been a while....

I recently signed up with Slingshot's (naked, unshaped, unlimited) VDSL service with 'global mode', and for the most part I'm a very happy camper.

I've set up the provided router into bridged mode & managing the PPPoE connection myself via my (hardened) pfSense firewall, and have set up my environment to use SlingShot's preferred DNS's @ 202.180.64.10 & 202.180.64.11. I still use 8.8.8.8 for non-entertainment hosts, but have blocked them for the entertainment hosts as per the ISP's docco's.

So far, so good: I've been watching previously unavailable media such as Hulu & BBC iPlayer without issue, so I believe the 'global mode' functionality is set up correctly for use by my media devices.

The problem I've got specifically is that I've plugged in this new Roku 3, did a factory reset on it, given it a static DHCP IP lease on my network (so as to have better control over what to block, allow & redirect), but it fails to come up as expected.

I pick wired connection, get the 3 green checks to show it getting internet connectivity OK, but then it tries to poll the update server & fails with "error code 003", and thereafter also fails to complete the registration process.

On the gateway I log the following connections:
* 8.8.8.8 - blocked as per docco's
* 202.180.64.10:53 & 202.180.64.11:53 - ISP DNS
* a bunch of IP's, 74.125.237.* & 208.111.*.* (on port 80 & 443) resolving somewhere in the US, so I can only guess they're Roku hosts.

I've run a basic curl on those IP's & found:
* 4 IP's in the in the 208.*-range that are either empty, "^U^C^A^@^B^B(", or "^U^C^A^@^B^B(" - I suspect these to be Roku hosts.
* 4 pages that look to be Google landing page (not sure why this would be...)

So, I'm getting 'global mode' for media on mobiles & browsers, but on on the dedicated Roku for some reason.
I doubt the problem is local (but need to re-check some assumptions again), and I've tried communicating this to the tech support folks.

Considering there's a setup guide for the Roku stick, others must have had butter luck than I, so I'd like to to know if I'm overlooking anything.

What am I missing?
Anyone else here on the SlingShot 'global mode' service with a Roku 3?