And in the exception rule you created via the policy, in the 'Allow unsolicited incoming messages...' dialogue, you've got a single entry for "localsubnet"?
Just out of interest, have you tried specifying the actual subnet itself, as opposed to using the localsubnet string?
Another thing you could try, is managing this particular policy from a 2008 / Win7 machine (that will have the later policy templates). So, for e.g., run up gpmc.msc from the 2k8 server, and edit the setting from there (or create a second test policy with the same setting and link it to the same OU).
The key to that last suggestion is simply to manage/create this policy setting using a machine that has the latest templates, just in case there is a subtle difference in how the firewall exception is actually implemented in 2k8.
They're just guesses I'm afraid, as I don't have an environment that I can replicate the problem in... (All our DCs are 2k8).
Worth a shot though!
Pete
