XG135 web problems only on two laptops

No - the idea is to capture the packets that are going out from the non-working laptop.  So you start the packet capture (with the filter as mentionned above), then you immediately go on the non-working laptop and try the different websites that aren't working.  The firewall will then capture the packets for that IP address (30.114), and it will give us a better picture of what exactly is going on and why some of the packets are blocked/dropped - and under which rule this is happening.

got it!

here we are

and yes....all the Incominf status rows are with the same Source Mac and Destination Mac, as all the Forward Status row....as below

incoming

and Forward

Can you do the same (with youtube) with one that works?  I see the NAT ID and Rule ID - I want to make sure they both use the same nat/rules?

here we are  

and

Do you have any of the "incoming" packets too?  Also - can you screenshot the Firewall Rule 3 and NAT rule 7?  And give me a screenshot of your firewall log filtered with src IP 192.168.30.114 and action - is not - allowed ?  

i didn´t see incoming packets....too much traffic on my laptop, anyway:

Firewall rule

and the nat rule

The nat rule seems to be only for DNS service, so it seems to NAT your DCs to your External-DNS whatever it is - but it's not going to nat your other requests...  I don't think this is the right NAT rule..  There is the rule # which is the actual row number - not the NAT ID - I'm looking for the one that has 7 in the "Id" column.

can you expand the  "configure synchronize security" part of the rule?  I also don't see the detect and prevent exploits part of the rule

sorry my fault.......

Quickly - ideally, you would set an outbound interface to whatever your WAN port is - not leaving it to Any.  Also - Firewall/Web/App filter log would be helpful.  But I would suggest you set an outbound interface on ur nat rule...

Also - looking at this rule here - because the dns are going outside, the Translated Source shouldn't be original?  Are the "External-DSN" Wan ips?  if so - this NAT rule should be set in the SNAT as MASQ (or whatever external ip you want it to be translated to...)