Not sure if this should be reported as a bug or not, so please bear with me.
A "scrub on $ext_if reassemble tcp" will deny some SuSE clients access to some Microsoft IIS webservers. This appears to be an issue with SuSE's latest kernel (2.4.20-100) only.
tcpdump data would help, for both interfaces. You can either write a file (-w) or provide at least -vx output.
