it was working well. We just changed ISP, and I had to reset
the public IP address on the BM server. I changed everything in
inetcfg, manually reset the address in every filter in filtcfg, and
changed the public addess in NWAdmin. Filters are enabled in inetcfg,
and ipflt is loaded. (In case it matters, the server also has one each
C2S and S2S VPN, and they are working.) Now it seems that port 80 is
wide open, as anyone can get to the Internet without having to
authenticate to the proxy.

Is there a quick fix, or is it time to use brdcfg?